PENETRATION TESTING

The External Black Box Penetration Testing simulates an external actor from the internet, without any previous knowledge of the infrastructure and/or configuration, that attacks the external facing network services on the target perimeter. The approach is goal oriented and aims to demonstrate the maximum impact of a successful attack that could allow a third party to obtain unauthorized access to the data served by the systems in scope with respect to the confidentiality, integrity and availability of the latter.

More specifically, the attack vectors within the context of the Penetration Testing will evaluate the ability of an external actor to:

• Obtain unauthorized system or network privileges
• Obtain unauthorized access to sensitive data
• Modify, corrupt or destroy data
• Eavesdrop network communications
• Change or introduce software, malicious or otherwise

The objective of the Penetration Testing is (a) to discover and exploit security weaknesses on the perimeter in scope, (b) to identify the level of risk associated with these weaknesses and (c) to recommend countermeasures to in order to mitigate the associated risk.

The Penetration Testing is conducted remotely, by combining industry leading automated testing tools along with Obrela Labs’ manual testing methods that aim to identify and exploit both known and unknown software flaws, misconfigurations and operational/control weaknesses while the testing is focused on in-depth coverage.

The Internal Penetration Testing simulates a malicious agent (e.g. employee, vendor, contractor) that has access on the internal network, without previous knowledge of the infrastructure and/or configuration – attacking the internal corporate network and systems. The approach is goal oriented and aims to demonstrate the maximum impact of a successful attack initiated from the internal network that could allow an attacker to obtain unauthorized access to the data served by the systems in scope with respect to the confidentiality, integrity and availability of the latter.

More specifically, the attack vectors within the context of the Penetration Testing will evaluate the ability of an internal actor to:

• Obtain unauthorized system or internal network privileges
• Obtain unauthorized access to sensitive data
• Modify, corrupt or destroy data
• Eavesdrop network communications
• Change or introduce software, malicious or otherwise

The objective of the Penetration Testing is (a) to discover and exploit security weaknesses on the internal network, (b) to identify the level of risk associated with these weaknesses and (c) to recommend countermeasures to mitigate the associated risk.

The Penetration Testing is conducted by combining industry leading automated testing tools  along with Obrela Labs’ manual testing methods that aim to identify and exploit both known and unknown software flaws, misconfigurations and operational/control weaknesses, while the testing is focused on in-depth coverage.

The Mobile Application Testing simulates a malicious application user that attacks the application in scope – assuming knowledge of credentials – by attempting to circumvent the application’s logic or by taking advantage of potential application’s security weaknesses in order to obtain unauthorized access to the data served by the application, with respect to the confidentiality, integrity and availability of the latter.

More specifically, the attack vectors within the context of the testing will evaluate the ability of a malicious user to:

• Obtain unauthorized access to sensitive data
• Modify, corrupt or destroy data
• Perturb the application and its components
• Change or introduce software, malicious or otherwise

The objective of the testing is (a) to discover -in depth- and exploit security weaknesses on the application, (b) to identify the level of risk associated with these weaknesses and (c) to recommend countermeasures to mitigate the associated risk.

Includes in-depth, pre- and post authenticated content of the server-side part of the application, its roles and the client application on user’s mobile phone. Fully OWASP compliant, Obrela’s highly skilled and certified Penetration Testers perform manual assessment on every area of interest i.e. Authentication, Session Management, Access controls, Input validation, Business Logic. Exploitation upon authorization is included in order to identify synergies among identified vulnerabilities.

The testing is conducted using a combination of industry leading automated testing tools along with Obrela Labs’ manual testing methods that aim to identify and exploit vulnerabilities according to OWASP framework.