How we test
Penetration Testing Methodology
A transparent, repeatable process for external, internal, web, API and mobile penetration testing, from reconnaissance to verified remediation.
- OSSTMM and OWASP based
- AI-augmented automation
- Free re-test included
Purpose of testing
What a SignalRed penetration test sets out to do
Every engagement assesses the security of your applications or infrastructure, including attempts to reach critical assets and confidential data; produces short- and long-term technical and organisational recommendations grounded in the findings and industry practice; and evaluates the applied fixes through a control re-test.
Standards-based, not limited by them
Our work follows OSSTMM and the OWASP Testing Guide, MASTG and API Security Top 10, extended with checks for business logic, financial logic and modern cloud stacks that generic checklists miss.
AI-augmented automation
Automated testing runs on the SignalRed EASM platform, which combines vulnerability scanning with agentic AI pentesting from our Breachloom platform. Humans verify every automated result before it reaches the report.
Impact over volume
We focus on exploitable vulnerabilities and realistic kill chains, demonstrate the access gained, and rate risk by business impact — not by the number of findings.
Verified remediation
Every engagement includes a free re-test. Fixed vulnerabilities are re-verified and the final report reflects the remediation status for your auditors and customers.
Methodology 1
External Network Penetration Testing
Black-box testing of everything reachable from the internet: perimeter hosts, exposed services, remote access and the web applications that sit on them. The goal is to break the perimeter the way a real attacker would and show the business impact.
- Standards followed
- OSSTMM, OWASP Testing Guide, PTES
- 1
Information gathering
- Open-source intelligence (OSINT) against external infrastructure and domain names
- Web application reconnaissance: frameworks, third-party components, versions, accepted parameters and HTTP methods of server scripts and APIs
- Identification of network limitations and monitoring tools (scanning speed, IDS/IPS)
- 2
External network vulnerability scanning
- Port scanning of external resources and service banner collection
- Selection of the most promising targets based on vulnerability statistics for each network service
- Detection of outdated software versions and configuration weaknesses
- Discovery of insecurely configured services and default accounts
- Password brute force and discovery of resources accessible without authorization
- 3
Security assessment
- Manual enumeration of network hosts, installed software versions and data available without authorization
- Correlation of scanning results and search for kill chains to penetrate the perimeter
- Analysis of credentials, including privileged accounts in web applications, network storage, remote desktops and management interfaces
- Controlled exploitation of vulnerabilities in external network services
- 4
Access maximization
- Exploitation of vulnerabilities discovered by manual and automated testing with demonstration of gained access
- Complete or partial compromise of server file systems, operating systems, application software and web applications
- Chaining of vulnerabilities and leaked credentials across services to reach critical data and realize relevant threats
- 5
Reporting
- Testing goals, intruder model and threat model
- Inventory of the assessed area: domain names, network blocks, IP addresses and applications
- Discovered vulnerabilities with risk levels and remediation recommendations
- Description of the exploitation process and how testing goals were reached
- Overall security assessment, vulnerability statistics, obtained data and list of compromised hosts
- Prioritized general and specific recommendations for remediation and building a security process
Methodology 2
Security Assessment of Web Applications and APIs
Deep, feature-by-feature testing of web applications and REST/GraphQL APIs, combining automated scanning with extensive manual testing of authentication, authorization, injection, cryptography, business logic and financial logic.
- Standards followed
- OWASP Web Security Testing Guide, OWASP API Security Top 10, OWASP ASVS
- 1
Information gathering
- Review of documentation, decomposition of the application and selection of controllers that interact with users
- Analysis of network interaction and HTTP requests, identification of target API methods
- Data-flow analysis, identification of likely compromise scenarios and the most probable vulnerable modules (file upload and download, authentication and authorization, user input processing, document and image parsing, DBMS and external service interaction)
- 2
Automated vulnerability scanning
- Identification of vulnerable and outdated third-party libraries
- DAST scanning and, where applicable, SAST, with analysis and verification of results
- Manual verification of detected issues, elimination of false positives and incorrectly rated risks
- 3
Manual and semi-manual vulnerability discovery
- Fingerprinting of frameworks and third-party components, examination of parameters and HTTP methods accepted by server scripts and APIs
- Fuzzing and injection testing, including technology-specific issues such as insecure deserialization, XML external entities, arbitrary script upload and type confusion
- Race conditions, access-control errors, insufficient identifier entropy and insufficient transaction validation
- Cryptographic weaknesses: block cipher misuse, padding oracles, weak pseudo-random generators, signature verification flaws
- Logical vulnerabilities: authorization errors, data leakage, privilege escalation, mass assignment
- Front-end security analysis and JavaScript audit: XSS, CSRF, prototype pollution and related attacks
- Financial-logic vulnerabilities: double debits, rounding errors, transaction amount tampering, payment data leakage and fraud techniques
- 4
Risk demonstration
- Exploitation of discovered vulnerabilities with demonstration of gained access
- Full or partial compromise of servers, operating systems, application software and web applications
- Combination of discovered information, vulnerabilities and accounts to build exploitation chains and reach sensitive data
- 5
Re-test
- One control re-check of fixed vulnerabilities within 10 business days of the customer's request during the warranty period
- 6
Reporting
- Testing goals, intruder model and threat model
- Inventory of application modules, API methods and data flows
- Vulnerabilities with risk levels, exploitation process, method of accessing sensitive data and remediation recommendations
- Remediation status after re-testing
- Overall security evaluation, vulnerability statistics and list of compromised hosts
- Prioritized general and specific recommendations
Methodology 3
Security Assessment of Mobile Applications
Testing of iOS and Android applications following the OWASP Mobile Application Security Testing Guide, focused on critical client-side vulnerabilities and the server-side endpoints specific to the mobile app.
- Standards followed
- OWASP MASTG, OWASP MASVS
- 1
Information gathering
- Review of application documentation and structure, decomposition and identification of potentially vulnerable interfaces
- Analysis of network interactions, HTTP requests and calls to the file system, clipboard, camera and other resources
- 2
Automated scanning of application components
- Identification of vulnerable and outdated third-party libraries
- DAST (Android) and SAST scanning with analysis and verification of results
- Manual verification, elimination of false positives and incorrectly rated risks
- 3
Manual and semi-automatic vulnerability assessment
- Data storage vulnerabilities: insecure logging, secrets in public directories, unprotected passwords or session identifiers
- Insecure data transmission: unencrypted channels, missing SSL pinning
- Privacy violations: secret data in the shared clipboard, page caching, data transmission to third-party services
- WebView vulnerabilities: deep-link processing, XSS or UI redressing, missing URL validation
- Cryptography and secrets management: weak algorithms or keys, passwords and API keys embedded in code
- External data processing: custom URL schemes, QR codes, Intents, pasteboards, broadcast receivers
- Other flaws: SQL injection, file reads, weak reverse-engineering protection, secret data shown on screen or in notifications
- 4
Exploitation
- Exploitation of discovered vulnerabilities with demonstration of gained access
- Full or partial compromise of mobile application resources
- 5
Re-test and reporting
- One control re-check of fixed vulnerabilities within 10 business days of the customer's request
- Report with threat model, vulnerabilities, risk levels, exploitation process, remediation status, overall evaluation and prioritized recommendations
Methodology 4
Internal Penetration Testing
Grey-box testing from inside the corporate network with the privileges of a regular employee or guest (VPN or remote workstation), aiming at domain compromise, lateral movement into privileged segments and access to critical data.
- Standards followed
- OSSTMM, MITRE ATT&CK
- 1
Information gathering
- Examination of the routing table and reachable network segments
- Enumeration of server infrastructure, host names and subsystem roles
- Identification of network constraints and monitoring tools (scanning speed, IDS/IPS)
- 2
Automated vulnerability scanning
- Port scanning and selection of the most promising targets
- Service scanning: web application vulnerabilities, configuration weaknesses, outdated software
- Service banner collection, detection of vulnerable versions, default accounts, password brute force and resources available without authentication
- 3
Manual and semi-manual vulnerability assessment
- Manual enumeration of hosts, software versions and data available without authentication
- Search for public storage, leaked corporate accounts, source code and configuration files on the internal network and the public internet
- Credential analysis including privileged accounts in web applications, network storage, remote desktops and management interfaces
- Privilege escalation on compromised workstations and servers; discovery of SSH keys, AWS/GCP access keys and Kubernetes credentials
- Data-link layer attacks where applicable: traffic interception and modification, session and account hijacking
- Vulnerabilities in network equipment, firewall bypass and lateral movement into privileged segments
- 4
Gaining maximum access
- Exploitation of discovered vulnerabilities with demonstration of gained access
- Full or partial compromise of servers, operating systems, application software and web applications
- Exploitation chains leading to payment data and targeted threats: domain hijacking, compromise of web resources, making payments
- 5
Reporting
- Testing goals, intruder model and threat model
- Inventory of domain names, network blocks, IP addresses and applications
- Vulnerabilities with risk levels and remediation recommendations; exploitation process and target threat realization
- Overall assessment, vulnerability statistics, obtained data and list of compromised nodes
- Prioritized general and specific recommendations
Methodology 5
DDoS Simulation Testing
Controlled application-layer and network-layer denial-of-service simulation from distributed cloud infrastructure to measure how your systems and anti-DDoS controls hold up under attack.
- Standards followed
- Custom SignalRed methodology
- 1
Preparation
- Distributed attack infrastructure hosted by cloud providers: at least 300 source IP addresses, 1 Gbps outbound peak volume (increase available on request), up to 3 hours of testing in total
- Analysis of infrastructure and applications for weaknesses that can lead to denial of service (image processing, database search and other heavy requests)
- Agreement on scenarios, attack types, date and duration
- 2
Simulation
- Application-level attacks: HTTP flood, slow read, slow POST, logic attacks
- Network-level attacks: SYN flood, UDP flood, ICMP flood
- Monitoring of the infrastructure during attacks, collection of response-time and attack-power statistics
- 3
Reporting
- Attack methodology, chronology of the work, detected weaknesses and recommendations to improve resilience against DDoS attacks
Methodology 6
Compromise Assessment
Investigation of a suspected or confirmed cyber incident: identify the causes and consequences, look for signs of attacker presence in the infrastructure, and harden the environment against repeat compromise.
- Standards followed
- NIST SP 800-61, MITRE ATT&CK
- 1
Information gathering
- Study of the network and product architecture, inventory of assets
- Collection of logs from compromised or related systems
- Search of leak databases and historical data on the external perimeter
- 2
Incident investigation
- Interviews with the customer, analysis of information systems and incident artifacts
- Checks for residual signs of active illegitimate sessions, backdoors in code, accounts created by attackers
- Reconstruction of the incident timeline and possible further lateral movement paths
- 3
Security audit
- Analysis of the product architecture and potential security issues on the perimeter, in the internal infrastructure and from insider threats
- Automated vulnerability scan of the entire infrastructure
- Manual vulnerability checks and analysis of scan results
- 4
Reporting
- Description of checks performed and signs of compromise discovered
- Vulnerabilities with risk levels and remediation recommendations
- Prioritized recommendations for eliminating the consequences of the incident, fixing vulnerabilities and establishing a security process
Who performs the testing
A certified, competition-proven team
Our experts include high-level hackers, reverse engineers, cryptographers, penetration testers, multiple hacking competition world champions and bug bounty hunters in the HackerOne world Top-100. SignalRed is a CREST Pathway organisation and placed Top-15 three times and Top-5 once in the HackTheBox Business CTF between 2022 and 2024.
- OSCP (Offensive Security Certified Professional)
- OSEP (Offensive Security Experienced Penetration Tester)
- OSWE (Offensive Security Web Expert)
- OSWP (Offensive Security Wireless Professional)
- BSCP (Burp Suite Certified Practitioner)
- CRTP (Certified Red Team Professional)
- CompTIA PenTest+
- CEH (Certified Ethical Hacker) Practical
- KLCP (Kali Linux Certified Professional)
- eJPT (eLearnSecurity Junior Penetration Tester)
Terms of work
What every proposal includes
- 1A fixed price and duration in business days for the agreed scope, valid for 30 days.
- 2Follow-up remediation testing (5 business days) free of charge, with a final penetration testing report.
- 3Weekly informal updates via chat or email, immediate notification of critical findings, and live progress in the PTaaS dashboard.
- 4A final report with an executive summary and a detailed description of every weakness with remediation recommendations.
- 512 months of post-engagement support and consulting.
Questions
Methodology FAQ
What is the goal of a SignalRed penetration test?
To identify vulnerabilities in your applications and infrastructure, demonstrate the real-world risk they pose through controlled exploitation, and deliver prioritized short-term and long-term recommendations — then verify the fixes in a follow-up re-test.
Do you use automated tools?
Yes, as a starting point. Automated testing runs on the SignalRed EASM platform, which combines vulnerability scanning with agentic AI pentesting from our Breachloom platform. Every automated result is manually verified; false positives and mis-rated risks are removed before anything reaches the report.
What does the final report contain?
Testing goals and threat model, an inventory of the assessed area, every vulnerability with risk level and remediation advice, the exploitation process and reached objectives, remediation status after re-testing, an overall security assessment with vulnerability statistics, and a prioritized list of general and specific recommendations.
How are updates communicated during the engagement?
Weekly informal updates via chat or email plus live progress in the PTaaS dashboard. Critical findings are reported immediately so you can start remediation before the final report.
Get a quote
Tell us about your scope
We reply within two hours during business hours with next steps and, where the scope is clear, a price.
About SignalRed
US company with teams in London and Dubai
Customers in the US, UK and UAE. CREST Pathway organisation.
- 1Discovery call, 15 minutes
We understand your scope, deadlines and compliance requirements.
- 2Proposal, same day
Fixed price and duration for the agreed scope, valid for 30 days.
- 3Testing starts within 24 hours
Autonomous testing begins immediately; manual engagements are scheduled with a named team.
- 4Report and re-test
An expert-signed report, then a free re-test once you have remediated.
Prefer email? info@signalred.io
Request a quote
No commitment. Free consultation. We never share your details.
Tell us what to test. We will tell you what it takes.
Share your scope and we will recommend the right engagement: autonomous, AI-augmented manual testing, or continuous coverage.
- Response within 2 hours in business hours
- No commitment required
- Fixed price in every proposal