Virtual Application Penetration Testing and Breakout Assessments

NetSPI will identify the risks specific to applications published through virtualization platforms along with traditional application testing to help ensure that your company is staying safe while trying to adapt to evolving business needs. We also will identify vulnerabilities that provide unauthorized access to the operating system through applications published via virtualization platforms like Citrix and VMware.

Improve application security with virtual application penetration testing and breakout assessments by NetSPI

It has become common for companies to make their traditional desktop applications accessible from the internet by publishing them through virtualization platforms like Citrix or VMware. Those platforms make it easy for remote employees, partners, and vendors to access existing desktop applications without requiring the large investment that comes with rewriting legacy apps for the web. However, with the ease of access comes additional risks that don’t have to be considered for desktop applications living behind a firewall.

Virtual Application Penetration Testing

During Virtual Application Penetration Tests, NetSPI will identify the risks specific to applications published through virtualization platforms along with traditional application testing to help ensure that your company is staying safe while trying to adapt to evolving business needs.

Virtual Application Breakout Assessments

During Virtual Application Breakout Assessments, NetSPI will identify vulnerabilities that provide unauthorized access to the operating system through applications published via virtualization platforms like Citrix and VMware.

NetSPI also offers host-based pentests and red team engagements that focus on virtualization platforms.

Our processes and platform allow our penetration testers to focus on identifying 20% more vulnerabilities at a higher criticality than other application penetration testing services.

The NetSPI Difference

NetSPI delivers industry-leading penetration testing expertise and a vulnerability
management platform that makes penetration test results actionable.
Learn More arrow_forward

A collaborative team with experience and expertise produces the highest
quality of work

Consistent processes with formalized quality assurance and oversight deliver consistent results
Technology allows more focus on testing and scales to large engagements and multiple ongoing projects
Actionable guidance by a trusted partner from the start of the engagement to the end of remediation

Our Virtual Application Penetration Testing and Breakout Assessment Services

NetSPI will test your virtual application whether it is hosted internally or in a virtualized environment. NetSPI’s approach to virtual application security assessments includes reviewing server-side controls, data communication paths, and potential client-related issues. We will employ manual and automated pentesting processes using commercial, open source, and proprietary software to evaluate your application.

Below is the full process that includes breakout testing. If you are only interested in breakout testing, this can be completed as a standalone project.

Static Analysis

During the static analysis phase of testing, NetSPI will review the follow areas:

 

  • Service account roles and permissions (client, application server, database server)
  • Application file, folder, and registry permissions
  • Application service, provider, WMI subscription, task, and other permissions
  • Assembly compilation security flags
  • Protection of data in transit
  • Hardcoded sensitive data and authentication tokens (passwords, private keys, etc.)
  • Hardcoded encryption material (keys, IVs, etc.)
  • Use of insecure encryption and hashing algorithms
  • Database user roles and permissions
  • Database and server configurations

Dynamic Analysis

During the dynamic analysis phase of testing, NetSPI will test and review the following areas:

 

  • Authentication and authorization controls enforced on the client and server
  • Application user roles and permissions
  • Application workflow logic between GUI elements
  • Web Services utilized by the application using NetSPI’s web application testing methodology
  • File system changes including file and folder creation, deletion, and modification
  • Registry changes including creation, deletion, and modification of keys and values
  • Application objects and information stored in memory during runtime
  • Use of insecure encryption and hashing algorithms
  • Network protocols utilized by the application (SMB, FTP, TFTP, etc.)
  • Database connections

Breakout Testing

During breakout testing, NetSPI will attempt to identify configurations and application functionality that may allow a remote attacker to access the operating system through the published application:

 

  • Virtualization platform vulnerabilities and misconfigurations
  • Application specific functionality
  • Operating system configurations and controls
  • Ingress and egress configurations and controls

*Note: If you are only interested in breakout testing, this can be completed as a standalone project.

Pentesting Research and Tools

Learn about network security testing on our blog, from our open-source penetration testing tool sets for the infosec community, and in our SQL injection wiki.

Benefits of Virtual Application Penetration Testing and Breakout Assessments

Pentest your applications to:

Avoid breaches

Discover your vulnerabilities and exposure, before a breach occurs.

Achieve compliance

Meet application security testing requirements from a third-party.

Improve security

Learn how to strengthen your software development process.

Augment your team

Get a fresh set of eyes from penetration testing experts.

Contact Us