<h3>Web Application Penetration Testing</h3>
<p>Validate and verify the effectiveness of the application security controls against OWASP Top 10 Vulnerabilities</p>
<h3>Internal/External Network Penetration Testing</h3>
<ul class="list-style">
<li>Validate and verify the effectiveness of the network security controls</li>
<li>Ascertain that the IT infrastructure is able to defend against exploits</li>
</ul>
<h3>Wireless Network Penetration Testing</h3>
<ul class="list-style">
<li>Discover of both known and unauthorized Wi-Fi networks and access points</li>
<li>Gather information on network strength, security protocols and connected devices</li>
<li>Validate and verify the strength of your encrypted Wi-Fi</li>
</ul>
<h3>Web Application Penetration Testing</h3>
<ul class="list-style">
<li>Reveal weaknesses in web applications security controls before hackers do</li>
<li>Demonstrate potential business impact when weaknesses are exploited</li>
<li>Incorporate into your ISMS to meet compliance standards (PCI DSS 3.1 Requirement 11.3)</li>
</ul>
<p><img src="http://cobaweb.co/project/arimtechV2/contents/tinyMCE/penetration-testing.jpg" alt="" /></p>
<h3><img src="http://cobaweb.co/project/arimtechV2/contents/tinyMCE/icon-penetration-testing.jpg" alt="" /> Eliminate the latest OWASP Top 10</h3>
<ul class="list-style">
<li>Injection</li>
<li>Broken Authentication and Session Management</li>
<li>Cross-Site Scripting (XSS)</li>
<li>Insecure Direct Object References</li>
<li>Security Misconfiguration</li>
<li>Sensitive Data Exposure</li>
<li>Missing Function Level Access Control</li>
<li>Cross Site Request Forgery (CSRF)</li>
<li>Using Known Vulnerable Components</li>
<li>Un-validated Redirects and Forwards</li>
</ul>
<h3>Leveraging OWASP Testing Framework</h3>
<div class="row">
<div class="col-xs-4">
<ul class="nav nav-tabs tabs-left sideways">
<li class="active"><a href="#before" data-toggle="tab">Before development</a></li>
<li><a href="#definition" data-toggle="tab">Definition &amp; Design</a></li>
<li><a href="#development" data-toggle="tab">Development</a></li>
<li><a href="#deployment" data-toggle="tab">Deployment</a></li>
<li><a href="#maintenance" data-toggle="tab">Maintenance</a></li>
</ul>
</div>
<div class="col-xs-8">
<div class="tab-content tab-content">
<div id="before" class="tab-pane active fade in">
<ul>
<li>Review SDLC Process</li>
<li>Policy Review</li>
<li>Standards Review</li>
</ul>
</div>
<div id="definition" class="tab-pane">
<ul>
<li>Requirements Review</li>
<li>Design &amp; Architecture Review</li>
<li>Create &amp; Review UML Models</li>
<li>Create &amp; Review Threat Models</li>
</ul>
</div>
<div id="development" class="tab-pane">
<ul>
<li>Code Review</li>
<li>Code Walkthroughs</li>
<li>Unit &amp; System Tests</li>
</ul>
</div>
<div id="deployment" class="tab-pane">
<ul>
<li class="active">Penetration Testing</li>
<li>Configuration Management Reviews</li>
<li>Unit &amp; System Tests</li>
<li>Acceptance Tests</li>
</ul>
</div>
<div id="maintenance" class="tab-pane">
<ul>
<li>Chance Verifications</li>
<li>Health Checks</li>
<li>Operational Management Reviews</li>
<li>Regression Tests</li>
</ul>
</div>
</div>
</div>
</div>
<h3>1. Passive Phase</h3>
<ul class="list-style">
<li>Understand the application logic by &ldquo;playing&rdquo; with the features</li>
<li>Observe network traffic between browser &amp; server</li>
<li>Compiles information on attack surfaces, including URL, HTTP headers, parameters, cookies</li>
</ul>
<h3>2. Active Phase</h3>
<ul class="list-style half-list">
<li>Information Gathering</li>
<li>Identity Management Testing</li>
<li>Authentication Testing</li>
<li>Authorization Testing</li>
<li>Session Management Testing</li>
<li>Input Validation Testing</li>
<li>Error Handling</li>
<li>Cryptography</li>
<li>Business Logic Testing</li>
<li>Client Side Testing</li>
<li>Configuration and Deployment Management Testing</li>
</ul>
<h3>Internal/External Network Penetration Testing</h3>
<ul class="list-style">
<li>Reveal weaknesses in the network security controls before hackers do</li>
<li>Demonstrate how hackers can take advantage of the weakest links to compromise your business applications and data</li>
<li>Incorporate into your ISMS to meet compliance standards (PCI DSS 3.1 Requirement 11.3)</li>
</ul>
<p><img src="http://cobaweb.co/project/arimtechV2/contents/tinyMCE/penetration-testing-2.jpg" alt="" /></p>
<h3>Leveraging The Cyber Kill Chain</h3>
<ul class="media-list list-addon">
<li class="media">
<div class="media-left media-middle">
<p>1. Reconnaissance</p>
</div>
<div class="media-body media-middle">
<p>Find targets by enumerating all IP addresses on the network and fingerprinting host types, OS installed, services running, etc..</p>
</div>
</li>
<li class="media">
<div class="media-left media-middle">
<p>2. Weaponization</p>
</div>
<div class="media-body media-middle">
<p>Select relevant plugins from toolbox to test for vulnerabilities for each targeted host</p>
</div>
</li>
<li class="media">
<div class="media-left media-middle">
<p>3. Delivery</p>
</div>
<div class="media-body media-middle">
<p>Send specially crafted network packets using plugins to targeted hosts</p>
</div>
</li>
<li class="media">
<div class="media-left media-middle">
<p>4. Exploit</p>
</div>
<div class="media-body media-middle">
<p>Exploit targeted host vulnerabilities, e.g. buffer overflow, weak cipher, etc.</p>
</div>
</li>
<li class="media">
<div class="media-left media-middle">
<p>5. Installation</p>
</div>
<div class="media-body media-middle">
<p>Send payload, such as Remote Administration Tool, over to exploited host</p>
</div>
</li>
<li class="media">
<div class="media-left media-middle">
<p style="display: table-cell;"><span style="display: table-cell;">6.</span> <span class="cyber-kill" style="vertical-align: middle; display: table-cell; padding-left: 2px;">Command &amp; Control</span></p>
</div>
<div class="media-body media-middle">
<p>Explore network around the compromised host</p>
</div>
</li>
<li class="media">
<div class="media-left media-middle">
<p>7. Actions</p>
</div>
<div class="media-body media-middle">
<p>Search for critical data such as credit card numbers, login credentials, etc. and document findings in Final Report</p>
</div>
</li>
</ul>
<h3>Wireless Network Penetration Testing</h3>
<ul class="list-style">
<li>Reveal weaknesses in the wireless security controls before hackers do</li>
<li>Demonstrate how hackers can find loopholes in your wireless infrastructure to gain access to your critical business applications and data</li>
<li>Incorporate into your ISMS to meet compliance standards (PCI DSS 3.1 Requirement 11.1)</li>
</ul>
<p><img src="http://cobaweb.co/project/arimtechV2/contents/tinyMCE/penetration-testing-3.jpg" alt="" /></p>
<h3>Leveraging The Cyber Kill Chain</h3>
<ul class="media-list list-addon">
<li class="media">
<div class="media-left media-middle">
<p>1. Reconnaissance</p>
</div>
<div class="media-body media-middle">
<p>Discover available networks (BSSID) in the vicinity, look for poorly configured Access Point, determine encryption used and capture network traffic Crack Wi- Fi password using Rainbow and/or brute-force attack Set up fake Access Point to find poorly configured client endpoints Document findings in Final Report</p>
</div>
</li>
<li class="media">
<div class="media-left media-middle addon-off">
<p>2. Weaponization</p>
</div>
<div class="media-body media-middle">
<p>&nbsp;</p>
</div>
</li>
<li class="media">
<div class="media-left media-middle addon-off">
<p>3. Delivery</p>
</div>
<div class="media-body media-middle">
<p>&nbsp;</p>
</div>
</li>
<li class="media">
<div class="media-left media-middle addon-off">
<p>4. Exploit</p>
</div>
<div class="media-body media-middle">
<p>&nbsp;</p>
</div>
</li>
<li class="media">
<div class="media-left media-middle addon-off">
<p>5. Installation</p>
</div>
<div class="media-body media-middle">
<p>&nbsp;</p>
</div>
</li>
<li class="media">
<div class="media-left media-middle addon-off">
<p style="display: table-cell;"><span style="display: table-cell;">6.</span> <span class="cyber-kill" style="vertical-align: middle; display: table-cell; padding-left: 2px;">Command &amp; Control</span></p>
</div>
<div class="media-body media-middle">
<p>&nbsp;</p>
</div>
</li>
<li class="media">
<div class="media-left media-middle addon-off">
<p>7. Actions</p>
</div>
<div class="media-body media-middle">
<p>&nbsp;</p>
</div>
</li>
</ul>
<p>{{brochure-pss-detail}}</p>