Protect your organisation’s perimeter with Blackfoot’s External Network Penetration Testing

Blackfoot’s manual penetration testing, or exploit testing, builds on vulnerability assessment results to simulate real-world attack methods.

Unlike automated vulnerability scanning, our manual penetration testing is delivered by our highly skilled testers who actively seek to progress vulnerabilities through the cyber kill-chain. They will assess the security of your environment by employing a combination of tools, techniques and, most importantly, creativity. As a CREST-certified organisation, Blackfoot penetration tests follow an approved, structured methodology.

A Blackfoot penetration test starts with a well-defined scope that dictates the targets to be tested in a five-stage approach:

Information gathering 

During this phase, our testers use open source intelligence (OSINT) to gather and collate publicly known information about the organisation to facilitate a cyber-attack.

Network mapping and target enumeration

This stage maps the application and local and adjacent network environments, to determine routes to business-critical systems and the enumeration of services presented by in-scope systems including service versions. 

Target and vulnerability analysis 

Once all services have been mapped and identified, analysis of the identified services will be performed to identify known vulnerabilities and common weakness and misconfiguration.

Controlled exploitation attempts of all identified vulnerabilities

Exploitation attempts are performed using known, verified methods. Common vulnerabilities such as injection-based attacks may require manual exploitation and generation of custom payloads created by the Blackfoot internal research team.

Access review and privilege escalation

Often, initial exploitation can result in unprivileged access to a system. Post-exploitation testing can be performed to elevate a threat actor’s privilege or allow lateral movement. These actions feed back into stage one and the process is repeated until the test objectives are achieved.