Penetration testing
A penetration test answers one question: what could an attacker do to you today? We find out with the tools and techniques attackers use, within limits you approve in writing.
Who it is for
Organisations that need to know their real exposure: before a launch, after a major change, for an audit or a customer requirement, or as a yearly check.
What we do
- External network test
- Everything reachable from the internet: websites, mail servers, VPN gateways, remote access and cloud services.
- Internal network test
- We start inside your network, as a compromised laptop or a malicious insider would, and see how close we can get to your critical systems.
- Web application test
- Login, sessions, access control and input handling in your web applications and APIs, following the OWASP Web Security Testing Guide.
- Mobile application test
- iOS and Android apps and the APIs behind them, following the OWASP Mobile Application Security guidelines.
- Social engineering
- Phishing campaigns, pretext calls and physical access attempts show how your people and processes respond to manipulation.
- Remote working test
- The security of home-office setups: VPN, laptop configuration, collaboration tools and identity providers.
- Continuous security testing
- Instead of one test a year, we test your external attack surface on a schedule and report new issues as they appear.
How a test runs
Scope
We agree on targets, rules and timing in writing. Nothing is tested without your approval.
Reconnaissance
We map what an attacker can see: domains, exposed services, technologies and people.
Exploitation
We try to get in with the techniques real attackers use, and stop at the limits we agreed.
Reporting
Every finding comes with its risk, the evidence and a concrete fix, plus a summary for management.
Retest
After you have fixed the issues, we test again and confirm that they are closed.
What you receive
- A management summary in plain language
- A technical report: every finding with its risk, evidence and a concrete fix
- A walkthrough meeting with your team
- A retest report confirming which issues are closed
Questions
Will the test disrupt our systems?
We agree on test windows and limits in advance and avoid techniques that could cause outages unless you approve them. You can stop a test at any time.
How long does a test take?
It depends on the scope. A single web application usually takes days; a full internal network takes longer. The proposal contains a fixed timeline.
Black box, grey box or white box?
We do all three. Grey box, where we receive a normal user account and basic documentation, usually finds the most in the time available.
Free security tools
-
Security headers scanner
Grade a website’s HTTP security headers, cookies and TLS certificate, with a fix for every finding.
Our server fetches the page -
JWT decoder
Decode a JSON Web Token and check it for common security mistakes, without it leaving your browser.
Runs in your browser -
CVSS 3.1 calculator
Score a vulnerability with the CVSS 3.1 base metrics and get a shareable vector.
Runs in your browser
Tell us what you need to protect
Describe your environment and what you want to achieve. We will reply by email.
Contact usAngelForce OÜ · Tallinn, Estonia