PRT (Primary Refresh Token): How it Works and Exploitation Techniques
With the widespread adoption of hybrid environments and the Zero Trust model, Microsoft Entra ID (formerly Azure AD) has established itself as a centr...
An infrastructure and network pentest aims to assess the security level of your IT infrastructure by simulating attacks targeting internal and external networks. The goal is to identify exploitable vulnerabilities within exposed services, network architecture, configurations (firewalls, routers, switches), active services (DNS, VPN, administration services) and critical components such as Active Directory or Wi-Fi access.
At the end of the mission, a detailed report presents the identified flaws, the associated attack scenarios, and specific, prioritised recommendations for remediation. A counter-audit phase can then be carried out to validate the effectiveness of the fixes implemented and confirm the effective reduction of risks.
Our auditors perform infrastructure and network penetration tests in a variety of complex environments. Whether it's a traditional on-premise infrastructure, a hybrid network, an information system spread across multiple sites, or cloud environments interconnected with internal infrastructures, our approach adapts to your architecture and operational constraints.
Our auditors begin the assignment with a detailed mapping of the internal environment. They identify active IP address ranges, locate accessible hosts, and perform port and service scans to establish an initial inventory. At this stage, they also fingerprint systems and services to determine versions and technical characteristics, while performing passive discovery to complete the visibility picture.
Our auditors conduct a thorough enumeration of the identified services. They examine SMB shares and sessions, query directories (LDAP/Kerberos) in Active Directory environments, and analyse remote access and administration services.
Our auditors then cross-reference the collected data with vulnerability databases and perform technical validation of potential flaws. They target both historical and critical CVEs as well as common configuration issues: weak or default passwords, unsecured shares, insufficient system hardening, etc.
Our auditors attempt to exploit identified vulnerabilities to measure the real impact of a compromise. They seek to gain additional access via remote code execution or Active Directory-specific techniques, perform lateral movement, escalate privileges on compromised machines and, if necessary, extract elements such as LSASS/SAM hashes to assess the risk associated with credential reuse. Finally, they test pivoting to other segments of the network to assess the scope of an intrusion and the robustness of compartmentalisation.
Once the tests are complete, our auditors compile a detailed report listing all the vulnerabilities identified. Each vulnerability is documented along with its severity level, exploitation scenario and associated technical evidence (screenshots, commands, logs). The report also includes prioritised remediation recommendations to help technical teams effectively address the vulnerabilities. A debriefing meeting is organised to present the results, explain the attack scenarios observed and support your teams in implementing corrective measures.
A network penetration test can be carried out using two complementary approaches, each offering a specific perspective on the security of your corporate network.
Our auditors simulate an internal attacker with no prior knowledge of the network, systems or user accounts.
They explore the environment from minimal access in order to identify exploitable vulnerabilities, configuration errors or possible attack vectors.
Our auditors have partial information or limited access to the internal network (user accounts, architecture diagrams, network segments, etc.).
By combining an offensive approach with targeted knowledge of the environment, they identify deeper vulnerabilities related to access rights, internal configurations, or privilege management.
Choosing Vaadata to carry out an infrastructure and network penetration test means placing your trust in a leading French company certified to the most demanding international standards. Vaadata is PASSI, CREST, ISO 27001 and ISO 27701 accredited, guaranteeing the quality, methodology and compliance of its penetration tests with cybersecurity and data protection standards. These certifications demonstrate our commitment to maintaining high standards and adhering to industry best practices.
Our auditors hold numerous certifications, attesting to their expertise in identifying and exploiting complex vulnerabilities in heterogeneous network or Active Directory contexts.
Depending on your objectives, we adapt the scope of the internal pentest to target the most sensitive segments or perform a comprehensive assessment of the infrastructure. We guarantee personalised support to strengthen the security of your internal network and the overall resilience of your organisation in the long term.
