Penetration testing experts
Certified penetration testers, ready to help you secure your web facing services.
What is penetration testing?
The definition of Penetration Testing, informally known as a Pen Test, is an attack on a computer system that looks for security weaknesses, potentially gaining access to the computer’s features and data. The goals of a penetration test varies depending on the type of approved activity for any given engagement with the primary goal focused on finding vulnerabilities that could be exploited by a nefarious actor, and informing the client of those vulnerabilities along with recommended mitigation strategies
Our core penetration testing services
Website penetration testing
For people who wish to test the security of their websites.
Web Application Penetration Testing
For people looking to test the security of a web application they have developed.
External Network Penetration Testing
For people that are looking to evaluate the security of their web facing network and services.
Internal Network Penetration Testing
Also known as Infrastructure Penetration Testing, for people looking to assess network security.
Mobile App Penetration Testing
For people looking to test the security of their mobile apps.
PCI Penetration
Assistance with PCI DSS compliance phases 11 to ensure security compliance.
How does penetration testing work?
Before you consider a penetration test, it’s important to learn how they work and the types of tests available. There are essentially two main types of penetration tests, blackbox penetration testing often called external penetration testing, or whitebox penetration testing, often called internal penetration testing.
Blackbox pen testing audits the target from an outsiders perspective, with no prior knowledge of the system, and is generally the most preferred type of test. Whitebox pen testing looks at the target host with insider knowledge, meaning a user account or some form of access has been granted to the penetration tester.
Whitebox tests are often done after an initial blackbox test in order to test account access controls, or to see if any flaws exist which would allow potential privilege escalation from within a website or web app. Both blackbox and whitebox penetration tests work within a set framework, generally consisting of four broad phases, network enumeration, vulnerability assessments, exploitation and finally reporting and remediation.
Network enumeration aims to gather as much information about the network as possible using a variety of tools and techniques. Penetration tests audit the information obtained for known flaws and weaknesses, which are then validated where possible using exploits. The final stage of the assessment is documenting and reporting on the findings to help you mitigate the discovered vulnerabilities.
Our penetration testing methology
Outlined to the right is a simplified visual version of our penetration testing methodology. In reality, there are hundreds of items that are checked when it comes to vulnerability and exploitation/attack phases.
Discovery
Host discovery aims to map out your digital assets so we can understand more about your setup and services.
Probing
Once we’ve identify your assets we will start probing them for information using various tools at our disposal.
Service Fingerprinting
More in-depth probing on services we’ve identify as running on your assets or frameworks running on your websites / apps.
Vulnerability mapping
We begin to map out any vulnerabilities in your services and categorise them by severity level.
Attack vectors
We plan a pathway of attack against your systems/services/websites also known as an attack vector where we work how we are going to breach your systems.
Exploit preparation and testing
We prepare exploits and if necessary build our own to exploit your systems through our chosen attack vector.
Execution
Exploits are used to breach your systems in-line with our chosen attack vector. We validate successful exploitation and start exploring your systems.
Pivoting
Once inside your systems we attempt to pivot internally to other systems or networks where possible to expand our breach.
Reporting
When our testing is complete we document and report our findings to you categorising vulnerabilities by impact level. We outline how you can fix vulnerabilities discovered to mitigate all threats and improve your security posture going forward.
Leaders in penetration testing
As the UK Government launches the NCSC to keep up with cyber criminals, we too are always researching and trying to gain insight into what hackers are up to. As part of our research we test services through tools and systems we have developed at our offices here in London in the UK, to try and identify new vulnerabilities. This has led to the development of many of our own security platforms and penetration testing tools, which gives us a competitive advantage when detecting system vulnerabilities. Our qualified security experts have performed countless penetration testing jobs for a variety of businesses globally. We have access to huge security vulnerability databases and unique private Proof of Concept (PoC) attack frameworks developed by our engineers in-house. All of our engineers are based in the UK and are certified experts in cyber security and penetration testing. We only use CREST penetration testers and consultants who have achieved certifications like OSCP and CHECK Team Leader status. Make an enquiry to discuss how we can help you meet your security requirements.
FAQs
What you need to know.
Why should I get a penetration test?
It is an important service that any business with sensitive data on their networks should consider. The information obtained from a penetration test may help prevent security breaches in critical web facing infrastructure, as well as flaws within the local area network. The information can be used to better prepare your business against the ever present threat of cyber attacks. Getting tested may also provide additional intelligence to help complete risk assessments and to seek additional funding when changes need to be made. We have compiled a list of free penetration testing tools however these should only be used if you know what you are doing with them, we highly advise using our professional services when considering a penetration test, please contact us for further information. Check out our penetration testing infographic to learn why you should consider getting one.
How much does a penetration test cost?
Costs of a security audit / penetration test can vary considerably, depending on the project size, and often what the clients scope or objectives are. Each test is quoted for once a full understanding of all the aims and objectives from the client have been made clear. If you are interesting in obtaining a free quote please contact us.
How long does it take to perform a penetration test?
On average, for a single website or web application assessment it can take one to two weeks, depending on the size of the website/app this may increase or decrease. Another factor that can affect how long a test takes is how many vulnerabilities we uncover whilst testing. If the target for the test is riddled with security vulnerabilities then it can take longer to test and write up the report. The golden rule when looking to carry out penetration testing is to leave plenty of planning time before (to establish a scope), and after (to fix the detected threats). We get a lot of customers who wish to get the testing done last minute, and forget that they will need to allocate time after the test to implement all the fixes. We always do our best to keep you updated throughout the testing process so you know when you can expect your final report.
UK Penetration Testing Company
To keep up with cyber criminals, we are always researching and trying to gain insight into what hackers are looking to take advantage of. As part of our research we test services through tools and systems we have developed at our offices here in London in the UK, to try and identify new vulnerabilities. This has led to the development of many of our own security platforms and penetration testing tools, which gives us a competitive advantage when detecting system vulnerabilities. Our qualified security experts have performed countless penetration testing jobs for a variety of businesses globally. We have access to huge security vulnerability databases and unique private Proof of Concept (PoC) attack frameworks developed by our engineers in-house. All of our engineers are based in the UK and are certified experts in cyber security and penetration testing. We only use CREST penetration testers and consultants who have achieved certifications like OSCP and CHECK Team Leader status. Make an enquiry to discuss how we can help you meet your security requirements.
REGISTERED MEMBERSHIPS AND PARTNERS
Ready to take your next step?
Contact us for a quote and free initial consultation