External Network Penetration Testing
An external network penetration test examines an organisation's internet-reachable IP addresses, domains and services from the point of view of an outside attacker. Nokta Guard first maps your attack surface with open source intelligence and reconnaissance, then verifies weaknesses in the services it finds under controlled conditions. The goal is to show the real paths from the internet to your internal network or sensitive data.
Your internet-facing systems are the first surface an attacker sees. Forgotten subdomains, exposed admin interfaces, unpatched VPN appliances and leaked credentials are often missing from an organisation's asset inventory.
We do not stop at the IP list you give us; with your scope approval, we also report assets that belong to you but are missing from the list.
Control Scope
areas · PTES · NIST SP 800-115
Attack surface discovery
Building an asset inventory from domains, subdomains, IP blocks and certificate records.
Exposed services and ports
Internet-facing services, their versions and ports left open unnecessarily.
Remote access
Configuration and known vulnerabilities of VPN, RDP, SSH and remote desktop gateways.
Email infrastructure
Mail servers and SPF, DKIM and DMARC configuration.
Web and admin interfaces
Exposed admin panels, default accounts and quick web checks.
Credential risks
The impact of leaked credentials and weak password policy on corporate services (using approved methods).
Cloud and third-party assets
Your cloud storage and internet-facing cloud services.
We work black box or grey box. Discovery starts with passive methods; active scanning and exploitation are limited to IPs and domains approved in advance. No tests that could cause a service outage are performed.
Duration depends on the number of IPs and domains and the variety of services found. Our source IP addresses are shared in advance so your security team can recognise the traffic.
Inventory of discovered external assets. Verified findings with evidence and CVSS score. Description of attack paths into the internal network or data. Retest report.
The recommended first test for any organisation with internet-facing services. Recommended at least once a year, whenever a new system goes online and after infrastructure changes.