A client — a fintech startup on React and Laravel — once lost $50,000 due to an IDOR vulnerability: any user could substitute another user's ID in a request and obtain transaction data. We found this during a pentest, but the code was already in production. Such cases are common if penetration testing isn't done before release. We specialize in web application penetration testing and know how to find even non-obvious attack chains. Get a consultation on penetration testing — we'll assess your app's risks.
Why pentesting matters more than auditing
Security audits often limit themselves to scanning and checklists. Pentesting goes further: we actively exploit vulnerabilities to show real business impact. For example, SQL injection can lead not only to data leaks but also to full server control. We simulate an attacker's actions using modern tools and techniques. According to OWASP, pentesting identifies three times more critical vulnerabilities than automated scanning.
How we conduct testing
We use a combination of automated scanners and manual analysis. Manual testing yields 40% more findings than automated scanners, especially in authentication logic and business processes. Our engineers hold OSCP and GPEN certifications and have 5+ years of pentesting experience.
Pre-engagement
Before starting, we sign a Statement of Work (SoW) and Rules of Engagement to clearly define the scope, permissible methods, and testing window. This ensures your systems remain safe and we don't exceed boundaries.
Reconnaissance (OSINT)
We gather maximum information from open sources: subdomains, DNS records, leaked credentials on GitHub, old page versions via Wayback Machine. This reveals entry points not visible on the surface.
Scanning and analysis
We use Nmap for port scanning, Burp Suite for traffic analysis, Gobuster for directory brute-forcing. We also check JavaScript files for API keys and internal endpoints.
# Example: subdomain search via crt.sh curl "https://crt.sh/?q=%.example.com&output=json" | jq '.[].name_value' Exploitation
We don't just find vulnerabilities — we build attack chains. A real case:
- Found SQL injection in the
filterparameter of the user export feature. -
sqlmap --os-shell— got a shell on the server. - Extracted AWS keys from
.envand gained access to the S3 bucket with database backups.
We check for IDOR, race conditions, session fixation, SSRF, RCE, and other typical vulnerabilities. For this, we write Python or Go scripts that emulate an attack from multiple accounts.
Example attack chain based on OWASP Top 10
- Reconnaissance -> find vulnerable endpoints.
- SQLi exploitation -> get shell.
- Privilege escalation -> access data.
- Cover tracks.
Post-exploitation
After successful exploitation, we assess potential damage: what data is compromised (PII, financial info), whether there's a path for lateral movement, and if persistence can be established. This helps the business understand real risks.
Reporting
We prepare a detailed report including:
- Executive summary for management with risk assessment and top 3 findings.
- Technical description of each vulnerability: PoC, screenshots, CVSS score, remediation recommendations.
- Roadmap: P1 (24–72 h), P2 (1–2 weeks), P3 (next release).
- Methodology: tools, timeline, what wasn't tested.
What's in the report?
The pentest report includes an executive summary for management, technical details with PoC, screenshots, and CVSS scores, as well as a remediation roadmap. We also attach the methodology and test scope.
How to prepare for a pentest?
Before the pentest, define the scope, prepare test accounts, and ensure you have log access. It's important to agree on Rules of Engagement and testing time to avoid disrupting production.
Comparison of pentest types
| Parameter | Black Box | Grey Box | White Box |
|---|---|---|---|
| System information | None | Partial | Full |
| Attack depth | Low | Medium | High |
| Time (simple site) | 3–5 days | 2–4 days | 2–3 days |
| Realism | Full | Partial | Low |
According to OWASP Testing Guide, Grey Box provides the best balance of depth and realism.
Timelines
| Application type | Black Box | Grey Box | White Box |
|---|---|---|---|
| Simple site | 3–5 days | 2–4 days | 2–3 days |
| SaaS / marketplace | 10–14 days | 7–10 days | 5–7 days |
| Banking / fintech | 21–30 days | 14–21 days | 10–14 days |
Cost is calculated individually. Keep in mind that pentesting investments pay off many times over: the average cost to fix a critical vulnerability is 10 times less than the cost of remediating a breach. Order a pentest now and secure your business.
Our experience
We have conducted over 200 pentests for companies in the top 50 of our region, including fintech, retail, and government portals. Our engineers hold OSCP, GPEN, CISSP certifications and have 5+ years of experience. We guarantee confidentiality of all data and full NDA compliance.