In this step, the objective is to compromise servers, applications, networks, bypass defense controls, etc. It is also where targeted or mass social engineering attacks occur, whether in person, via email, phone, chat apps or SMS. The exploit step is the first step into the target’s network, where it allows preparation for the next phase of privilege escalation and malware installation. After escalating privileges and, to ensure that remote access to exploited systems is stable and reliable, consultants use tools such as custom backdoors, task scheduling, adding users and keys to records, among other techniques. This is done so that the consultants can obtain relevant results to the project.

With persistence established through access to accounts and computers, at this stage the team will achieve the goals agreed with the client. This happens through lateral movements throughout the customer’s digital environment. From compromised systems or accounts, evidence is captured in photos, videos and audios. Usually with the success of this step, the team extracts critical data and information from the customer, with the objective of highlighting the exploited vulnerabilities and recommending improvements.

Upon completion of the project testing phase, an analysis is carried out on the identified points, where the main security controls to be taken to assist in the correction of vulnerabilities are listed, based on the best security practices and methodologies of the market, also considering the many years of experience accumulated by PROOF. Points for improvement and mitigation based on good practices are raised, aiming to increase the customer’s maturity in cybersecurity.