Penetration Testing Services

Get a real-world look at how attackers could exploit your vulnerabilities and guidance on how to stop them with DCI's pen testing services.


DCI’s Security Team will test key aspects of a customer’s environment for flaws that could be taken advantage of. The objective is to build strategies that help secure and protect the environment. DCI security team first performs a Vulnerability Assessment against the identified infrastructure to highlight vulnerabilities that an attacker might use to compromise the integrity of the systems in play. DCI security team then performs various Penetration Tests in order to better understand and improve upon the organization’s present security posture.

Whether internal or external, Network or Web Application Penetration Testing is executed in the following phases, with the goal of exploiting discovered vulnerabilities:

Intelligence Gathering

In this phase we gain an understanding of the organization and its Internet footprint as well as any digital asset information.

  • Social Media (Twitter, Facebook, blogs)
  • Search Engine results (Google hacking, username/email harvesting, employee information)
  • Domains owned and registered by the company (mail, web, ftp and other server identification)
  • Company website (services/skills used by the company, partnerships, services provided)

Network and Application Reconnaissance

Reconnaissance is conducted next to discover all live hosts and services running within the organization’s network range.

  • Port scanning (standard and non-standard ports are probed)
  • IP scanning (discovering hosts and verifying host status)
  • DNS Lookup
  • Service fingerprinting (banner grabs, response analysis, known port lookup)
  • Service enumeration (pull relevant information from open services)
  • Operating System identification

Vulnerability Discovery and Analysis

The Vulnerability Discovery phase is an interactive procedure with the customer network to discover any vulnerabilities that exist on the hosts found in the previous phases.

  • Service Scanning
  • Vulnerability Scanning (typically conducted with third party tools)
  • Manual Checks
  • Based on discovered hosts and services information as well as manually researched vulnerabilities

Vulnerability Exploit and Privilege Escalation

In this phase we attempt to exploit the vulnerabilities discovered in the previous phases in order to gain unauthorized access to the host.

  • Vulnerability exploitation (typically remote but not limited to):
    • Use of known exploitation tools
    • Use of custom created scripts or modified third-party scripts
  • Account hash dumping (password cracking attempts can be made, hashes can be passed)
  • Escalation from low level accounts (horizontal or vertical)
  • Shell code injection (in vulnerable applications)

To facilitate the successful transfer of knowledge following a Penetration Testing engagement, DCI Security Team will document and present our findings. The output to your team will include:

  • An executive summary
  • A detailed technical report with recommended corrective action plan