Penetration testing, also known as pentesting or ethical hacking, is a security exercise where cybersecurity experts mimic external attackers who are looking to gain access to your sensitive data and resources.

During this exercise, our team performs a simulated attack to identify and exploit vulnerabilities in your system. We then provide a comprehensive report outlining our recommendations to patch identified vulnerabilities and strengthen your overall security posture.

Thoropass recommends performing annual gray box pentests, where the tester has partial access to the in-scope targets to assess your systems’ unauthenticated and authenticated segments. This type of test strikes a balance between depth and efficiency, as direct access allows the tester to save time when identifying weaknesses inside your system. A gray box pentest is the most efficient way to test your vulnerability to outsider and insider threats.

The main goal of web application penetration testing is to identify potential vulnerabilities, which may include unintentional information exposures, authentication bypass methods, poorly implemented security controls, and injection attacks.

Pentesters utilize tools such as Burp Suite and browser developer tools to analyze the functionality of a target and its business logic, and to search for vulnerabilities in JavaScript files and HTML source code. Client-side interactions are beyond the server's control, so the server-side application is tested by sending arbitrary input to see if it can handle potentially harmful inputs properly.

Examples of this testing include modifying hidden HTML form field values, changing session tokens in HTTP cookies, and adding or removing parameters. The testing approach also examines the target's workflows and business logic, which can uncover vulnerabilities such as the ability to bypass certain steps in a process, like skipping multi-factor authentication or purchasing a product for a lower price than advertised.

APIs sit in a critical position between users and the sensitive systems on the backend. The main difference between a web pentest and an API pentest is that in the latter, you no longer have the obvious graphical user interface cues such as search bars, login fields, and buttons for uploading files. Instead, API hacking relies on the backend operations of those items that are found in the GUI. The pentester uses tools such as Burp Suite or Postman to interact with the APIs and actively searches for information disclosure flaws, authentication bypasses, lack of rate limiting, and broken authorization, among other common vulnerabilities found in APIs.

Mobile pentesting is primarily focused on data protection. Apps, regardless of the operating system that they run on, store various types of personal information, including pictures, location, notes, and more. Even though iOS and Android offer mature mechanisms for secure data storage and communication, those have to be implemented and used correctly in order to be effective. Data storage, inter-app communication,

proper usage of cryptographic APIs, and secure network communication are only some of the aspects that require careful testing.

Network pen tests assess all aspects of a computer network, including on-prem servers and services running on any port. These tests require a strong understanding of networking, Windows, Linux, and Active Directory. While network vulnerability scanners like Nessus can be used in conjunction with other tools during network pentesting, it is important to note that network vulnerability scanning is just one component of a comprehensive network pentest. Other objectives of this type of test include lateral movement, privilege escalation, and gaining root access.

This includes variables such as:

This is arguably the most critical step in every pentest. During this reconnaissance stage, testers search for the necessary information about the target and investigate its scope. During this stage, information is gathered through various means such as finding open ports, subdomains, crawling the target, discovering directories and parameters via fuzzing, OSINT gathering, searching for leaked credentials on the web, identifying the technology stack of the application, and Google Dorking, among others.

Before beginning manual assessments, it is recommended to perform automated reconnaissance and execute vulnerability scanners. This will catch low-hanging fruit and point the tester to areas that are more vulnerable in terms of security. Pentesters will assess the targeted application using commercial and open-source security tools. During this phase, we ensure that scanning covers the entire scope of the application and that every segment is assessed for security issues.

During this phase, a skilled pentester will use proxy tools to simulate real-world cyber-attack scenarios. This is where the magic happens, as we mimic what real hackers might do and employ various attack techniques to identify vulnerabilities in your systems.

These vulnerabilities may include authorization bypass, which could allow User A to view the private information of User B or gain access to highly sensitive data handled by your application. Other strategies include escalating privileges, exfiltrating data, cracking passwords, and more to see the damage they can cause.

It is important to note that we do not restrict ourselves to a predefined list of test cases. Instead, we evaluate the security of an application as an actual intruder would, using both manual methods and automated tools. However, we do have a checklist that establishes a baseline of the minimum coverage that every application must undergo to be considered a thorough test.

With that being said, we consider the requirements and recommendations set forth by reputable organizations, such as the OWASP Top 10, the OWASP Testing Guide sections that are applicable to the target application, as well as the relevant guidelines from NIST 800-115 for assessment of security tests.

Once the tester identifies a vulnerability and exploits it within the system, the tester validates the ability to move within the system persistently. This indicates that a malicious actor could gain in-depth access to exploit additional weaknesses. The actor may move within the system to exploit or chain different vulnerabilities.

At the final step of the penetration testing, the tester will compile a report and showcase the data gathered. The report will include specific exploited vulnerabilities, the accessed and sensitive data, and the amount of time the tester remained in the system undetected.

The report should be readable by anyone ranging from a technical person to a non-technical person.

The detailed report consists of the following sections:

The Thoropass pentesting team will categorize vulnerabilities based on the Common Vulnerability Scoring System (CVSS 3.1), an industry standard that provides a method to capture the key features of a vulnerability and generate a numerical score reflecting its severity.

Thoropass offers unlimited retests within a 90-day period for every identified vulnerability.

From here, it is the organization’s job to move forward with new security solutions based on the feedback provided.