Penetration testing: We break the product first.

An active penetration test following OWASP WSTG and PTES: a real attempt to break in, through to access and privilege escalation. Concrete findings with CVSS 3.1 and reproduction steps, a video walkthrough of the critical ones, and 30 days of re-testing. The report is short and to the point — only what matters for fixing it.

Start a project Price PDF

CVSS 3.1

scoring on every finding

PTES

+ OWASP WSTG methodology

30 days

of re-testing included

1–2 wks

from sign-off to report

SOUND FAMILIAR?

Where it usually hurts

Защищено только на словах

Подрядчик заверил, что всё надёжно, но никто не пробовал обойти вход в вашу систему. Слабое место первым находит посторонний.

Доступы шире, чем кажется

Из-за ошибки в правах обычный пользователь видит чужие заказы или попадает в управление сайтом. Узнают об этом по жалобе или утечке.

Партнёр просит отчёт

Крупный заказчик хочет подтверждения, что ваш сервис защищён, ещё до подписания договора. Без отчёта сделка встаёт на паузу.

Приложение не проверяли

Сайт смотрели, а мобильное приложение и его связь с сервером нет. Через него к тем же данным можно добраться другим путём.

WHAT YOU GET

What the business gains

A real break-in, not a scanner

Manual exploitation through to access and privilege escalation, not an automated scan. We find what scanners miss.

By the methodology

PTES + OWASP WSTG as the checklist. We document every step so you can reproduce any finding and confirm it's real.

Ahead of the attacker

We find the vulnerabilities before a real attack does. A pentest is cheaper than a data breach and a regulatory fine.

Re-testing included

30 days of re-testing: fix it and we verify at no extra cost. For critical findings we coordinate an emergency fix.

WHAT'S INCLUDED

A tight PDF rather than a scanner dump: what we found, how to reproduce it, how to fix it — plus video on the critical findings.

What we test

Web (frontend + API) against OWASP WSTG, mobile (if there is one) against OWASP MASVS, servers along the way. No social engineering and no DDoS — that's a separate red-team format.

Web: a full OWASP WSTG pass
API: auth / authz / IDOR / rate-limit / CORS
Mobile: OWASP MASVS (iOS + Android)
Servers: headers, TLS, secrets, SSRF
Not included: social engineering, DDoS, destructive tests

Methodology

We work to PTES + OWASP rather than intuition. Every step is documented: reconnaissance, discovery, exploitation, escalation. Every finding is reproducible from the instructions.

PTES (Penetration Testing Execution Standard)
OWASP WSTG / MASVS as the checklist
Reconnaissance → exploitation → privilege escalation
Reproduction steps for every finding

A report with substance

A tight PDF, not a boilerplate export. Every finding carries severity, CVSS 3.1, CWE, how to reproduce it and how to fix it. Critical findings come with a video walkthrough.

Severity + CVSS 3.1 + CWE ID
Reproduction and a specific fix
Video walkthrough of critical findings
A summary for management + detail for engineering

After the pentest

A vulnerability nobody fixes is useless. 30 days of re-testing are in the price: fix it and we verify. For critical findings we coordinate the emergency fix and help with the regulator.

30 days of re-testing — free
Coordinated emergency fixes for critical findings
Help with the regulator notification after a breach
Long-term monitoring — quoted separately

HOW WE WORK

From brief to launch

Week 0Scoping, NDA, the scope document signed offpentester
Week 1Reconnaissance, automated tooling, deep manual workpentester
Week 2Exploitation, escalation, documentationpentester
+ 1 dayPDF handover + call + critical findingspentester
+ 30 daysRe-testing after your fixes — freeincluded

PACKAGES

Pick the scope

WEB PENTEST8–10 days

A mid-complexity web application. OWASP WSTG. PDF + 30 days of re-testing.

Web + API
OWASP WSTG
PDF + video on critical findings
30 days of re-testing
Mobile (iOS / Android) — not included
Deep server review — not included

Discuss

FULL STACK2 wks

Web + mobile + API + servers. OWASP WSTG + MASVS. 60 days of re-testing.

Web + mobile + API + servers
OWASP WSTG + MASVS
Video on critical findings
60 days of re-testing
Coordinated emergency fixes
Help with the regulator notification

Start a project

RED TEAM3–4 wks

Social engineering, phishing, physical testing, long-lived access.

Social engineering + phishing
Physical penetration testing
Long-lived persistence
MITRE ATT&CK coverage
A full red-team report
A debrief with your security team

Discuss the scope

Package prices are in the price list. We put an exact number on it after a free review of the task.

Price PDF

FREQUENTLY ASKED

Questions about this service

This is an active pentest — do you really attack the system?

Yes, actively: through to access and privilege escalation. No destructive actions (no DROP TABLE). The scope document is agreed before we start and everything happens under contract.

Is there a risk of disrupting production?

Where possible we work on staging. If it has to be production, we work in a low-traffic window with a rollback ready. Destructive operations are excluded by contract — the goal is to find vulnerabilities, not to break the service.

How does a pentest differ from a security audit?

An audit analyses code and configuration against OWASP and explains each finding. A pentest is an active break-in attempt, with manual exploitation. The strongest result comes from pairing them: audit plus pentest.

Will you give concrete CVE/CVSS figures for our reporting?

Yes. Every finding carries CVSS 3.1 and a CWE ID with reproduction steps and a fix. Convenient for reporting to a regulator, to clients, or during certification.

How many re-test rounds are there?

One round is included within the 30 days (or 60 on the full stack): fix it and we verify at no extra cost. Additional rounds are charged at a fraction of the cost, depending on scope.

Next step

Let's break the product before an intruder does.

Start a project Security Review (product)