NETWORK PENETRATION TESTING
Penetration test is a methods and techniques to gain access to information systems. Its main goal is to identify the presence of vulnerabilities allowing malicious people to establish access to your systems and personal and/or confidential information.

CONSEJO takes care to prevent possible breaches by identifying threats and provide effective methods to eliminate vulnerabilities before malicious individuals manage to exploit them. We are able to do penetration tests, analyzing your networks and devices.

Check the extent to which your internal network is publicly accessible, such as testing if your network services and protocols are protected. Create virtual topology of your servers, routers, switches, access points, firewalls, IPS/IDS devices and others. Having found the available devices on your network, check whether they are updated and test all possible exploits for found services and protocols. Check whether your confidential information is encrypted with strong enough algorithms so that no one can read it. Network tests also include testing of firmware and commodity software that is installed on various devices.

As a result of our penetration tests we prepare and provide written reports and provide your team the necessary guidelines for the effective elimination of all vulnerabilities that we find.

CONSEJO approached any intrusion test in a unique way for each client. Based on the findings of our specialists will synthesize customized course of action for both the management and the technical audience. The approach consists of about 80% manual testing and automated testing 20%, as actual results may differ slightly. Although automated testing enables efficiency, it is appropriate during the initial stages of penetration tests. Comprehensive penetration test can be realized only through precise techniques for manual testing. And we securing our customers the best solution!
 

WEB APPLICATION PENETRATION TESTING
The web application is any software that can be accessed through a web server, but not necessarily with a web browser. An appropriate example of web application includes portals for online banking, Web sites, which are managed by the content management system (such as WordPress, Joomla, Mambo, etc.), e-commerce websites, etc. Web applications are also among the favourite targets of hackers who can use relatively simple vulnerabilities for getting access to confidential information. 

However, most often it is containing a valuable information, possession of which could lead to further damages. 
Statistically, the major of all compromises are the result of exploited weaknesses in web applications. In many cases, the vulnerabilities that result in compromise, which entail serious breakthroughs are completely ignored by conventional and automatic testing methods. In other cases, vulnerabilities are identified but incorrectly considered inviolable because of the presence of protective technologies. For example, a common misconception is that you can use queries with a specific parameter to eliminate all risks from injecting code into the database. The truth is that if the queries are not constructed properly, then often the exploitation is still possible. Another misconception is that Web Application Firewalls protect them from attacks. The truth is that their firewalls can only be configured to protect them against certain attacks, but are completely ineffective against new attack methods.

The Best Practice suggests that an organization should perform a web application test in addition to regular security assessments to ensure their protection.
  SOCIAL ENGINEERING TESTS
Social Engineering is a technique that relies on exploiting weaknesses in human nature, rather than hardware, software, or network vulnerabilities. CONSEJO offers four core Social Engineering areas to test human susceptibility to persuasion, suggestion, and manipulation:

Email Phishing
This danger is actually sending an email from a fake source with luring or false information that misleads the email recipient. Exchange of important and sensitive information through emails happen constantly and almost daily.  However, almost all of these exchanges don’t go through the proper channels for authentication and authorization.
To perform the required inspection by email phishing CONSEJO will provoke the staff to visit unfamiliar Web sites, to disclose sensitive information, or in short - to perform an action that employees would not do otherwise.
 
Telephone/SMS
Like any other modern form of communication and the exchange of confidential information over the phone happens almost constantly. Suggestion to hear the voice of a person on the phone is enough confirmation of his identity. However, malicious persons already diverted frequently by Social Engineering via email to this by phone. By methods of Social Engineering via phone we will check how your employees are willing to reveal sensitive information about you, or are to commit other action which might affect your interests - intentionally or not.
 
Physical Social Engineering
CONSEJO specializes in performing tests for Physical Social Engineering in your company. The tests run in a real physical Environment, with our professional staff directly involved. The purpose of such tests is to reveal potential weaknesses in the physical perimeter. As part of the checks, CONSEJO's experts pretend to be suppliers, new employees, business associates and even family members of employees to provoke your staff to give confidential company information or to authorize access to areas in your building.
 
DDoS attack protection
Next among recent hacker attacks are those of the "denial of service" (DoS). DoS attacks target to crash the proposed customer service and spend system resources in its infrastructure. This type of attacks is conducted by sending a huge amount of network traffic, which is overloading the network channel. Another way is causing endless processes to run on the victim machine, using all of the CPU and Memory resources and others.Those attacks even more frequent, which makes them difficult, durable, sophisticated and compelling security challenges to organizations of various scale. It is true that this kind of malicious actions isn't new, but most of the available methods and resources to conduct them are useless. They have drastically evolved to include (DDoS), and recently (DRDoS) as well. Those attacks simply can't be overcome by most traditional solutions.

Testing of Information Systems – Penetration test, Testing for vulnerabilities, Social engineering, Prevention of DoS attacks