Penetration Testing

Engagements are scoped to your risk profile, conducted under strict rules of engagement, and delivered with proof-of-concept demonstrations that communicate risk to both technical teams and boards.

Network Penetration Testing

Our network penetration tests evaluate the security posture of your internal and external network infrastructure. We identify misconfigurations, weak authentication mechanisms, unpatched services, and trust relationships that attackers exploit to gain unauthorized access and move laterally through your environment.

• External perimeter testing — internet-facing assets, firewalls, VPNs, and DMZ services
• Internal network testing — Active Directory attacks, NTLM relay, Kerberoasting, and lateral movement
• Segmentation validation — verify that network boundaries actually contain threats as designed
• Wireless security assessment — rogue access point detection, WPA2/WPA3 testing, evil twin attacks, and client isolation verification
• VPN and remote access testing — authentication bypass, session hijacking, and split-tunnel risks

Web Application & API Testing

Modern organizations depend on web applications and APIs to serve customers, process transactions, and integrate systems. A single vulnerability in these components can expose sensitive data, enable account takeover, or provide an entry point into your entire infrastructure.

• OWASP Top 10 coverage including injection, broken access control, cryptographic failures, and SSRF
• Authentication and session management testing — OAuth/OIDC flows, JWT handling, MFA bypass attempts
• REST, GraphQL, and SOAP API security testing with full endpoint enumeration
• Business logic testing — race conditions, privilege escalation, and workflow bypass
• Client-side security — XSS, CSRF, DOM manipulation, and insecure deserialization

Social Engineering Assessments

Technology controls are only as strong as the humans who interact with them. Our social engineering campaigns measure your organization's resilience against phishing, pretexting, vishing, and physical intrusion attempts, providing measurable baselines and targeted training recommendations.

• Spear phishing campaigns with custom pretexts tailored to your organization
• Vishing (voice phishing) to test call center and helpdesk procedures
• Physical social engineering — tailgating, badge cloning, and facility infiltration
• USB drop campaigns and other media-based attacks
• Detailed metrics on click rates, credential submission, and reporting behavior

Our Methodology

Every Mjolnir penetration test follows industry-recognized frameworks to ensure comprehensive coverage and repeatable results. Our methodology integrates the best elements of PTES (Penetration Testing Execution Standard), OWASP Testing Guide, and NIST SP 800-115 into a structured approach that covers reconnaissance, vulnerability identification, exploitation, post-exploitation, and detailed reporting.

• Pre-engagement scoping and rules of engagement definition
• Open-source intelligence (OSINT) gathering and attack surface enumeration
• Automated and manual vulnerability identification
• Controlled exploitation with real-time communication
• Post-exploitation analysis including privilege escalation and data access
• Comprehensive reporting with executive summary, technical findings, and remediation priorities
• Post-remediation validation testing at no additional cost