Security assessment of your AWS infrastructure compared to current industry best practices, including an external penetration test.

Assessment Overview

Phases of penetration testing activities include the following:

1. Planning - Customer goals are gathered and rules of engagement obtained
2. Discovery - Perform scanning and enumeration to identify potential vulnerabilities, weak areas, and exploits
3. Attack - Confirm potential vulnerabilities through exploitation and perform additional discovery upon new access.
4. Reporting - Document all found vulnerabilities and exploits, failed attempts, and company strengths and weaknesses.

Tools Used

• dnslookup
• dnsrecon
• securityheaders
• hunter.io
• Netcraft
• BuitWith
• HaveIBeenPwnd
• httrack
• nmap
• nikto
• netcat
• wpscan
• Metasploit
• Burp Suite
• Published and customized exploit code and scripts

Internal Penetration Test

Internal network pen testing simulates an attack on your organization based on the premise that the hacker already has access to your internal network. From there, the test aims to document and analyze exactly what the attacker can do once inside.

External Penetration Test

An external penetration test emulates the role of an attacker attempting to gain access to an internal network without internal resources or inside knowledge. A TrackIt engineer attempts to gather sensitive information through open-source intelligence (OSINT), including employee information, historical breached passwords, and more that can be leveraged against external systems to gain internal network access. The engineer also performs scanning and enumeration to identify potential vulnerabilities in hopes of exploitation.