PENETRATION TESTING SERVICES

A penetration test emulates the real-world threats and attack vectors you are likely to encounter. The goal of a penetration test is to identify the weaknesses and demonstrate the impact before an attacker does.

Request Info

GO BEYOND VULNERABILITY SCANNING

Testing your IT environment from a security perspective is an often overlooked and daunting task. Further, automated scans and tools can only go so far in telling you what the risks are and how to prioritize them. By emulating the real-world attacks your organization is likely to face, you can gain a quantified, holistic view of your risks to help you prioritize your resources to protect your organization

Identifying Vulnerabilities

The sophistication of attacks from recent data breaches show that identifying vulnerabilities requires more than simply running a vulnerability scan against your assets.

Exploiting Vulnerabilities

While identifying a vulnerability is useful, being able to demonstrate how vulnerabilities can be combined and exploited gives you a better understanding of the overall risk.

Quantifying Risks

Being able to quantify the risks your organization faces helps you to better prioritize your resources and make data-driven decisions to protect your organization.

THE BENEFITS OF PENETRATION TESTING

WHAT TRIAXIOM DELIVERS

External Penetration Test
An external penetration test emulates an attacker trying to break into your network from the outside. The goal of the engineer performing this assessment is to breach the perimeter and prove they have internal network access. This test includes:

Open source reconnaissance against the organization

Full port scan covering all TCP ports and the top 1,000 UDP ports of the targets in scope

Full vulnerability scan of the targets

Manual and automated exploit attempts

Password attacks
Internal Penetration Test
An internal penetration test emulates an attacker on the inside of your network. This could be either an attacker who is successful in breaching the perimeter through another method or a malicious insider. The goal of the engineer in this module is to gain root and/or domain administrator level access on the network, and gain access to sensitive files. Activities include:

Active and Passive network reconnaissance including traffic sniffing, port scanning, LDAP enumeration, SMB enumeration, etc.

Vulnerability scan on all in-scope targets

Spoofing attacks such as ARP cache poisoning, LLMNR/NBNS spoofing, etc.

Manual and automated exploit attempts

Shared resource enumeration

Password attacks

Pivoting attacks
Wireless Penetration Test
A wireless penetration test is a comprehensive evaluation of the wireless networks in your organization using automated and manual methods. Areas covered include:

Password attacks

WEP/WPA cracking

Guest wireless segmentation checks

Traffic sniffing attacks

SSID spoofing

Rogue access point discovery
Web Application Penetration Test
A web application penetration test is an in-depth penetration test on both the unauthenticated and authenticated portions of your website. The engineer will test for all of the OWASP Top-10 critical security flaws, as well as a variety of other potential vulnerabilities based on security best practice. Activities include:

Website mapping techniques such as spidering

Directory enumeration

Automated and manual tests for injection flaws on all input fields

Directory traversal testing

Malicious file upload and remote code execution

Password attacks and testing for vulnerabilities in the authentication mechanisms

Session attacks, including hijacking, fixation, and spoofing attempts

Other tests depending on specific site content and languages

Social Engineering Assessment
This assessment is designed to target and take advantage of the human-element to gain access to your network. This is done using a variety of methods to get an employee to click on something they shouldn’t, enter their credentials or otherwise provide them when they shouldn’t, or divulge information that may assist an attacker in breaching your network. The goal for the engineer performing this assessment is to gain information that may assist an attacker in future attacks, gather credentials, or gain a foothold on the internal network. This assessment will include:

Phone-based attacks

Spear phishing attacks

Bulk phishing attacks
Physical Penetration Test

A physical penetration test is an assessment of the physical security of your premises. Our engineers will attempt to gain access to your facility by identifying weaknesses and/or using social engineering. Once inside, our engineers will attempt to gather sensitive information, gain access to sensitive areas such as the data center, and attempt to gain internal network access.
Vulnerability Scanning

Vulnerability scanning is a regular, automated process that identifies the potential points of compromise on a network. A vulnerability scan detects and classifies system weaknesses in computers, networks and communications equipment and predicts the effectiveness of countermeasures. Our engineers will conduct this scan for you and use our expertise to remove false positives and produce a risk-prioritized report.
API Penetration Test
An API penetration test emulates an attacker trying to exploit vulnerabilities within your API that may allow him to bypass authentication controls, access sensitive data, or otherwise disrupt the service. The goal of the engineer performing this assessment is to comprehensively review your API for OWASP Top 10 vulnerabilities and exploit any vulnerability that may allow the engineer to bypass security controls. Our API Penetration Testing includes:

Method and parameter fuzzing

Injection attacks, such as SQLi, XSS, XPath, Command

Authentication bypass and privilege escalation attempts

Authorization testing to assess the security of data in multi-tenant configurations including:

Direct object references

Client or user impersonation

Authorization bypass

Information Leakage between clients

Analyzing headers and error messages for information disclosure

Identification of unnecessary information returned or data leakage

Analysis of server-level transport encryption for security best practice

Request Info

WHY TRIAXIOM

Industry Experts

At Triaxiom Security, we understand that you are looking for a security expert, and that’s why our engineers are masters of their craft. Triaxiom Security is a CREST-accredited penetration testing provider. Our engineers, at a minimum, have five years of direct information security experience. Additionally, our engineers have industry leading certifications including:

PCI Qualified Security Assessor (QSA)
Certified Information Systems Security Professional (CISSP)
Certified Ethical Hacker (C|EH)
Offensive Security Certified Professional (OSCP)
Offensive Security Web Expert (OSWE)
GIAC Security Essentials Certified (GSEC)
GIAC Certified Incident Handler (GCIH)
GIAC Web Application Penetration Tester (GWAPT)

Customized Findings

At Triaxiom Security, we understand everyone’s security goals are different. Our clients in healthcare and primarily concerned with keeping protected health information private, while our clients in manufacturing’s biggest risk is a ransomware attack shutting down production. It wouldn’t make sense to provide the same report to both organizations. As such, at Triaxiom, we customize our report for each organization to highlight the risks most pertinent to you.

Partner With You

Triaxiom Security was created to make our clients safer. We want to partner with you to meet your security goals, and we hope you will view us as an extension of your team. As such, you will have direct access to the lead engineer who performed your assessment whenever you need it. If you have questions about the assessment, or security in general, we encourage you to reach out to us 3 months, 6 months or even a year down the road. We are passionate about making your organization more secure and want to help.