security checks · hyderabad

we break itbeforethey do.

Audits and pen tests for the sites and apps you run.

how a check runs

five steps.

A sample check on shop.example, a demo shop. Real checks start only with your written go ahead.

scope

Step 1, scope: agree what we test, in writing.

scope sheet · shop.examplev1

targets

  • shop.example
  • api.shop.example
  • admin.shop.example

in scope

  • accounts and login
  • checkout and payments
  • admin roles
  • the public API

out of scope

  • denial of service
  • social engineering
  • third party services
test window: 3 days, from your written go aheadsigned
recon

Step 2, recon: map everything that's exposed.

recon · shop.example

Command: gobuster dns -d shop.example -w subs.txt. Output: Found: api.shop.example; Found: admin.shop.example; Found: staging.shop.example. Found: staging is public.

Command: nmap -sV admin.shop.example. Output: 22/tcp open ssh OpenSSH 9.6; 443/tcp open https nginx 1.24.0. Found: server version on show.

Command: ffuf -u https://shop.example/FUZZ -w common.txt. Output: admin [Status: 302]; api [Status: 200]; backup.zip [Status: 200, Size: 48211337]. Found: a backup anyone can download.

test

Step 3, test: try what an attacker would.

  • A01broken access controlqueued
  • A02cryptographic failuresqueued
  • A03injectionqueued
  • A04insecure designqueued
  • A05security misconfigurationqueued
  • A06vulnerable componentsqueued
  • A07authentication failuresqueued
  • A08data integrity failuresqueued
  • A09logging and monitoringqueued
  • A10server side request forgeryqueued

OWASP Top 10: 4 findings, 6 clear.

report

Step 4, report: every finding ranked, with its fix.

1 critical2 high2 medium1 low

  • impactNames, addresses and phone numbers of every customer, one number at a time.

    fixCheck on the server that the order belongs to the signed in customer.

fix

Step 5, fix: close the holes, then prove it.

retest · shop.example

  • any customer can open any orderopen
  • the site backup is publicopen
  • unlimited password guessesopen
  • staging is open to the internetopen
  • no alert on mass downloadsopen
  • server version on showopen

this page, checked live

  • reading…

Read from this page by your browser just now. We build to the same standard we test to.

get yours checked

From ₹15,000, first report in 24 hours.

what we do

  1. 01offensive security
  2. 02VAPT
  3. 03application security
  4. 04web application security
  5. 05network security
  6. 06reconnaissance
  7. 07vulnerability assessment

the kit

what we're building

VOID

An AI security copilot we're building: it finds the right security knowledge, reasons with memory, and uses security tools only within limits we set.

  1. 01knowledgestructured security knowledge and relationships
  2. 02meaningsemantic chunking, metadata, and embeddings
  3. 03retrievalvector search and relevant context
  4. 04reasoningLLM reasoning with session memory
  5. 05toolscontrolled security-tool integration

want yourschecked.

A first check from ₹15,000, with the report in 24 hours. Only ever with your written go ahead.

start a security briefread the story