Infrastructure
Compromising machines in the infrastructure is the endgame of any sophisticated attacker.
Attacks on the infrastructure can result in:
- Personal Data Leaks
- Leak of Company Secrets (Corporate Espionage)
- Loss in revenue, from machine downtime or data corruption
What is it?
Penetration testing company infrastructure to find vulnerabilities and exploit them, while giving concrete remediation tactics.
Attacking either specific elements or the entire infrastructure
Typical Targets:
- Workstations
- Servers
- Domain Controllers
- Printers
- IoT devices
- Routers
- Miscellaneous Shadow IT
Variations/Focuses of Infrastructure Penetration Tests:
- General Infrastructure
- Active Directory
- Wireless
- IoT
- NAC
How is it done?
Our Approach:
- Starting broad, ending narrow
- Finding vulnerabilities and machines of interest
- Exploiting vulnerabilities
- Escalating privileges on exploited machines
- Pivoting from one machine to other important machines
Typical attack methods:
- Authentication related attacks like:
- Relay Attacks
- Pass the Hash
- Man-in-the-Middle
- Rogue authentication Servers
- Insecure Passwords
- Attacking common vulnerabilities in protocols/services/OS like:
- Eternal Blue
- Heartbleed
- Shellshock
- Dirty COW
- KRACK
- and much, much more
What do we deliver?
A structured report detailing the found vulnerabilities and the recommended remediation strategies.