The IT companies are establishing, monitoring and updating their protection systems for networks against the attacks and malwares each day. It is well known about the consequences of such internal and external attacks, it is vital to keep your company secure.

Dual Layer Cyber is well aware about the businesses and also thinks about the ways attackers can make the attack. This provides us an insight about the technical loopholes of the attacker where the attack can be reversed. By utilizing the objectives, our group firstly identifies the weakest link and then move upward until one and all the attackers fall and we get the advantage of accessing the systems or information.

Our services of penetration testing provides the hybrid approach which relies upon both the manual and automated methods of testing. We strive to gain the fortunate access to the servers, web applications, firewalls, networks and other devices, IoT and various other exposure points that are carried out in the controlled but safe manner whereas utilizing the identified vulnerabilities. Once the successful demoralization off the vulnerability is done, the security analysts of our team will move forward and launch further exploits to earn more privilege and in-depth access of the electronic information and assets.

Our Methodology for Penetration Testing

At the Dual Layer Cyber Technology, we have built our penetration testing methodology on the basis of OWASP Testing Guide, Penetration Testing Executions Standard and Open Source Security Testing Methodology Manual. The methodology includes certain steps:

• Preparation
• Recon
• Mapping
• Vulnerability assessment
• Vulnerability exploitation
• Analysis and final report

What do we test during the Penetration Testing?

The performance of the penetration testing is conducted in the three phases as mentioned below:

1. Active and Passive Investigation

It involves the collection of information regarding the targeted organization along with the identification of the fundamental aspects such as software versions, running services, operating systems, etc. below mentioned is the non-inclusive items list which will be tested in order to allow the company to carry out the attack in the information and elevated fashion that will raise our chances of succession.

• Search for public information (social networks, search engines and newsgroups, etc.)
• DNS investigation
• Enumeration of network
• Open domain search
• Enumeration of firewall
• Version scanning, OS fingerprinting and Port scanning

1. Identification of vulnerability

The assessment involves information assets evaluation against more than 80,000 vulnerabilities as well as the configuration checks. Our team utilizes different scanners for vulnerability testing along with the manual methods and test the different services that are reachable by network such as DNS, SNMP, SSH, SMB, FTP, HTTP, SMTP, etc. below mentioned are the certain types of non-inclusive list of vulnerability that can be identified:

1. Network manipulation and exploitation

• ARP Spoofing
• VLAN Hopping attacks
• Routing Protocols MiTM
• HSRP and VRRP Man-In-The-Middle Attack

1. Service Side Exploitation

• Buffer overflow
• Remote execution of code
• Exploitation of web application (RFI, LFI, CSRF, XXE, SQLi, XSS, and many more
• Code injection

1. Privileged escalation

• Local exploitation of the high privileged service and program
• Kernel attacks
• Race conditions

1. Authentication and identification of weakness exploit

• Weak user credentials
• Default password and username

• Exploitation of vulnerability

By utilizing the manual and automated testing approach, our team of security analysts earn the access towards targeted system in timely and controlled way by using the vulnerabilities identified in last phase of vulnerability identification.

Supported Approaches for Web Application Testing

Dual Layer Cyber technology web application testing services back the mentioned approaches of testing while assessment of web applications.

• GreyBox Web Application Penetration Test

It involves system testing with knowledge regarding target assets. This information is limited to application URL and user credentials that shows different roles of user. This greybox testing provides the prioritized and centered efforts that are relying on the information of target system. It raises the identification of more vulnerabilities without any effort.

• Blackbox web application penetration test

It is referred to the system testing without any information of information asset inner workings, architecture and source code. This system shows how the attacker approach the web application.

• Whitebox web application penetration test

It refers to the system with full information about target system. Our penetration test of whitebox is combined with the secure code review and greybox test. These analysis offers the application fuller understanding and its posture of infrastructure security.

What will you earn?

All the analysis will be properly documented in one final report and then they will be compared in terms of their weaknesses and strengths against the international standards of Cyber Security and IT. The identified weaknesses are assessed and added with the remediation and recommendations actions and prioritized on basis of risks. The final documented report will be discussed in one presentation with you.