The company contracted us to help with Penetration Testing to help them with their Identity Provider authentication solution. Our testing process is both application and programming language agnostic, allowing our testers to accurately plan any testing activity's duration and resources.

The project started with a discovery phase, in which we focused on gathering all necessary information to establish the testing scope and obtain the required application access. We communicated closely with stakeholders to determine what assets were in scope for the pentest and clarify the necessary application permissions.

Next was the design phase, which covered workload and time estimations, collaboration to prepare a suitable environment for running the pentests, and formalising the project's details. We extended the initial scope regarding the IDP authentication website to also include the administrative part of the Identity Provider solution.

Next came the development phase. Our team simulated security attacks on the testing assets in scope using different techniques like scanning & reconnaissance, gaining system access, persistent access and many others. Throughout this phase, we kept close contact with the client's development team and reported any critical security vulnerabilities that required immediate resolution. At the end of this phase, we successfully delivered the complete vulnerability reports for the two applications in scope.

Finally, we had the delivery phase in which our experts presented the complete vulnerability reports for the two applications in scope to the client's development team. We also clarified the aspects presented in the reports and consulted the client on the best approach to remediate the vulnerabilities.

After the development teams addressed the vulnerabilities and provided the necessary fixes, the organisation asked us to retest to ensure the issues were resolved. The verification was very efficient as we already had the necessary scripts to validate the fixes almost automatically.