We’re excited to share what’s new in Core Impact v21.8! This release is all about making your penetration testing workflows more efficient, more integrated, and easier to manage. Let’s dive into the highlights.
Smarter Agent Deployment
Agents are at the heart of Core Impact, and we’ve made them even better:
New OSCI Agent Entity
In many cases, it is very difficult to get an agent deployed on a specific system due to hardening, network configuration, or target operating system. Through this new feature, it is possible for some Remote Command Injection vulnerabilities to run commands on a target system without deploying a physical Agent. Below you can see a short demo of this new OSCI agent working:
RX Memory Page Mapping
Agents can now be generated and mapped in RX memory pages for improved execution. That improves the capability to inject those Agents via a Cobalt Strike Beacon without having to set the `userwx` flag to true.
Better Reporting and Integration
Need to share results with your SIEM? We’ve got you covered:
Syslog CEF Export
You can now export workspace information in CEF format via syslog using the module “Export results into Syslog (CEF formatted).” This makes it easier to centralize your data and keep your security team in the loop.
Other Quality of Life Improvements
SQL Server Express Limit Handling: No more surprises when hitting the 10GB limit. Core Impact will stop at 95% capacity, giving you time to clean up workspaces.
Add Hosts by IP and Name: Organize your targets the way you want.
Support for the latest Metasploit framework exploits.
Re-run Information Gathering on created hosts to get updated information.
Why Upgrade?
Core Impact v21.8 is all about efficiency, integration, and reliability. From smarter agent handling to better syslog export options, this release ensures your penetration testing workflows remain robust and adaptable.
Ready to Try It?
Upgrade today and take advantage of these new capabilities. For full details, visit our Core Impact Release Notes page.
Interested in Core Impact?
See these new features in action and more with a personalized demo.
Pen Testing Use Case – Finance
Core Banking & Customer Portal Penetration Test
Background
A major retail bank relies on a cloud-hosted customer banking portal and an internally developed mobile app for millions of customers worldwide. The bank wants to ensure these systems are resistant to real-world cyberattacks that could compromise customer data, disrupt transactions, or damage trust.
Phase 1: Planning and Reconnaissance
To begin, pen testers gather as much information as possible about the bank’s systems, employees, network, website, application, and architecture.
-
Passive Reconnaissance: They use Open Source Intelligence (OSINT) techniques to gather information for social engineering attacks (via social media, the bank’s website, public records, and online databases), as well as for technical inroads (IP addresses, domain names, and technologies used).
-
Active Reconnaissance: They perform a perimeter test, probing the public-facing mobile app, the customer banking portal, and any other exposed services for vulnerabilities in line with OWASP Top 10 and CWE/SANS Top 25.
Phase 2: Scanning
Next, pen testers subject the bank’s mobile app, customer portal, and other public-facing services to further investigation using automated tools that scan for exploitable weaknesses.
-
Validate Scans: Core Impact can validate vulnerabilities from over 20 scanners, integrating with Fortra VM, Burpsuite, Nessus, Qualys, Tenable, and more.
-
Prioritize Findings: After completing a scan of the environment, pen testers use Core Impact to provide a prioritized validation of the bank’s internal weaknesses.
Phase 3: Gaining Access
Pen testers attempt to gain control over the bank’s services using the information gained in the reconnaissance and scanning stages.
-
External Application Testing: They simulate attacker attempts to exploit customer-facing banking portals and APIs (e.g., injection, broken authentication, improper access controls).
-
API Security Review: Testers focus their efforts on FinTech integrations and open banking APIs (in line with PSD2 compliance).
-
Payment Workflow Tampering: Pen testers try to manipulate transaction parameters or bypass transaction confirmation steps.
-
Mobile App Reverse Engineering: Testers assess whether the mobile app’s code, APIs, and local storage leak sensitive data or expose keys.
-
Social Engineering: They leverage Core Impact to conduct an automated phishing campaign. Posing as the FDIC, pen testers create a simulated malicious phishing email that notifies banking executives about the soon-to-be-retired FFIEC Cybersecurity Assessment Tool (CAT). The link provided in the email contains malware that will download upon clicking.
Phase 4: Maintaining Access
Pen testers now look to leverage initial access, maintain persistence, and demonstrate avenues for additional damage within the bank’s digital infrastructure.
-
Privilege Escalation Attempts: They test for ways to move from a standard customer account to administrative or back-end access. With Core Impact, this step is automated.
-
Lateral Movement: Using elevated access, pen testers attempt to pivot into systems holding sensitive PII, such as databases containing account numbers, addresses, and login credentials.
-
Data Exfiltration Simulation: Using Core Impact, testers assess how easily sensitive datasets could be extracted and whether the data loss prevention (DLP) tools in place effectively trigger alerts.
-
Establish Persistence: Core Impact’s patented Core Agents help pen testers establish persistence within the bank’s internal systems. OS agents operate like malware, and persistent agents can be planted in the bank’s file system to provide a longer-lasting foothold.
Phase 5: Reporting
The bank receives a detailed report of the results of the penetration test, outlining the scope, methods used, vulnerabilities discovered, and prioritized security remediation recommendations.
Core Impact’s automated reporting feature supports a number of reporting formats, based on the type of pen test used, and helps prove compliance with standards such as HIPAA, GDPR, and PCI DSS.
Outcome & Lessons Learned
At the outset, the retail bank commissioned the penetration testing report with several objectives in mind.
-
Identify Exploitable Vulnerabilities Before Threat Actors Do: By the time financially motivated attackers probe the bank’s website, app, or customer portal, it is already too late. Pen testing lets the financial institution experience this same level of awareness within a safe setting and with time to spare.
-
Ensure Compliance With PCI DSS, FFIEC Guidance, and Internal Risk Controls: Increasingly, compliance mandates require penetration testing as a necessary security measure to test defenses and reduce risk within the financial sector.
After receiving the pen testing report, the bank understands key areas of concern within the network, its end-users, and its mobile application that could jeopardize these objectives.
Advanced Penetration Testing Tools
Fortra’s Core Impact provides multi-vector, comprehensive penetration tests for major retail banks looking to reduce risk and meet compliance standards. Supported by a dedicated team of exploit writers, threat researchers, and data scientists, this automated pen testing solution provides financial firms with a stable, up-to-date library of commercial-grade exploits.
Don’t let your bank be beaten by intrepid attackers. Get automated, centralized, consistently current penetration tests from Fortra’s Core Impact.
See Core Impact in Action
Conduct advanced penetration tests with ease and efficiency. See what our powerful penetration testing platform can do by viewing this on-demand demo.
Pen Testing Use Case – Government
Critical Citizen Services Penetration Test
Background
A national government agency operates a secure web platform for delivering citizen services such as benefits applications, licensing, and tax filings. The agency wants to proactively identify weaknesses in its public-facing and internal systems before they can be exploited by hostile actors.
Phase 1: Planning and Reconnaissance
The pen testers gather critical information about the target organization, its employees, its network, and systems.
-
Passive Reconnaissance: They leverage Open Source Intelligence (OSINT), or publicly available data like public records, social media posts, the public-facing website, and online databases, to glean intelligence on the government agency’s key stakeholders and material assets.
-
Active Reconnaissance: Pen testers perform a perimeter assessment. This tests the agency’s public-facing web apps, customer/citizen portals, and exposed services for vulnerabilities in line with OWASP Top 10 and CWE/SANS Top 25.
Phase 2: Scanning
The public sector agency is probed with automated tools to identify vulnerabilities, open ports, and exploitable services.
-
Validate 20+ Scanners: Using Core Impact, pen testers can validate the results of more than 20 third-party scanners. These include Fortra VM, Nessus, and BurpSuite.
-
Prioritize Results: Following the scan, Core Impact prioritizes the results to give the government agency’s security team a severity-based list of where to begin remediations.
Phase 3: Gaining Access
The penetration testers use the information gained in reconnaissance and scanning to gain unauthorized access to the agency’s network and systems. The goal is to gain control over the target and demonstrate potential damage by an outside attacker.
-
Access Control Testing: They validate that only authorized roles can access sensitive citizen records (benefits forms, tax documents, business licenses), even under complex multi-role workflows. In this case, they discover a vulnerability in a public-facing website that can be exploited to allow unauthorized access to a database containing business license numbers and contact information.
-
Password Cracking: Pen testers leverage Core Impact to communicate securely with password-cracking service CloudCypher. The communication is encrypted with mutual authentication. Any Windows NTLM hashes discovered are passed back to Core Impact for further use in the agency’s penetration test.
-
Social Engineering: Using Core Impact, pen testers launch an automated phishing campaign impersonating a CISA threat sharing advisory, warning the agency to be wary of tax season scams. The campaign is sent to the head of the agency, key stakeholders, and the CISO.
-
Infrastructure Security Review: The pen testing team includes firewall, VPN, and email gateway testing (for additional resilience against phishing-based initial access) when attempting to gain entry to the target.
Phase 4: Maintaining Access
At this stage, the pen testers try to establish persistence into the agency’s systems to increase their chances of exfiltrating sensitive citizen data over time.
-
Privilege Escalation & Lateral Movement: They attempt to escalate privileges within the agency’s internal network and pivot into systems holding sensitive PII (tax filing databases, SSNs associated with Social Security benefits, etc.).
-
Data Exfiltration Simulation: Pen testers assess how easily sensitive datasets could be extracted from public-facing systems (SQL attacks), and whether data loss prevention (DLP) tools trigger alerts.
-
Establish Backdoors: The pen testing team has the option of partnering with Cobalt Strike Beacon to create backdoors to establish persistence and maintain access to the target.
Phase 5: Reporting
A report is delivered to the agency providing a detailed account of the vulnerabilities discovered during the penetration test. The agency receives a summary of key findings and actions taken at each phase, along with prioritized recommendations for remediation.
The pen testers recommend regular vulnerability scans and patch management across internal systems and the agency’s public-facing website, increased password security standards, and multi-factor authentication (MFA) as a second line of defense against credential abuse.
Outcome & Lessons Learned
This government agency had several objectives in mind when deciding to perform a penetration test. They included:
-
Demonstrating Regulatory Compliance: Standards like NIST 800-53 and FISMA both require pen testing as a mandatory security control for federal agencies.
-
Improve Citizen Trust: Publicizing the fact that they perform regular, third-party penetration tests earns them the trust of the public and increases the number of citizens likely to interact with that agency’s services.
-
Harden Defenses Against Both Nation-State and Cybercriminal Threats: Unpatched vulnerabilities are an open invitation to sophisticated nation-state actors who can do a lot with these easy entry points.
Advanced Penetration Testing Tools
With Fortra’s Core Impact, public sector agencies get a comprehensive, multi-vector solution for assessing vulnerabilities within their systems and network. Get commercial-grade exploits in this automated pen testing software with a solution that tests all its exploits in-house, supports third-party exploits, and subjects its exploit library to rigorous testing on a weekly basis to ensure there are no unexpected surprises, and no backdoors are left behind.
Core Impact stays current with more than ten new exploits every month, making it the perfect tool to keep any government agency up to date with the latest emerging threats.
See Core Impact in Action
Conduct advanced penetration tests with ease and efficiency. See what our powerful penetration testing platform can do by viewing this on-demand demo.