Core Impact 6.0 is a pure penetration testing tool. It is optimised for production use and comes with a suite of preprogrammed exploits. The support agreement provides regular updates with new exploits. Users can write their own exploits and can add to existing ones in the library. Core Impact can perform preconfigured scenarios or individual exploits.
Penetration tools tend to be designed for very skilled users. They often run from command lines and execute individual exploits only. While this is adequate for a research laboratory, when it comes to the production testing of large networks, speed, accuracy and repeatability are critical. This is where this software-based solution shines. It is a product developed for the savvy penetration tester.
Impact can perform a set of pre-programmed functions that sequentially scan the entire network for vulnerabilities, attempt to penetrate, attempt to plant mini-shells and continue testing. Alternatively, and most important for the skilled penetration tester, individual exploits can be run, shells planted in the target and the exploit confirmed.
Exploits are written in Python and conform with common vulnerabilities and exploits (CVE). We know of no other product that performs penetrations in this manner.
The solution tracks all actions of the user and creates a detailed log of the user's behaviour as well as that of the program. Several stock reports are available and these can be customised.
Finally, the documentation is very good, containing all of the information needed to implement successfully.
Support is first rate and, although the product seems pricey at nearly £13,000, that licence covers an unlimited range of IP addresses. This actually places it at the lower end of the scale for scanners.
We rate Core Impact 6.0 as Lab Approved for its comprehensive capability in a production environment, performance and ease of use.