Ethical Hacking · Penetration Test · OSSTMM, ISSAF, PTES

Penetration Testing

There is no better way to test the strength of security systems than by attacking them. The objective of a Penetration Test is to evaluate the state of systems against intrusive attacks.

Planning

Definition of scope and systems to be audited

Audit

Controlled attacks following OSSTMM, ISSAF, and PTES methodologies

Documentation

Executive and technical report with CVSS classification

Service

What is a Penetration Test?

A penetration test is a simulated and authorized attack on a computer system, network, or application to find security flaws before criminals can exploit them.

At Internet Security Auditors, our Ethical Hacking services are objective and follow the same steps that an attacker would take when attempting to breach a company's systems. For this reason, our professionals audit security systems from the perspective of potential external attacks by hackers with malicious intent.

The best way to carry out this assessment is through controlled attacks on the systems, which can be performed remotely (from Internet Security Auditors' facilities) or from the client's premises, depending on the desired objectives and the scope of the audit.

A Penetration Test consists of the following phases:

Planning

Definition and identification of the systems to be audited.

Auditing

Execution of tests carried out progressively until intrusion is achieved, followed by escalation within the systems.

Documentation

Drafting of all results obtained.

Our services

How we work

To carry out these attacks, both techniques and hacking tools will be used. The tools will be the same as those used in the underground world by hackers themselves to perform attacks, as well as tools created by the Internet Security Auditors technical team to conduct Penetration Tests, which have been developed based on the guidelines defined in the OSSTMM, ISSAF, and PTES standards.

01Public Information Analysis

The success of an intrusion depends, to a great extent, on the level of knowledge the attacker has about the target systems. In other words, the more detailed and accurate the information available, the higher the probability of achieving their goal. To this end, analyses will be conducted on corporate websites, metadata, social networks, job offers, blacklists and reputation, forums, and websites external to the entity. As well as Internet searches for information related to the entity, brand, or service, among other data:

Analysis of corporate websites.
Analysis of metadata.
Analysis of social networks.
Analysis of job offers.
Analysis of blacklists and reputation.
Analysis of forums and websites external to the entity.
Analysis of other sources of information.

02Network-Level Security Analysis

Network analysis consists of data collection and the acquisition of information and control policies for the systems being analyzed, with the goal of obtaining maximum information about the hardware and software components, as well as the arrangement of all these elements. To perform this network analysis, the following steps will be followed:

Network probing.
Network mapping.
Port scanning.
Service identification.
Operating system identification.

03System-Level Security Analysis

Vulnerability detection is performed both automatically and manually, and in both cases, a validation phase for the identified vulnerabilities is carried out to rule out false positives.

To perform this system analysis, the following actions are executed:

Analysis of updates.
Analysis of configurations.
Identification of unpublished vulnerabilities.
Analysis of authentication systems.

04Application-Level Security Analysis

Application-level analysis is limited to those applications accessible from the Internet and follows a black-box philosophy. In other words, there is no privileged information about the application available (such as authentication credentials), and the analysis of the application's source code is not included in the scope. The reason for this working methodology is to simulate the actual behavior of an attacker who, through the audited applications and without having any information about them, attempts to compromise the security of the application:

Application inventory.
Analysis of infrastructure configuration.
Analysis of authentication systems.
Analysis of the authorization scheme.
Analysis of session management.
Analysis of the data validation mechanism.

05Analysis of Security Systems

In many cases, these devices and tools may not be properly configured and/or monitored, which can greatly reduce their effectiveness. Among these security systems, the following will be analyzed:

Firewall analysis.
WAF (Web Application Firewall) analysis.
WAF detection and identification.
Analysis of WAF behavior against different attacks.
WAF evasion.
IDS / IPS analysis.
Antivirus/Antimalware analysis.

06Results

High-level executive summary with the classification of the results.
Detail of all tests performed, specifying their objective.
Results obtained in the different tests conducted, with step-by-step descriptions of the detection and exploitation process for each vulnerability.
Recommendations to resolve the identified security issues in the most appropriate manner.
Classification of security issues according to their danger level, including CVSS values. This will allow the company to develop an efficient action plan to resolve these security problems.
Meeting aimed at explaining the results obtained in the audit and advising on the possible solutions available for the security issues found.

Related Services

Internal Penetration Testing WiFi Penetration Testing Cloud Penetration Testing Application Security Red Team exercises

Scope of service

What this service covers

Public Information

Analysis of corporate websites, metadata, social media, job offers, blacklists, reputation, and external forums to gather information about the entity.

Network security

Network polling, network mapping, port scanning, service and operating system identification to obtain maximum information on components.

System security

Analysis of updates, configurations, unpublished vulnerabilities, and authentication systems, with manual validation to rule out false positives.

Application security

Application inventory, authentication, authorization, session management, and data validation analysis following a black-box philosophy.

Security systems

Analysis of Firewalls, WAF (detection, behavior, and evasion), IDS/IPS, and Antivirus/Antimalware solutions to validate their actual effectiveness.

Results and documentation

Executive summary, technical details of each vulnerability with CVSS classification, prioritized recommendations, and a results presentation meeting.

Working with Internet Security Auditors has been a highly satisfactory experience. Their support during our migration to the ISO/IEC 27001:2022 standard, the execution of internal audits, and the PCI DSS certification process has been fundamental in strengthening our information security management system.

Ricardo Andrés Cárdenas Galvis

Information Security Office · Neurona

The strategic support of Internet Security Auditors as CISOaaS has been fundamental in strengthening our internal team. Their expertise perfectly complements our CISO's work and has allowed us to advance more quickly in our cybersecurity maturity.

CISO

RACC

On behalf of Outsourcing SAS BIC, we would like to express our gratitude for your commitment and dedication during the implementation of PCI DSS compliance in our call center. We succeeded in establishing a secure environment in accordance with the most demanding requirements of the payment industry.

Yulian Colmenares

Information Security Office · Outsourcing SAS BIC

Working with Internet Security Auditors has been a positive experience in every respect. Their team combines solid technical expertise with a great willingness for collaborative work, which has strengthened our security posture and regulatory compliance.

Andrés Mejía

Head of GRC · Payválida

As CFO of Saint Louis University – Madrid Campus, I have had the opportunity to work with Internet Security Auditors. They have been our indispensable partner for the implementation of the requirements set forth by GDPR regulations. I would like to highlight their availability to resolve questions and their ability to develop a legal framework with concrete and understandable actions…

Victoria Villarreal Palazón

Vice President & Associate VP CFO · Saint Louis University

As CFO of Fleurop - Interflora Spain, we have worked with Internet Security Auditors for years in the field of consulting and GDPR compliance. As Interflora is a company 100% oriented towards online commerce, the professional services of Internet Security Auditors provide us with support, security, and the peace of mind that all our activity is aligned with GDPR compliance.

Francisco Tébar Prada

CFO Southern Europe · Fleurop - Interflora Spain

As CISO at Intaremit S.A., we place the utmost importance on logical security. This is not only due to the mere fact that PCI-CPP regulations require us to perform four internal and external vulnerability scans and an annual internal and external pen-test, but also because of the security and peace of mind our company aims to provide to each and every one of our clients. We have been working and collaborating with Internet Security Auditors for over 10 years due to their experience, commitment, and accessibility; therefore, I recommend them without hesitation.

Sergio Sainz de la Maza

CISO · Intaremit

At Grupo Arbulu, we have collaborated closely with Internet Security Auditors on the implementation of advanced cybersecurity measures. Thanks to their expertise, we have significantly improved our ability to detect and mitigate cyber risks. Their comprehensive audits and customized solutions have strengthened our security infrastructure, ensuring the protection of our data and the continuity of our operations.

Marcos Montes de Oca

CIO · Arbulu Group

As CEO of Beruby, we worked with Internet Security Auditors when we had to urgently complete a PCI DSS Attestation of Compliance. The entire process was extremely fast, efficient, and professional. Their team provided us with excellent support, demonstrating great technical knowledge and commitment. We undoubtedly recommend their services to any company in need of cybersecurity solutions.

Miguel Acosta

Global CEO · Beruby

At Grupo AR, we highly value the brand protection service provided by Internet Security Auditors for its comprehensive and proactive approach. Their highly qualified team allows us to identify and mitigate risks that could affect the AR Construcciones brand and its various companies.

Nestor Ivan Melo Ballen

Cybersecurity Director · AR Group

FAQ

Frequently Asked Questions

What is the difference between an external and an internal penetration test?

The external test simulates an attacker from the Internet, without access to the internal network, evaluating the security of the perimeter and exposed applications. The internal test is performed from within the corporate network, simulating an attacker who has already gained access or a malicious employee.

Can the tests be performed on systems in production?

Yes. Tests are carried out in a controlled and progressive manner, with the rules of engagement and execution windows defined in advance with the client to minimize any impact on production services.

What methodologies are followed?

We follow the recognized OSSTMM (Open Source Security Testing Methodology Manual), ISSAF (Information Systems Security Assessment Framework), and PTES (Penetration Testing Execution Standard) methodologies, complemented by proprietary tools from the Internet Security Auditors technical team.

How often should a penetration test be performed?

The recommended frequency depends on the organization's context. At a minimum, it is recommended once a year, although regulations such as PCI DSS require quarterly vulnerability scanning and an annual penetration test. In the event of significant changes to the infrastructure, it is recommended to repeat the tests.

What deliverables are received after the Penetration Test?

A full report is provided, including: a high-level executive summary, technical details of all tests performed, evidence of the detection and exploitation process for each vulnerability, criticality classification with CVSS scores, prioritized remediation recommendations, and a results presentation meeting.

Contact

Do you need to evaluate the security of your systems?

Tell us about your situation and our team will contact you to provide guidance or schedule a technical call.

Phone

+34 93 305 13 18

info@isecauditors.com

Offices

Barcelona, Madrid, Bogotá

Ricardo Andrés Cárdenas

2 months ago

Working with Internet Security Auditors has been a highly satisfactory experience. Their support in the migration to ISO/IEC 27001:2022 and the PCI DSS certification process has been fundamental in strengthening our ISMS.

Andrés Mejía

3 months ago

Your team combines solid technical expertise with a great willingness for collaborative work, which has strengthened our security posture and regulatory compliance.

Victoria Villarreal Palazón

4 months ago

They have been our indispensable partner for the implementation of GDPR requirements. I would highlight their availability to resolve questions and their ability to develop a legal framework with concrete and understandable actions.

Miguel Acosta

5 months ago

The entire PCI DSS Attestation of Compliance process was extremely fast, efficient, and professional. We undoubtedly recommend your services to any company in need of cybersecurity solutions.

Sergio Sainz de la Maza

6 months ago

We have been working with Internet Security Auditors for over 10 years due to their experience, commitment, and accessibility. I recommend them without hesitation.

Request information

I am a human

Name

Last name

Contact phone

Corporate email

Company

Country

Service of interest

Tell us what you need

I have read and accept the privacy policy. I would like to receive information about the services and publications of Internet Security Auditors. We will get in touch with you as soon as possible.

Global Presence