Penetration Testing Services

Auspex Labs offers a comprehensive range of Red Team services, including perimeter testing and social engineering. Our skilled team specializes in identifying vulnerabilities, simulating real-world attacks, and providing valuable insights to enhance your security posture.

  • Web Applications

    Our Web Application Testing service aligns with NIST SP 800-115 guidelines to provide a focused and effective security evaluation of your web applications. By adhering to these standards and incorporating the OWASP Web Security Guide, we ensure a comprehensive analysis that identifies vulnerabilities in your web application.

  • Perimeter Testing

    Make sure your organization's external network defenses are secure with and up to standard with Perimeter Testing. This process aims to uncover vulnerabilities in critical network components such as firewalls, routers, and servers, which could potentially be exploited. By systematically examining these components and their configurations, the service identifies security weaknesses, providing a foundation for strengthening the network's defense against external threats.

  • Cloud Security

    Perimeter Testing within the Cloud Security Posture Assessment (CSPA) methodically evaluates the security of a cloud computing environment's external defenses, focusing on configurations and security measures of internet-exposed cloud services and infrastructure. This streamlined process identifies vulnerabilities in critical boundary devices like firewalls and routers, and assesses the effectiveness of access controls, encryption, and network segmentation strategies against unauthorized access.

Need penetration testing in order to fulfill compliance requirements?

Auspex Labs’ Red Team is:

  • Bright

  • Charming

  • Based in the United States of America

  • Certified

Options

  • Basic Perimeter Testing

    Basic Perimeter Testing

    For small to medium-sized businesses with relatively simple network infrastructures, basic black box perimeter testing might range from [redacted] This includes scanning for common vulnerabilities and basic penetration attempts.

  • Intermediate Testing

    Intermediate Testing

    For organizations with more complex networks or those requiring a more thorough assessment, costs can range between [redacted]. This level of testing includes more sophisticated attack simulations and a deeper analysis of potential vulnerabilities.

  • Advanced & Customized Testing

    For large enterprises or organizations with highly complex and critical systems, the cost can range from [redacted]. This testing often involves a comprehensive security assessment, including testing of web applications, APIs, and cloud services, along with detailed reporting and recommendations.

Custom work?

Absolutely.

If your organization does not quite fit into one of the tiers above, just reach out.

Our Process

Featured
Planning
Planning

In the planning phase, the customer delineates the engagement's scope, specifying the targeted systems, networks, and applications for testing. This collaborative step involves setting clear rules of engagement with the customer to define the testing boundaries and ensure all activities are agreed upon. It also includes identifying any pertinent regulatory requirements that need to be addressed, aligning the testing process with industry standards or data protection laws as necessary. The outcome of this phase is a detailed contract that encapsulates the scope, rules, and regulatory considerations, serving as a guiding document for the entire penetration testing engagement.

Reconnaissance
Reconnaissance

The Reconnaissance stage follows planning and involves both active and passive information gathering techniques tailored to the engagement's specific nature and scope. This stage may include scanning public-facing interfaces to identify open ports and services, evaluating DNS entries for information about domain structures and potential vulnerabilities, and checking TLS certificates for validity and configuration issues. Additional methods of data collection can encompass passive techniques such as analyzing publicly available information to identify potential entry points and vulnerabilities without directly interacting with the target system. This comprehensive information gathering phase is critical for mapping out the attack surface and preparing for the subsequent stages of the penetration testing process.

Testing
Testing

During the testing phase, efforts are concentrated on actively attempting to breach the systems within the agreed-upon boundaries of the contract. This phase involves executing various strategies to subvert security measures, with the primary objectives being data exfiltration and rights escalation. Techniques employed may range from exploiting known vulnerabilities to simulating social engineering attacks, all tailored to identify weaknesses that could be leveraged by malicious actors. This stage is conducted with utmost respect for the limits and conditions established in the planning phase, ensuring that all activities are ethical and within legal boundaries. The aim is to uncover as many vulnerabilities as possible, providing a realistic assessment of the system's security posture.

Reporting
Reporting

Auspex Labs delivers a comprehensive report detailing all findings from the penetration testing process, including both vulnerabilities and secure attributes of the systems tested. Tailored to meet the regulatory frameworks specific to our customers, such as NIST SP 800-171, PCI DSS, HIPAA, ISO 27001, and others, the report ensures compliance with industry standards.
It includes detailed reconnaissance data, such as DNS entries, services running, and issues with TLS certificates, alongside narratives of each attack attempt, highlighting exploited vulnerabilities, techniques used, and the rationale for not targeting certain services. Designed to exceed contractual and regulatory requirements, this report provides actionable insights for remediation and enhancing system security.

Contact us for more information.