Frequently Asked Questions

Penetration testing (pentesting) is a simulated cyberattack on your application to identify security vulnerabilities before real hackers do. We act like ethical hackers to:

• Discover security weaknesses in your web apps, APIs, and infrastructure
• Test authentication, authorization, and data protection mechanisms
• Verify compliance with security standards (OWASP, PCI-DSS, GDPR)
• Provide detailed remediation steps to fix found vulnerabilities

Think of it as a "security health check" for your digital assets.

Regular penetration testing is essential for several reasons:

• Prevent Data Breaches: Identify and fix vulnerabilities before attackers exploit them
• Compliance: Meet regulatory requirements (GDPR, PCI-DSS, ISO 27001, SOC 2)
• Customer Trust: Demonstrate security commitment to clients and partners
• Cost Savings: Fixing vulnerabilities early is 100x cheaper than dealing with a breach
• Insurance: Many cyber insurance policies require regular security audits
• Competitive Advantage: Security certifications help you win enterprise contracts

All tests are performed by Certified Ethical Hackers (CEH) with extensive experience in:

• Web application security (OWASP Top 10)
• API security testing (REST, GraphQL, SOAP)
• Cloud security (AWS, Azure, GCP)
• Modern frameworks (React, Vue, Node.js, Django, Laravel)
• Mobile application security

We combine automated tools with manual testing expertise to find vulnerabilities that scanners miss.

Automated scanners are useful but limited. Our manual penetration testing provides:

• Business Logic Testing: We understand your app's workflow to find logic flaws scanners can't detect
• Context-Aware Testing: We analyze your specific use case and tech stack
• Creative Exploitation: We think like real attackers to chain vulnerabilities
• False Positive Reduction: We verify findings so you don't waste time on false alarms
• Actionable Reports: Clear explanations and step-by-step fixes, not just CVE numbers

The Starter package includes:

• Full OWASP Top 10 security testing
• Web application and API vulnerability assessment
• Frontend and backend security analysis
• Authentication and session management testing
• Comprehensive technical report with severity ratings
• Remediation recommendations
• 7-day delivery
• Email support during testing

Best for: Startups, SMBs, and single web applications

Professional package (€3,370) adds:

• Subdomain enumeration: Test all subdomains (api.*, admin.*, staging.*, etc.)
• Port scanning: Full infrastructure mapping and exposed service testing
• Free retest: After you fix vulnerabilities, we verify them at no cost
• Priority support: Direct communication channel during testing
• Executive summary: Non-technical report for management/board
• Compliance mapping: How findings relate to GDPR, PCI-DSS, etc.

Best for: Growing companies, complex apps, and compliance needs

Yes! Retest policy:

• Professional package: One free retest included (within 90 days)
• Starter package: Retest available at €50 per vulnerability
• Enterprise: Unlimited retests included

A retest verifies that vulnerabilities were properly fixed. We'll confirm each issue is resolved or provide additional guidance if needed.

We accept multiple payment options:

• Bank transfer (EUR, USD)
• Credit/Debit cards (via Stripe)
• PayPal
• Cryptocurrency (via Stripe)

Payment terms: 50% upfront, 50% upon report delivery (flexible for Enterprise)

Timeline depends on scope:

• Starter (simple app): 5-7 days
• Professional (complex app): 10-14 days
• Enterprise (multiple apps): Custom timeline

Breakdown:

1. Day 1-2: Reconnaissance and scoping
2. Day 3-5: Active testing and exploitation
3. Day 6-7: Analysis, report writing, and delivery

We can expedite for urgent needs (rush fee may apply).

To begin testing, we need:

• Target URLs: All domains/subdomains in scope
• Testing type: Black box, grey box, or white box
• Credentials (grey/white box): Test accounts at different permission levels
• Out-of-scope items: Any systems we shouldn't test
• Testing window: Preferred dates/times (especially for production)
• Point of contact: Technical contact for questions during testing

Optional but helpful: Architecture docs, API documentation, known issues

No. We take precautions to ensure safe testing:

• Non-destructive testing: We don't delete data or crash systems
• Controlled exploitation: We prove vulnerabilities exist without causing damage
• Rate limiting: We avoid DoS conditions that could impact performance
• Staging environment preferred: We recommend testing on staging first when possible
• Off-peak testing: For production, we can test during low-traffic periods

We'll stop immediately if any issues arise and notify you.

Our comprehensive report includes:

• Executive Summary: High-level findings for non-technical stakeholders
• Vulnerability Details: Each finding with severity rating (Critical/High/Medium/Low)
• Proof of Concept: Screenshots, request/response data showing exploitation
• Risk Assessment: Business impact analysis for each vulnerability
• Remediation Steps: Specific fixes for developers (code examples when relevant)
• OWASP Mapping: How findings relate to OWASP Top 10
• Retest Results: If applicable, verification of fixes

Format: PDF + optional formats (JSON, XML, CSV) for integration with your tools

We test for the complete OWASP Top 10 and more:

• Injection: SQL, NoSQL, LDAP, OS command, XXE
• Authentication: Broken auth, session management, password policies
• Authorization: IDOR, privilege escalation, broken access control
• XSS: Reflected, stored, DOM-based cross-site scripting
• CSRF: Cross-site request forgery attacks
• SSRF: Server-side request forgery
• Cryptography: Weak encryption, insecure storage, SSL/TLS issues
• Business Logic: Payment bypass, workflow manipulation, race conditions
• API Security: Mass assignment, rate limiting, GraphQL issues
• File Upload: Unrestricted uploads, path traversal
• Security Misconfigurations: Default credentials, exposed admin panels

Yes! API security testing is included in all packages. We test:

• REST APIs: Authentication, authorization, rate limiting, input validation
• GraphQL: Query depth limits, introspection, batch attacks, injection
• SOAP: XML injection, schema validation
• WebSocket: Real-time communication security
• API Gateway: WAF bypass, token handling

We test both documented and undocumented endpoints.

We have experience with all modern tech stacks:

Frontend: React, Vue.js, Angular, Next.js, Nuxt.js, Svelte

Backend: Node.js, Python (Django/Flask), PHP (Laravel/Symfony), Ruby on Rails, Java (Spring), .NET, Go

Databases: PostgreSQL, MySQL, MongoDB, Redis, Elasticsearch

Cloud: AWS, Azure, Google Cloud Platform, DigitalOcean, Heroku

Mobile: iOS, Android, React Native, Flutter

If you're using something not listed, just ask! We constantly adapt to new technologies.

Yes! Mobile app penetration testing includes:

• Static Analysis: Reverse engineering, code review, hardcoded secrets
• Dynamic Analysis: Runtime behavior, API communication, data storage
• Network Traffic: SSL pinning, certificate validation, man-in-the-middle
• Local Storage: Insecure data storage, SQLite databases, shared preferences
• Authentication: Token handling, biometric bypass, jailbreak detection

We test both native (iOS/Android) and hybrid apps (React Native, Flutter).

Note: Mobile testing requires a separate engagement. Contact us for pricing.

Black Box Testing:

• No credentials or internal knowledge provided
• Simulates external attacker with zero information
• Tests from outside perspective only
• Limited in discovering logic flaws

Grey Box Testing (RECOMMENDED):

• Limited authenticated access (test user accounts)
• Best balance of real-world attack and coverage
• Can test both external and internal attack vectors
• Most cost-effective approach

White Box Testing:

• Full access to source code, architecture, documentation
• Most thorough security analysis possible
• Includes code review and design analysis
• Best for compliance and high-security requirements

Yes, when done with proper authorization. We require:

• Written Authorization: Signed agreement before testing begins
• Scope Definition: Clear list of what can and cannot be tested
• Rules of Engagement: Testing boundaries and restrictions
• NDA: Confidentiality agreement protecting your data

We ensure full legal compliance and can provide documentation for your legal team to review.

Absolutely. We understand the sensitive nature of security testing and happily sign:

• Non-Disclosure Agreements (NDAs)
• Mutual NDAs
• Your company's standard confidentiality agreements

All findings remain strictly confidential. We never disclose vulnerabilities publicly or share information between clients.

Yes! Our reports are designed to support compliance requirements:

• GDPR: Data protection and privacy controls validation
• PCI-DSS: Requirement 11.3 (external and internal penetration testing)
• ISO 27001: Control A.12.6.1 (technical vulnerability management)
• SOC 2: Security and availability trust criteria
• HIPAA: Security Rule technical safeguards

We can customize reports to map findings to specific compliance frameworks upon request.

For critical findings that pose immediate risk:

• Immediate Notification: We contact you ASAP (email + phone if provided)
• Preliminary Report: Quick summary of the issue and temporary mitigation steps
• Testing Pause: We may pause further testing to give you time to patch
• Guidance: We provide emergency remediation advice
• Verification: After fix, we verify the vulnerability is resolved

We never exploit critical vulnerabilities beyond proof-of-concept and treat your security as our priority.

Yes! We don't just find problems, we help fix them:

• Detailed Fix Guidance: Every vulnerability includes step-by-step remediation
• Code Examples: Sample secure code when applicable
• Post-Report Q&A: 30 days of email support for clarification questions
• Remediation Consultation: Available as add-on service (hourly rate)
• Developer Training: Optional security awareness training for your team

Our goal is to help you achieve long-term security, not just identify issues.

Absolutely! Beyond one-time testing, we offer:

• Continuous Security Testing: Quarterly or monthly testing for ongoing protection
• Secure SDLC Integration: Security review at each development phase
• Security Champions Program: Train internal team members as security advocates
• Threat Modeling: Proactive identification of potential attack vectors
• Security Roadmap: Strategic plan to improve security over time

Contact us for Enterprise packages with continuous engagement options.

Yes! We understand security incidents require immediate attention:

• Rush Testing: Start within 24-48 hours
• Incident Response: Emergency vulnerability verification
• Pre-Launch Audits: Last-minute security checks before go-live
• Post-Breach Analysis: Understand what happened and prevent recurrence

Note: Rush services incur 50% premium fee due to resource prioritization.

Contact us directly for urgent requests: [email protected]

We're here to help! Contact us through:

• Email: [email protected] (response within 24h)
• Contact Form: Request a quote with your questions

No question is too technical or too simple. We're happy to discuss your specific security concerns.