Skip Ribbon Commands
Skip to main content
Home > Services > Profiling > PCI Internal A&P


PCI Internal Attack & Penetration


A PCI Attack and Penetration Assessment attempts to breach the PCI network segment by using the vulnerabilities identified during the client’s vulnerability scanning process. Vulnerability scan results are provided to SecureState from the client in advance of the testing. Once vulnerabilities have been identified, SecureState will use Penetration Testing techniques to exploit these vulnerabilities in an attempt to gain privileged access to PCI network segment systems.

  • Smaller scope penetration test focused on the PCI network
  • SecureState attempts to gain access to PCI customer and card holder information
PCI Attack and Penetration Process


Providing SecureState with recent vulnerability scan results removes the Discovery (Footprint) and Service Identification Phases of a typical Penetration Test; and allows SecureState to immediately begin the Exploitation Phase of a Penetration Test. This process results in a more focused attack and a quicker turnaround of results. SecureState has developed an approach that is extremely effective in testing the security of PCI network segment systems. This program includes controlled tests in which SecureState will attempt to gain access to your PCI related resources and ultimately to PCI customer and card holder information by exploiting vulnerabilities and using other information gathered from the vulnerability analysis phase.


Over the years, SecureState has developed custom toolsets that aid us in Penetration Testing. Additionally, SecureState has published to the security community a wide variety of tools to help penetration testers in identifying potential exposures within their networks. Many of these tools have been integrated into popular attack frameworks such as Metasploit. During the Penetration Test, SecureState will demonstrate some of the proprietary tools used and how they work.

Did You Know?

  • PCI-DSS 11.3 requires Penetration Testing to be performed
  • Penetration Tests are not Vulnerability Assessments
  • Penetration Tests should be performed at least once a year and after any significant application modification or network upgrade
  • Penetration Tests should follow industry standard testing methodologies
  • Penetration Tests are an important part of any security program

Our Approach and Methodology

The SecureState Profiling Team is well known and highly regarded as experts in Penetration Testing. Our approach follows industry accepted testing methodologies such as PTES, NIST 800-115 and OSSTMM. By following these methodologies, our clients can accurately replicate the testing SecureState has performed in their own environment to accurately mitigate identified vulnerabilities. The SecureState Profiling Team also helps identify strategic “root cause” issues through our Penetration Tests. Our Risk Management Team is uniquely positioned to work closely with the Profiling Team in order to assist clients with mitigating these strategic “root cause” issues.

Phase I – Vulnerability Analysis:

Providing SecureState with internal vulnerability scan results removes the Discovery (Footprint) and Service Identification Phases of a typical Penetration Test and allows SecureState to immediately begin the Exploitation Phase. This process results in a more focused attack and a quicker turnaround of results. SecureState will use the most recent internal vulnerability scan results provided by the client to conduct this Vulnerability Analysis.

The internal vulnerability scan results provide not only vulnerability information, but also the ports and services that are exposed. SecureState will assess open ports and services from the vulnerability scans to look for potential targets, such as accessible HTTP, Telnet, RDP, and other ports that allow remote access or web server functionality.

Vulnerability scanners are notorious for outputting numerous false positives that are not applicable to a given environment. Engineers manually review scanner outputs to ensure verified vulnerabilities are applicable to only your PCI environment.

Phase II - Application Layer Testing:

During Internal Attack and Penetration Testing, SecureState often encounters web applications within the scope of testing. When this occurs, SecureState will perform limited manual testing of the web application in an attempt to identify common web application vulnerabilities such as SQL injection, file upload or command injection. While a Web Application Security (WAS) Assessment attempts to identify a breadth of vulnerabilities in a web application, application layer testing focuses on depth and on identifying vulnerabilities which ultimately will lead to complete access to critical systems and data.

SecureState will not test the business logic of the web application or attempt to understand how vulnerabilities may affect users of the system. Additionally, SecureState will not use credentials to test the application, truly making application layer testing a “blind test.”

Phase III – Exploitation:

SecureState first will manually validate the results from the scan. Next, all identified vulnerabilities will be assessed as to the likelihood of exploitation. The client’s Project Lead will be notified prior to any type of intrusive activity that potentially could impact network performance or system stability.

Phase IV – Locate Card Holder Data:

Upon discovering an exploitable vulnerability which allows the ability to gain elevated access to card holder data, SecureState will communicate the issue to the client within a mutually agreed upon timeframe.


What Makes Us Different


  • Uses a team based approach for all Penetration Tests
  • Utilizes proprietary Vulnerability Linkage Theory (VLT) to achieve a greater attack
  • Demonstrates proprietary tools to Clients during Penetration Testing
  • Publishes our own Exploits, Zero Days and Tools to the Information Security Community
  • Profiling Team members are known as experts in Penetration Testing worldwide
  • Profiling Team members are frequent speakers at National and worldwide security and hacking conferences such as DEFCON, Black Hat, OWASP AppSec, SANS, ShmooCon, THOTCON, DerbyCon, ToorCon and more
  • Conducts all Penetration Tests from our state-of-the-art hacking facility in SecureState’s world headquarters; a DOD cleared facility
  • Has the capability to perform secure remote Internal Penetration Tests using the latest Penetration Testing technology
  • Provides a secure two-factor authentication web portal for access to Penetration Test results
  • Follows industry standard testing methodologies and vulnerability rating systems