External

The external penetration test assessed the security of the client's Internet-facing systems from the perspective of an attacker on the Internet with no prior access or credentials. Testing was limited to the IP addresses, ranges, hostnames and domains listed under Scope & dates. Excluded entries were not tested.

The approach follows recognised industry practice, including the Penetration Testing Execution Standard (PTES) and NIST SP 800-115. Automated tools were used for coverage; every reported finding was verified manually.

Phases

• Reconnaissance: passive collection of public information about the in-scope assets, such as DNS records, certificate transparency logs and public service banners.
• Discovery: host discovery and full TCP port scanning, plus scanning of common UDP ports, to identify live hosts and exposed services.
• Service enumeration: identification of service types, products and versions, and review of their configuration.
• Vulnerability analysis: checks for known vulnerabilities, outdated software, weak encryption (TLS protocols, ciphers and certificates), default or weak credentials, exposed administrative interfaces and information disclosure.
• Exploitation: controlled attempts to confirm identified vulnerabilities and show their real impact, without disrupting service availability or modifying data beyond what was needed to prove the issue.
• Reporting: each confirmed issue is documented with its severity, affected assets, evidence and remediation advice.

Limitations

• The test is a point-in-time assessment. Changes made to the systems after the test dates are not covered.
• Denial-of-service attacks, social engineering and physical attacks were not performed unless stated in the scope.
• The absence of a finding does not guarantee that a system is free of vulnerabilities.