Penetration testing

What it is

A penetration test chains weaknesses together. A low-rated misconfiguration plus a reused password can add up to full control of a server, and a scanner will not tell you that. A person has to try it.

We test external networks, internal networks, web applications and APIs, and cloud configuration. Our approach follows NIST SP 800-115 and, for applications, the OWASP Web Security Testing Guide and ASVS.

What you get

• A written rules-of-engagement document before testing starts
• Immediate notice if we find something critical, instead of waiting for the final report
• Findings with step-by-step reproduction, evidence and CVSS scores
• An attack narrative: what we reached and the path we took
• Fix guidance for each finding and a retest of what you fix

How it works

1. Scope and rules of engagement

   Targets, allowed techniques, testing hours, escalation contacts and what is off limits, all in writing.

2. Reconnaissance

   We learn what an outsider can see about you before we touch anything.

3. Testing

   Manual testing with tools: authentication and access control, injection, misconfiguration, weak credentials, exposed services.

4. Exploitation and proof

   We confirm that a weakness is usable, capture evidence, and stop short of damage or data loss.

5. Reporting and readout

   You get the report, a walkthrough, and a retest window once fixes are in.

What we need from you

• Signed authorization and rules of engagement
• Target list, plus test accounts for each user role if applications are in scope
• A technical contact during the test window
• Notice to your hosting or cloud provider where their policy requires it