Intrusion Test / Penetration Test

There is no better way to test the strength of security systems than by attacking them. The objective of the Intrusion Test / Penetration Test is to assess the state of systems against intrusive-type attacks.

Ethical Hacking services must be objective and follow the same steps an attacker would take if attempting to compromise the company’s systems. For this reason, Internet Security Auditors professionals audit security systems from the perspective of potential external attacks by hackers with malicious intent.

The best way to perform this security assessment is by conducting controlled attacks on the systems. These can be carried out remotely (from Internet Security Auditors’ facilities) or from the client’s premises, depending on the objectives and scope of the audit.

An Intrusion Test consists of the following phases:

PLANNING

PLANNING

Definition and identification of the systems to be audited.

AUDIT

AUDIT

Execution of tests carried out progressively until intrusion is achieved and, once achieved, escalation within the systems.

DOCUMENTATION

DOCUMENTATION

Drafting of all results obtained.

Scope of the tests

To perform these attacks, both techniques and hacking tools will be used. The tools will be the same as those used in the underground world by hackers to carry out attacks, as well as tools created by the Internet Security Auditors technical team to perform Intrusion Tests, developed based on the guidelines defined in the OSSTMM, ISSAF, PTES standards.

Public Information Analysis

The success of an intrusion largely depends on the level of knowledge the attacker has about the target systems. The more detailed and precise information available, the higher the probability of achieving their goal. Therefore, analyses will be performed on corporate websites, metadata, social networks, job postings, blacklists and reputation, forums, and external websites related to the entity. Internet searches will also be conducted for information related to the entity, brand, or service, among other data:

  • Corporate website analysis.
  • Metadata analysis.
  • Social network analysis.
  • Job posting analysis.
  • Blacklist and reputation analysis.
  • Analysis of forums and external websites.
  • Analysis of other information sources.

 

Network-Level Security Analysis

Network analysis consists of collecting data and obtaining information and control policies of the analyzed systems, with the objective of gathering maximum information about hardware and software components, as well as their arrangement. To perform this network analysis, the following steps will be followed:

  • Network probing.
  • Network mapping.
  • Port scanning.
  • Service identification.
  • Operating system identification.

 

System-Level Security Analysis

Vulnerability detection is performed both automatically and manually, and in both cases a validation phase is carried out to discard false positives.
To perform this system analysis, the following actions are executed:

  • Update analysis.
  • Configuration analysis.
  • Identification of unpublished vulnerabilities.
  • Authentication system analysis.

 

Application-Level Security Analysis

Application-level analysis is limited to applications accessible from the Internet and follows a black-box philosophy. That is, no privileged information about the application is available (such as authentication credentials), and source code analysis is not included in the scope. The purpose of this methodology is to simulate the real behavior of an attacker who, through the audited applications and without prior knowledge, attempts to compromise the application’s security:

  • Application inventory.
  • Infrastructure configuration analysis.
  • Authentication system analysis.
  • Authorization scheme analysis.
  • Session management analysis.
  • Data validation mechanism analysis.

 

Security Systems Analysis

In many cases, these devices and tools may not be properly configured and/or monitored, significantly reducing their effectiveness. Among these security systems, the following will be analyzed:

  • Firewall analysis.
  • WAF (Web Application Firewall) analysis
    • WAF detection and identification.
    • Analysis of WAF behavior against different attacks.
    • WAF evasion.
  • IDS / IPS analysis.
  • Antivirus / Antimalware analysis.

 

Results

  • High-level executive summary with classification of results.
  • Details of all tests performed, specifying their objective.
  • Results obtained in the different tests, with step-by-step descriptions of the detection and exploitation process for each vulnerability.
  • Recommendations to effectively resolve the identified security issues.
  • Classification of security issues according to their risk level, including CVSS values. This will allow the company to develop an efficient action plan to address these security problems.
  • Meeting aimed at explaining the results obtained in the audit and advising on possible solutions for the identified security issues.

 

What Our Clients Say


At Grupo AR, we highly value the brand protection service provided by Internet Security Auditors for its comprehensive and proactive approach. Their highly qualified team enables us to identify and mitigate risks that could affect the AR Construcciones brand and its different companies. Many thanks for your support!
Nestor Ivan Melo Ballen
Director of Cybersecurity
Grupo AR
As CEO of Beruby, we worked with Internet Security Auditors when we urgently needed to complete a PCI DSS Attestation of Compliance. The entire process was extremely fast, efficient, and professional. Their team provided us with excellent support, demonstrating strong technical expertise and a high level of commitment. Without a doubt, we recommend their services to any company in need of cybersecurity solutions.
Miguel Acosta
Global CEO
Beruby
At Grupo Arbulu, we have worked closely with Internet Security Auditors on the implementation of advanced cybersecurity measures. Thanks to their expertise, we have significantly strengthened our ability to detect and mitigate cyber risks. Their thorough audits and tailored solutions have reinforced our security infrastructure, ensuring the protection of our data and the continuity of our operations.
Marcos Montes de Oca
CIO
Grupo Arbulu
As CISO at Intaremit S.A., the importance we place on logical security is extremely high. Not only because the PCI‑CPP standard requires us to perform four internal and external vulnerability scans and an annual internal and external penetration test, but also because of the security and peace of mind our company aims to provide to each and every one of our customers.We have been working and collaborating with IsecAuditors for more than 10 years thanks to their experience, commitment, and close support, and I therefore recommend them without hesitation.
Sergio Sainz de la Maza
CISO
Intaremit S.A.
As CFO of Fleurop – Interflora Spain, we have been working with Internet Security Auditors for years in the areas of consulting and GDPR compliance. As Interflora is a company fully oriented toward online commerce, the professional services provided by ISEC Auditors give us the support, security, and peace of mind that all our activities remain aligned with GDPR requirements.
Francisco Tébar Prada
CFO Southern Europe (Spain, Italy, Portugal and Romania)
Fleurop - Interflora España
As CFO of Saint Louis University – Madrid Campus, I have had the opportunity to work with Internet Security Auditors, S.L. They have been an indispensable partner in implementing the requirements established by GDPR: preparing the record of processing activities, developing privacy policies, drafting the necessary data‑protection agreements with our service providers, and complementing all of this with thorough training for our staff—an essential element to ensure full compliance with the law. I would like to highlight their availability to address questions and their ability to translate the legal framework into concrete and understandable actions. Their periodic internal audits are efficient and allow us to stay up to date, correcting any deviations in a timely manner.I highly recommend Internet Security Auditors, S.L. to anyone seeking a successful implementation and ongoing oversight of personal data protection within their organization. 
Victoria Villarreal Palazón
Vice-Rector & Associate Vice President Chief Financial Officer
Saint Louis University, Spain
Working with Internet Security Auditors has been a positive experience in every respect. Their team combines strong technical expertise with a great willingness to collaborate, which has strengthened our security posture and regulatory compliance.
Andres Mejia
Head of GRC
PAYVÁLIDA
On behalf of Outsourcing SAS BIC, we would like to express our sincere appreciation for the commitment, professionalism, and dedication demonstrated throughout the implementation of the PCI DSS compliance project in our call center. Thanks to your expertise and guidance at every stage of the process, we were able to establish a secure environment that meets the industry’s most demanding payment‑security requirements, significantly strengthening our security controls and data‑protection practices. We especially value your team’s willingness to provide clear solutions, effective training, and smooth communication, all of which were key to achieving our objectives on time and with full confidence.
Yulian Colmenares
Information Security Officer
OUTSOURCNG SAS BIC
Working with Internet Security Auditors has been a highly satisfactory experience. Their support throughout our migration to the ISO/IEC 27001:2022 standard, the execution of internal audits, and the PCI DSS certification process has been essential in strengthening our information security management system. We especially value the professionalism and interpersonal skills of their team, which have made this collaboration a relationship of trust and great value for Neurona.
Ricardo Andrés Cárdenas Galvis
Information Security and Continuity Officer
Neurona
The strategic support provided by Internet Security Auditors as our CISOaaS has been essential in strengthening our internal team. Their expertise perfectly complements the work of our CISO and has enabled us to accelerate the maturity of our cybersecurity program.
CISO
RACC

Do not hesitate to contact us if you need more information

Send us your questions and we will get in touch with you as soon as possible.
CAPTCHA