Professional Services : We offer bespoke penetration services to meet the requirements of our clients. We bring years of global experience and stamina to guide our clients through the ever-evolving cyber security threat landscape We are driven to understand your security concerns and are committed to delivering high quality security solutions, such as : -Research Powerhouse -Client-centric Focus -Affordable -Certified Security Experts -Global Consulting Services https://redfoxsec.com/

1. Penetration
Testing Services
Outpace Attackers.
Be Secure.Think Redfox.
S E C U R I T Y

2. Network Pentest Web Application Pentest
Mobile Application Pentest Source Code Review Wireless Assessment
Other Services Our Accreditations
Red Team Operations
Cloud Configuration Review
2
Professional Services
We are driven to understand your security concerns and are committed to delivering high-
quality security solutions, such as :
Research Powerhouse
Client-centric Focus
Affordable
Certified Security Experts
Global Consulting Services
P4
P7 P9 P11
P13 P15 P16
P6
We offer bespoke penetration services to meet the requirements of our clients. We bring
years of global experience and stamina to guide our clients through the ever-evolving cyber
security threat landscape.
We turn information security into actionable insights.
P3

3. Network Pentest
What is it?
What is the output from this assessment?
Penetration testing of a network is an objective method to gauge
the safety of your network's externally facing services or internally
managed network.
In an internet-facing service, identify and exploit security
vulnerabilities to get access to an internal network, for example,
an office or a datacentre, and obtain Personally Identifiable
Information (PII) of customers or employees
Using a network connection in an office, identify and exploit any
vulnerabilities in an internal network that could be used to
compromise an important internal system, such as a Finance
or Human Resources system
Summary of Findings –
a table listing all vulnerabilities identified during the
assessment, along with the vulnerability's name,
risk rating, and current status
Detailed Findings:
– the rating of the vulnerability's risk
– the system, URL, or procedure containing the
vulnerability
– how the vulnerability was exploited
– the threat to the organisation
– detailed technical information on how to replicate
the vulnerability
– recommending Remedial action
Appendices – vulnerability output that was noted during engagement
Impact – the effect that exploiting this
vulnerability will have on the enterprise or
organisation
Risk – threat to the organisation posed by
the exploitation of this vulnerability
Likelihood – probability that this vulnerability
could be exploited
Each vulnerability will be accompanied by
a remediation recommendation consisting
of one of the following:
Typical examples of objectives include:
A comprehensive technical report will
contain the following:
Executive Summary –
description of the vulnerabilities discovered, the
risk they pose to your organisation, whether
the goal was met, and recommendations for any
corrective action that should be taken
The following factors will be considered
while rating each vulnerability's overall risk:
official fix, such as upgrading the firmware
or a patch for a publicly disclosed vulnerability
a workaround may be employed in
case there is no official solution
when a business process causes the
exploitation of a vulnerability, process
improvement is required
Does this involve
exploitation of
vulnerabilities?
Yes. The penetration tester
can use any flaws they find
during the engagement to
help them reach their goal
3
•
•
• •
•
•
•
•
•
•
•
•

4. –
–
–
–
•
•
–
–
–
–
Web Application Pentest
Web Application Testing is a thorough evaluation of your
web applications according to the Open Web Application
Security Project's (OWASP) Top 10 testing methodology.
Black Box Assessment – Penetration tester assumes the role of
an anonymous, malicious threat actor and therefore is provided
only the URL of the application. If the application requires signup
or registration, this can also be included in the scope of work
Grey Box Assessment – Penetration tester posing a threat to the
application is provided access to the application. However, no
information is provided with respect to its architecture, user base,
or technologies
White Box Assessment – The penetration tester is permitted to access
the application, along with complete information on its architecture,
user rights assignment, and the technologies employed in its development
The Web Application Testing methodology emphasises on the following application
security areas:
Executive Summary – description of the vulnerabilities discovered, the risk they pose to your organisation,
whether the goal was met, and recommendations for any corrective action that should be taken
Does this constitute
the exploitation of
vulnerabilities?
To demonstrate the risk
posed by the identified
issue, vulnerabilities will
be exploited to their
logical conclusion.
4
What is it?
What configuration is reviewed?
Input validation
Session management
Encryption mechanisms and data security
for in-transit and at-rest data
Divulgence of confidential information
Access management
Functional defects
Third-party components as well as libraries
Administration privileges
The assessment may be conducted from the following viewpoints:
Summary of Findings – a table listing all vulnerabilities identified during the assessment, along with the
vulnerability's name, risk rating, and current status

5. –
–
–
–
–
–
the rating of the vulnerability's risk
the system, URL, or procedure containing the vulnerability
how the vulnerability was exploited
the threat to the organisation
detailed technical information on how to replicate the vulnerability
recommending Remedial action
Appendices – vulnerability output that was noted during engagement
Each vulnerability will be accompanied by a remediation recommendation
consisting of one of the following:
The following factors will be considered while rating
each vulnerability's overall risk:
Detailed Findings:
•
•
•
•
•
•
•
•
Official fix, such as upgrading the firmware or a patch for a publicly disclosed vulnerability
A workaround may be employed in case there is no official solution
When a business process causes the exploitation of a vulnerability, process improvement is required
Impact – the effect that exploiting this vulnerability will have on the enterprise or organisation
Risk – threat to the organisation posed by the exploitation of this vulnerability
Likelihood – probability that this vulnerability could be exploited
5

6. •
•
•
•
•
•
•
•
•
•
•
•
Red Teaming
At Redfox Security, we deliver team engagements to assess an
organisation’s preparedness to advanced persistent threat (APT)
attacks. We do this by emulating real-world attackers’ TTPs used
by cybercriminals and malicious insiders. An attacker's ultimate
objective is to gain access to a company's critical assets. Thus, it
is evident that businesses must maintain readiness for such attacks.
Skills and Experience
At Redfox, our team uses all of their penetration testing expertise
and possesses extensive industry-recognized training to guarantee
that the Tactics, Techniques and Procedures (TTPs) simulate an
actual attack on your network against the organisation
The members of the team are carefully selected to ensure
that they possess expertise in each of the
following disciplines:
Safety and Risk Management
Our Team's attack infrastructure is significant to prevent unauthorised
entry into your organisation. Our Teams' actions are defined as
non-destructive by the Practice Director, and methodology that the
team uses, minimises the risk of introducing real-world threats into
your organisation. This is accomplished through the following:
Recon
Deliver
Exploit
Execute
Control
Maintain
Weaponise
6
Open-source intelligence collection methods (OSINT)
and threat intelligence are used for reconnaissance
Armament based on current strategies and techniques
Payload delivery using the stealthiest methods
Making use of known security flaws as well as configuration settings
C2 employing the most recent threat actor techniques, along
with redirection and fronting regarding C2 traffic
Code execution via inventive endpoint circumvention
using target systems
Products for detection and response (EDR)
Real world communication smuggling employing
the same methods as the
Expert threat actor
C2 traffic in transit is encrypted twice. The information is encrypted using
symmetric key encryption and transmitted over a secure channel, such as
HTTPS.
Access to C2 servers is protected by two-factor authentication (2FA)
so that only authorised Team members can access attack infrastructure.
The attack infrastructure uses access control lists and firewalls at each hop to
ensure that only the intended infrastructure can communicate with the Team's
C2 infrastructure.

7. •
•
•
•
•
•
•
•
•
•
•
Mobile device testing examines and identify security
vulnerabilities in the configuration of your organisation's
Android and iOS smartphones and tablets. This can be
performed independently or in conjunction with a standard
network infrastructure penetration test. This service provides
a comprehensive overview of the current security status of
your devices, along with the necessary corrective measures.
Mobile Application Pentest
In the first attack phase, manual testing uses a range of tools
and techniques. These tools mainly consist of network
monitoring,man-in-the-middle proxies, and reverse engineering
tools. The tests are thorough, and their performance will differ
on the basis of the nature of the application. Generally, these
consist of the following:
As for the second attack phase, manual and automated
testing of the server-side end point of a client-server
mobile application are included. Tools such as network
scanners, automated testing tools, and man-in-the-middle
proxies are used.
SQL injection, Xpath injection, and path manipulation
flaws - examples of input manipulation vulnerabilities
logical errors in the business
authentication and authorization flaw
session management errors
Does this comprise the exploitation
of vulnerabilities?
Yes. Identified vulnerabilities will be
exploited to demonstrate the risk
posed where possible.
Executive Summary – description of the
vulnerabilities discovered, the risk they pose
to your organisation, whether the goal was
met, and recommendations for any corrective
action that should be taken
Summary of Findings – a table listing all
vulnerabilities identified during the assessment,
along with the vulnerability's name, risk rating,
and current status
A comprehensive technical report will
contain the following:
What is the output from this assessment?
7
mobile device data analysis
transport layer security analysis
cryptography usage analysis within the application
analysis of any binary protection
validation of authentication along with session management
evaluating source code
OWASP's Top Ten Mobile Risks
The testing will look for a variety of flaws,
which include:
Approach
What is it?

8. •
•
•
•
•
•
•
•
•
•
•
•
Appendices – vulnerability output that was noted during engagement
The following factors will be considered while rating each vulnerability's overall risk:
Each vulnerability will be accompanied by a remediation recommendation consisting
of one of the following:
Official fix, such as upgrading the firmware or a patch for a publicly disclosed vulnerability
A workaround may be employed in case there is no official solution
When a business process causes the exploitation of a vulnerability, process improvement is required
8
Detailed Findings:
the rating of the vulnerability's risk
the system, URL, or procedure containing the vulnerability
how the vulnerability was exploited
the threat to the organisation
detailed technical information on how to replicate the vulnerability
recommending Remedial action
Impact – the effect that exploiting this vulnerability will have on the enterprise or organisation
Risk – threat to the organisation posed by the exploitation of this vulnerability
Likelihood – probability that this vulnerability could be exploited

9. •
•
•
Source Code Review
What is it?
Source Code Review identifies areas of an application that a
user could use to harm the application's confidentiality,
availability, and integrity and the data it processes.
accepting and processing user input and output
accessing data stores and databases
third party interactions
All these Untrusted areas are reviewed since they are
the focus of the source code.
Areas of Review:
The source code is evaluated for compliance with
best practises in the following areas:
Bounds checking
Documentation
Memory allocation
Code maintainability and performance
Insecure library functions
Assessment of Input Validation
includes the following:
Buffer Overflow
SQL Query Injection
Command Injection
Cross-Site Scripting
Error Handling Assessment:
All the errors created by the application are
handled securely and do not leave the
application in an insecure state.
Does not provide feedback to an attacker
that may aid in further attacks, such as error
messages detailing the application's internal
workings.
Session Management Evaluation:
Session identifier construction,
including predictability;
Session identifier generation in
relation to session fixation attacks
Terminating a secure session
Secure session transport, including
encryption
Development of session identifiers,
including predictability
Evaluation of Authentication:
Assessment of Authentication Methods
Restrictions on Password Complexity
Account Lockout Configuration
Methods for Password Storage
9
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
To ensure effectiveness and value, we will work with
application developers to identify code that includes as follows:

10. Cryptographic Evaluation
The source code will be looked at to figure out how
application encryption is used, with a focus on:
use of proprietary cryptographic algorithms
insufficient encryption key lengths
inadequate encryption libraries
insecure cryptographic encryption
algorithms, such as DE
Logging Evaluation
Successes and failures in authentication
Requests for authorisation
Manipulating data
Session activity (logout events)
Refusing to Evaluate Service
Inadequate resource management
10
•
•
•
•
•
•
•
•
•

11. •
•
•
•
•
•
•
•
•
•
•
Wireless Assessment
What is it?
The Wireless Assessment can be done in either a
"black box" or "white box" way to find out if
someone has access to your organisation's
network and other networks.
Black Box - no information about the wireless
network is provided and the network is attacked
by simulating the actions of a malicious threat actor
White Box - access to the wireless network is provided and
the configuration of the network is examined against
security best practices
What configuration is reviewed?
The Wireless Assessment methodology analyses
the following wireless network components:
finding wireless networks in a certain place and
scanning for rogue access points or devices
protocols and mechanisms for authentication
traffic analysis
improving encryption
segmentation of wireless networks,
if already implemented
What is the output from this assessment?
A full technical report will include the following:
Executive Summary – description of the vulnerabilities
discovered, the risk they pose to your organisation,
whether the goal was met, and recommendations for any
corrective action that should be taken
Detailed Findings:
the rating of the vulnerability's risk
the system, URL, or procedure containing
the vulnerability
how the vulnerability was exploited
the threat to the organisation
detailed technical information
on how to replicate the vulnerability
recommending Remedial action
Appendices – vulnerability output that was
noted during engagement
Does this comprise the
exploitation of
vulnerabilities?
During a black box
assessment, the team
will try to get into your
wireless network by
using modern attack
vectors that try to get
around or crack the
wireless authentication
protocol in use.
11
Summary of Findings – a table listing all
vulnerabilities identified during the assessment,
along with the vulnerability's name, risk rating,
and current status

12. •
•
•
•
•
•
The following factors will be considered while rating each vulnerability's overall risk:
Impact – the effect that exploiting this vulnerability will have on the enterprise or organisation
Risk – threat to the organisation posed by the exploitation of this vulnerability
Likelihood – probability that this vulnerability could be exploited
Each vulnerability will be accompanied by a remediation recommendation consisting of
one of the following:
Official fix, such as upgrading the firmware or a patch for a publicly disclosed vulnerability
A workaround may be employed in case there is no official solution
When a business process causes the exploitation of a vulnerability, process improvement is required
12

13. Cloud Configuration Reviews
What is it?
Constant evolution in the digital transformation journey of small and large-scale organisations, and the inevitable
transfer of business functions to cloud ecosystems, call for strict security measures to enhance an organisation’s
overall security posture.
The sooner your cloud platform’s configuration issues are fixed, the sooner your business becomes less vulnerable
to exploits launched by adversaries. With the rapid evolution of cloud-based environments, security challenges are
growing in complexity by the day. This leaves organisations open to security risks, which can eventually make cloud
platforms useless.
What is a Cloud Configuration Review?
An application’s business context and security standards are assessed during a Cloud Configuration Review.
The assessment includes interviewing key internal stakeholders and then analysing the relevant cloud
infrastructure using both manual and automated tools.
Identity and Access Management (IAM)
Networking
Storage
Compute
Other Services
These assessments are created using a mix of manual and automated methodologies that take into
account industry best practices and security standards from trusted sources (such as the CIS Benchmarks)
How do we do it?
At Redfox Security, we offer organisations a comprehensive assessment of their cloud environments. This includes
comparing your cloud configuration settings to best practises in the industry to keep your business safe from
cyberattacks that use the cloud.
We regularly review and update our methodologies to ensure that they're aligned with the latest compliance and
regulatory standards that many businesses must meet when implementing cloud services
13
The review involves finding configuration issues in the following areas:
i.
ii.
iii.
iv.
v.

14. We offer the following services:
AWS Configuration Reviews
Azure Configuration Reviews
GCP Configuration Reviews
O365 Configuration Reviews
Benefits of Cloud Configuration Reviews:
Get professional advice on how to strengthen your cloud security controls
Meet compliance requirement and apply security best practices
Improve your overall security posture
Protect your cloud environment against most common, configuration-based vulnerabilities
Efficiently use security features offered by cloud providers
14
•
•
•
•
•
•
•
•
•
Approach
We provide our customers with cloud configuration and assessment services to carry security into the cloud, identify
vulnerabilities and risks, and determinenext steps to strengthen their security posture.

15. Other Services
ICS Security Assessments
Hardware Security Assessments
Architecture Reviews
Purple Teaming
ATM Security Assessments
Cloud Penetration Testing
Smart Contract Security Assessments
API Penetration Testing
Mobile Application Penetration Testing
Active Directory Security Assessments
PCI DSS Security Assessments
OSINT
Container Security
Kubernetes Configuration Reviews
Offensive Cyber Security Training
Managed Vulnerabilities Scanning
Threat Modelling
Host Reviews
Phishing Simulations
Firewall Configuration Reviews
15

16. Our Accreditations
16

17. Redfox Cyber Security Pvt. Ltd.
A-201, Sunrise, Lokhandwala Market,
Andheri West, Mumbai, Maharashtra
400053, India.
Kemp House, Unit 2446,
152 City Road, London EC1V 2NX,
United Kingdom.
Redfox Cyber Security Inc.
3080 Yonge Street, Suite 6060,
Toronto, Ontario M4N 3N1, Canada.
Redfox Cyber Security Inc.
8 The Green, Ste. A, Dover,
Delaware 19901, United States. info@redfoxsec.com
+1-800-917-0850 (USA & Canada)
+91-892-849-5754 (APAC & EMEA)
https://redfoxsec.com
Redfox Security is a fast-growing cyber security consulting firm,
spread across 4 countries. With over 10 years of global security
consulting experience, we help businesses strengthen their security
posture. Our mission is to help businesses grow securely with our
top-line cyber security consulting services – and that’s exactly what
we do.
We leverage our insightful understanding of the threat landscape
to identify and resolve security risks. We believe in establishing a
company culture that disrupts the status quo of security testing.
With an undying passion for improving security, we continue to
hire innovative talent while continually upgrading our penetration
testing methodologies.
Who we are
S E C U R I T Y