BERRY9 IT Services, home +91 86868 92922

Pen-Testing VPNs and Zero-Trust Gateways

VPN appliances and zero-trust network access (ZTNA) gateways occupy the same architectural slot — they are the front door for remote employees and contractors. They have very different threat models, very different attack surfaces, and very characteristic weaknesses.

Request a scoping call Call +91 86868 92922

Network · By Thimmagurudu Bathini · Published · 6 min read · Last reviewed

VPN appliance weaknesses

The big-vendor SSL-VPN appliances (Pulse Secure, Fortinet FortiGate, Citrix NetScaler, Cisco ASA) have had a steady stream of pre-auth RCEs over the last six years. The appliance itself is often the breach. We check firmware versions against the published CVE list, test for management interface exposure, and verify that admin authentication is MFA-protected.

ZTNA gateway weaknesses

Newer ZTNA architectures (Cloudflare Access, Tailscale, Twingate, ZScaler Private Access, BeyondCorp-style) shift trust from network location to identity. The attack surface moves to the identity provider, the device posture check, and the policy engine. Common weaknesses:

  • Identity provider not enforcing MFA for the IdP itself
  • Device posture checks bypassed by spoofing the agent's reported state
  • Application allowlists too broad — a single account compromise grants access to more than necessary
  • Session lifetimes too long, with no re-evaluation on context change

What we test

For both, we attempt to authenticate without legitimate credentials (credential stuffing, password spray, OAuth state confusion), with credentials but no MFA, and with credentials plus MFA from an unusual context. The goal is to map the actual enforcement, which is rarely what the documentation says.

See network penetration testing.

Written by Thimmagurudu Bathini, BERRY9 IT SERVICES PRIVATE LIMITED, Hyderabad. Questions about your own systems? Request a scoping call or call +91 86868 92922.

Plan your next security test

Tell us what needs testing and when you need it done, and we will propose a scope and timeline. We respond within 24 hours. If you would rather talk first, call or write to us.

Request a scoping call WhatsApp