Virtual Application
Penetration Testing

4 Key Testing Focus Areas

• Policy and Sandbox Validation
  We validate the virtual environment’s policy and sandbox restriction rules to identify potential circumvention paths. Our assessment focuses on breaking out of locked-down environments through techniques including group policy bypasses, peripheral restriction bypasses, default application breakouts, and other exploitation methods.
• Application Testing
  In addition to testing the virtualization framework itself, NetSPI performs comprehensive application penetration testing of the application itself. Since the virtualization layer alone cannot guarantee application security, we apply our extensive experience in traditional application testing to uncover vulnerabilities in legacy applications.
• Environment Enumeration and Network Segmentation
  Virtual environments typically operate within an organization’s internal network, inside the external security boundary. NetSPI leverages this privileged position to enumerate the internal environment and identify methods to bypass network segmentation. Connection routes to other sensitive enclaves may exist, creating pathways for further attacks.
• Data Exfiltration Channels
  A primary purpose of virtual applications is controlling the storage and transmission of sensitive data to prevent loss. NetSPI employs novel and unconventional exfiltration channels to bypass DLP controls and test the extraction of data from the virtual environment.