Perimeter appliance & VPN offensive testing

When it applies

An internet-facing appliance is in scope — a firewall/SSL-VPN (FortiGate, PAN-OS/GlobalProtect, Cisco ASA, Citrix NetScaler, Ivanti/Pulse), a Check Point gateway, or a load balancer — and you must test the live device, not just audit its config (network-service-attacks covers generic ports/SMB; defense-hardening-baseline is the config-audit counterpart). Edge appliances are today's number-one initial-access vector, so a version→CVE call has to be precise.

Why it works

Appliances expose crypto and management surfaces that leak more than they should: IKE aggressive mode hands out a crackable PSK hash, unauthenticated NTLM challenges leak internal host/domain names, and login pages/certs disclose enough to pin a firmware version. The trick is discipline: infer, don't assume — a version banner alone never proves a CVE, because banners are backported and spoofable. Every CVE call is a precondition check, not a blind "vulnerable."