Cloud Security · Ethical Hacking · AWS, Azure, GCP

Penetration Testing
in Cloud environments

Over the last decade, cloud-based technological environments have become key components within companies that are increasingly moving their services and/or systems to providers of such services.

Planning
Definition and identification of the systems to be audited
Audit
Progressive testing until intrusion is achieved
Documentation
Drafting of results obtained
Service

What is a Penetration Test in Cloud environments?

A cloud intrusion test is a controlled simulation of an authorized cyberattack on services, applications, configurations, and infrastructure hosted in the cloud.

It addresses the need for external security actions, taking into account the technological particularities, limitations, and considerations that must be kept in mind when carried out on cloud services. To do this, it simulates the actions of an attacker who wishes to compromise services, applications, or components, using the tools and methodologies typical of hackers, but in an ethical manner.

At Internet Security Auditors, we provide the most appropriate security solutions for all areas of Information Systems, with audit projects based on Ethical Hacking being one of them. The best way to perform this evaluation is through controlled attacks on the systems, which can be carried out remotely (from the Internet Security Auditors facilities) or from the client's facilities, depending on the goals sought and the scope of the audit.

During the execution of an Intrusion Test, there are different phases, each of which requires multiple actions and considerations. The following sections describe them and provide a guide for action.

An Intrusion Test consists of the following phases:

Planning
Definition and identification of the systems to be audited.
Auditing
Execution of tests carried out progressively until intrusion is achieved, followed by escalation within the systems.
Documentation
Drafting of all results obtained.
Our services

How we work

To carry out these attacks, both hacking techniques and tools will be used. The tools will be the same as those used in the underground world by hackers themselves to perform attacks, as well as tools created by the Internet Security Auditors technical team to carry out Penetration Tests, which have been developed based on the guidelines defined in the OSSTMM, ISSAF, and PTES standards.

01Network and systems-level testing execution
Identification of services, operating systems, and network components
  • Enumeration and identification of live hosts.
  • Port scanning and identification of their status (open, closed, filtered).
  • Identification of protocols.
  • Identification of platform and version installed on the services running on each of the open ports.
  • Identification of platform and operating system version.
Update analysis
  • Identification of versions installed on the different systems.
  • Port scanning and identification of their status (open, closed, filtered).
  • Search for vulnerabilities that may affect the detected versions.
  • Manual exploitation of vulnerabilities.
Configuration analysis
  • Detection and identification of the use of default parameters in the configuration.
  • Detection of enabled debugging options.
  • Detection of poor configurations.
  • Use of default access credentials.
  • Manual exploitation of vulnerabilities.
Analysis of authentication systems
  • Identification of all services that use some form of authentication.
  • Validation of credential transmission over an encrypted channel.
  • Validation of the existence of an account lockout mechanism.
  • Identification of measures against automated attacks.
  • Verification of the non-existence of default or weak passwords.
02Application-level testing
Information gathering
  • Internet information search.
  • Platform identification.
  • Robots.txt and humans.txt searches.
  • Information leakage in the application.
  • Identification of application entry points.
Authentication system analysis
  • Identification of all services using any type of authentication.
  • Validation of credential transmission over an encrypted channel.
  • Validation of the existence of an account lockout mechanism.
  • Identification of measures against automated attacks.
  • Validation of the credential recovery process.
  • Authentication system bypass.
  • Verification of the non-existence of default or weak passwords.
Infrastructure configuration analysis
  • Identification of administration tools.
  • Verification of default credentials.
  • Identification of example resources.
  • Identification of backup and unreferenced files.
  • Identification of supported HTTP methods.
  • Identification of HSTS (HTTP Strict Transport Security) header.
  • Identification of anti-clickjacking protection mechanisms.
Identity management analysis
  • Verification of the access policy defined by the application for each existing role.
  • Validation of the user registration process.
  • Verification of predictable user accounts.
  • Validation of the possibility of enumerating user accounts.
Authorization analysis
  • Identification of path traversal vulnerabilities.
  • Identification of RFI (remote file inclusion) vulnerabilities.
  • Validate authorization schema bypass.
  • Validate insecure direct object references.
Session management analysis
  • Identify cookies used by the application.
  • Perform an analysis of session tokens.
  • Verification of cookie attributes.
  • Validation of the existence of persistent cookies.
  • Validate logout functionality.
  • Validate that the session expires after a reasonable time due to inactivity.
  • Validation of Session Fixation vulnerability.
  • Validate exposure of session variables.
  • Validation of CSRF vulnerability.
Data validation analysis
  • Verify that a centralized data validation mechanism exists.
  • Confirm that the application correctly validates data before it is used.
  • Verify the non-existence of vulnerabilities such as SQL Injection or Cross-Site Scripting.
Error management analysis
  • Generate uncontrolled error scenarios.
  • Analyze error messages for information leakage.
  • Analyze stack traces.
Weak cryptography analysis
  • Validate that sensitive information is not transmitted in cleartext.
  • Validate that weak ciphers are not used.
  • Validate that weak protocols are disabled.
  • Validate that insecure SSL/TLS renegotiations are disabled.
  • Validate that MD5 is not used (collision attacks).
  • Validate that RC4 is not used (crypto-analytical attacks).
  • Validate that the server is protected against the BEAST attack.
  • Validate that the server is protected against the CRIME attack.
  • Validate that the server is protected against the POODLE attack.
  • Verify SSL certificate validity.
03Verification Audit
The Verification Audit aims to carry out a verification of the corrections applied by organizations for the vulnerabilities detected in the penetration test that is the subject of the service.

As a result of the penetration test, the report will include the vulnerabilities discovered during the service and the solutions that must be implemented by each company's staff.
04Results
After the execution of the tests, the obtained results are analyzed and the associated documentation is generated.
  • Executive summary of the audit results.
  • Results obtained from the various tests performed, identifying the security issues found and specifying the conditions under which they were found, so that they can be reproduced (as far as possible) to facilitate their localization and resolution.
  • Recommendations to resolve the identified security issues in the most appropriate way.
  • Classification of the detected security issues according to their risk level.
Related Services
Penetration Testing Internal Penetration Testing WiFi Penetration Testing Application Security Red Team Exercises

Scope of service

What this service covers

Network services and components

Host enumeration, port scanning, and identification of protocols, platforms, versions, and operating systems.

Updates and settings

Manual search and exploitation of vulnerabilities in detected versions, default parameters, debugging options, and misconfigurations.

Authentication and identity

Credential encryption, account locking, default or weak passwords, credential recovery, and role-based access policies.

Authorization and sessions

Path traversal, RFI, insecure direct object references, cookies, session tokens, session fixation, and CSRF.

Data, errors and cryptography

Data validation (SQL Injection, XSS), error handling, weak ciphers and protocols, BEAST, CRIME, and POODLE attacks, and SSL certificate validity.

Verification and results

Verification audit of corrections, executive summary, reproducible results, recommendations, and hazard classification.

What our clients say

Organizations that trust us

Working with Internet Security Auditors has been a highly satisfying experience. Their guidance during our migration to the ISO/IEC 27001:2022 standard, the execution of internal audits, and the PCI DSS certification process have been fundamental to strengthening our information security management system.

Ricardo Andrés Cárdenas Galvis
Information Security Office · Neurona

The strategic support of Internet Security Auditors as CISOaaS has been fundamental in strengthening our internal team. Their expertise perfectly complements our CISO's work and has allowed us to advance more quickly in our cybersecurity maturity.

CISO
RACC

On behalf of Outsourcing SAS BIC, we would like to express our gratitude for your commitment and dedication during the implementation of PCI DSS compliance in our call center. We succeeded in establishing a secure environment in accordance with the most demanding requirements of the payment industry.

Yulian Colmenares
Information Security Office · Outsourcing SAS BIC

Working with Internet Security Auditors has been a positive experience in every respect. Their team combines solid technical expertise with a great willingness to collaborate, which has strengthened our security posture and regulatory compliance.

Andrés Mejía
Head of GRC · Payválida

As CFO of Saint Louis University – Madrid Campus, I have had the opportunity to work with Internet Security Auditors. They have been our indispensable partner in implementing the requirements set forth by GDPR regulations. I would like to highlight their availability to resolve questions and their ability to develop a legal framework with concrete and understandable actions…

Victoria Villarreal Palazón
Vice President & Associate VP CFO · Saint Louis University

As CFO of Fleurop - Interflora Spain, we have been working with Internet Security Auditors for years in the areas of consulting and GDPR compliance. As Interflora is a company 100% oriented towards online commerce, the professional services of Internet Security Auditors provide us with support, security, and the peace of mind that all of our activity is aligned with GDPR compliance.

Francisco Tébar Prada
CFO Southern Europe · Fleurop - Interflora Spain

As CISO at Intaremit S.A., we place the utmost importance on logical security. This is not only due to the mere fact that PCI-CPP regulations require us to conduct 4 internal and external vulnerability scans and an annual internal and external pen-test, but also because of the security and peace of mind our company aims to provide to each and every one of its clients. We have been working and collaborating with Internet Security Auditors for over 10 years due to their experience, commitment, and accessibility; therefore, I recommend them without hesitation.

Sergio Sainz de la Maza
CISO · Intaremit

At Grupo Arbulu, we have worked closely with Internet Security Auditors on the implementation of advanced cybersecurity measures. Thanks to their expertise, we have significantly improved our ability to detect and mitigate cyber risks. Their comprehensive audits and customized solutions have strengthened our security infrastructure, ensuring the protection of our data and the continuity of our operations.

Marcos Montes de Oca
CIO · Arbulu Group

As CEO of Beruby, we worked with Internet Security Auditors when we had to urgently perform a PCI DSS Attestation of Compliance. The entire process was extremely fast, efficient, and professional. Their team provided us with excellent support, demonstrating great technical knowledge and commitment. We undoubtedly recommend their services to any company in need of cybersecurity solutions.

Miguel Acosta
Global CEO · Beruby

At Grupo AR, we highly value the brand protection service provided by Internet Security Auditors for its comprehensive and proactive approach. Their highly qualified team allows us to identify and mitigate risks that could affect the AR Construcciones brand and its various companies.

Nestor Ivan Melo Ballen
Cybersecurity Director · AR Group

FAQ

Frequently Asked Questions

Which cloud providers cover testing?

We conduct penetration tests on major providers: Amazon Web Services (AWS), Microsoft Azure, Google Cloud Platform (GCP), and multi-cloud or hybrid environments.

Is it necessary to notify the cloud provider before testing?

It depends on the provider. AWS and Azure no longer require prior authorization for most tests, but GCP and others may require it. Our team handles the necessary permissions as part of the service.

What is the difference between a cloud penetration test and a traditional one?

The cloud penetration test addresses the specific features of cloud infrastructures: IAM configurations, provider security policies, exposed storage (S3, Blob Storage), cloud APIs, serverless, containers, and shared responsibility, in addition to traditional network and application-level testing.

Can tests be performed in production without affecting the service?

Yes. We define execution windows and rules of engagement with the client. Testing is carried out in a controlled and progressive manner, minimizing the impact on production services.

What methodologies are used?

We follow the recognized OSSTMM, ISSAF, and PTES methodologies, complemented by our own tools developed by the Internet Security Auditors technical team and the same tools used in the underground world by actual attackers.

Contact

Do you need to evaluate the security of your cloud environment?

Tell us about your situation and our team will get in touch with you to provide guidance or schedule a technical call.

R
Ricardo Andrés Cárdenas
2 months ago

Working with Internet Security Auditors has been a highly satisfactory experience. Their support in the migration to ISO/IEC 27001:2022 and the PCI DSS certification process has been fundamental in strengthening our ISMS.

A
Andrés Mejía
3 months ago

Your team combines solid technical expertise with a great willingness for collaborative work, which has strengthened our security posture and regulatory compliance.

V
Victoria Villarreal Palazón
4 months ago

They have been our indispensable partner for the implementation of GDPR requirements. I would highlight their availability to resolve questions and their ability to develop a legal framework with concrete and understandable actions.

M
Miguel Acosta
5 months ago

The entire PCI DSS Attestation of Compliance process was extremely fast, efficient, and professional. We would undoubtedly recommend your services to any company in need of cybersecurity solutions.

S
Sergio Sainz de la Maza
6 months ago

We have been working with Internet Security Auditors for over 10 years due to their experience, commitment, and accessibility. I recommend them without hesitation.

Request information

We will contact you as soon as possible.
Global Presence

Our offices

Barcelona

C. Santander, 101. Building A-2
E-08030 Barcelona (Spain)

+34 93 305 13 18
Madrid

Arequipa St., 1
28043 Madrid (Spain)

+34 91 763 40 47
Bogotá

Transversal 22 # 98-82, Porta 100 Building, Office 1003
110221 Bogotá (Colombia)

+57 601 638 68 88
25
years of experience in cybersecurity
Contact us