Ciberseguridad ofensiva · Cybersecurity
Web application and API penetration testing
We attack your application the way a real adversary would, with written authorization and scope, and hand you every finding with a reproducible proof of concept.
- Model
- Black, grey or white box
- Duration
- 2 to 4 weeks depending on scope
- Methodology
- OWASP WSTG · PTES · NIST SP 800-115
- Severity
- CVSS 3.1 and 4.0 + CWE/CAPEC
The problem
A badly exposed automation is an open door. Before connecting your critical processes to chatbots, APIs and integrations, we verify that nobody else can get in through there. The exercise covers the application, its APIs, the business logic and the authentication flows.
What it includes
- Reconocimiento y mapeo de superficie de ataque: subdominios, endpoints, bundles JS, specs OpenAPI y repositorios expuestos.
- Explotación de los Top 10 de OWASP: inyecciones (SQL, NoSQL, SSTI), XSS, SSRF, deserialización y carga de archivos.
- Fallas de autorización y lógica de negocio: BOLA/IDOR, escalamiento horizontal y vertical, manipulación de precios y flujos.
- Auditoría de sesión y tokens: JWT, OAuth 2.0, cookies, expiración y revocación.
- Revisión de la capa de IA: inyección de prompts, fuga de instrucciones del sistema y abuso de herramientas del agente.
- Encadenamiento de vulnerabilidades para demostrar el impacto real, no el teórico.
How we work
- 01Alcance y autorizaciónDefinimos objetivos, ventanas de ejecución, contactos de emergencia y reglas de enfrentamiento. Nada se ejecuta sin autorización firmada.
- 02ReconocimientoInventario de activos, tecnologías, versiones y superficie expuesta. Correlación con CVEs conocidos.
- 03Explotación controladaPruebas manuales asistidas por herramientas, sin técnicas destructivas ni denegación de servicio.
- 04Encadenamiento e impactoConstruimos la cadena de ataque completa y medimos hasta dónde llega un atacante.
- 05Informe y presentaciónEntrega del informe y sesión de revisión técnica con tu equipo de desarrollo.
- 06ReverificaciónVolvemos a probar los hallazgos corregidos y emitimos el acta de cierre.
Deliverables
| Document | Length |
|---|---|
| Informe ejecutivo Riesgo del negocio en lenguaje no técnico, para el directorio. | 8-12 págs |
| Informe técnico Hallazgo, impacto, CVSS, CWE y remediación priorizada. | 40-90 págs |
| PoC por hallazgo Paso a paso reproducible con comandos y capturas. | included |
| Registro de evidencias Bitácora completa con fecha y hora de cada prueba. | included |
| Acta de reverificación Estado final de cada hallazgo tras las correcciones. | included |
Note
No surprises on the invoice or in your operation. We work only on assets with the client's written authorization, in agreed windows and without destructive techniques. All evidence is encrypted and destroyed 90 days after closing.
Other services in this area
Cybersecurity posture assessmentDetailed analysis of the real state of your security: vulnerabilities, threats and compliance level, with a clear view of the risks and how to mitigate them.Ethical HackingOffensive security analysis on the target you define, run under the OWASP Testing Guide and classified with OWASP Top 10, CWE and CVSS 3.1.Mobile application audit (APK)We decompile, instrument and attack your Android application to find what a store review would never see.Red Team and Purple TeamFull adversarial assessment and collaborative work with your defensive team, mapped to MITRE ATT&CK, to strengthen the defences where they actually give way.APT-style exercisesSimulation of advanced persistent threats to measure how your organisation holds up against the most sophisticated scenarios, in white box or black box.Simulated phishing and awarenessWe measure how your people respond, not your software: controlled social engineering campaigns that end in training built on the real cases from the exercise.Digital forensic analysisFast, precise answers once something has happened: what got in, through where, when and what it took, with evidence valid for legal proceedings.Incident response and digital forensicsWhen something has already happened, we contain it, investigate what occurred and leave you with what you need so it does not happen again.Building your CSIRTWe design, implement and train your organisation's computer security incident response team, so the capability stays in house.Security Operation CenterCreation and rollout of a centralised unit that monitors, detects, responds to and mitigates threats in real time, on your premises and with your trained staff.Digital security monitoringConstant supervision of all your digital assets, with proactive defence against environmental threats and reports that can actually be read.Server hardeningComprehensive hardening of your servers: optimised configuration, patch management and periodic audits to close the door before anyone tries it.Cloud hardening: GCP, AWS and AzureWe review your entire account against the CIS benchmark, fix whatever you authorize and show you the before and after with a posture score.Cloud services: migration and architectureMigration, architecture design, implementation, resource optimisation and account management on AWS, Google Cloud and Azure, with security built in from day one.Connectivity and networksWe connect your organisation to the world securely: structured cabling, network security and orderly workstations.Information security planA plan of your own, aligned with your business objectives: assessed risks, policies written to measure and a security culture that reaches every employee.Cybersecurity roadmapA strategic plan for the short, medium and long term that sets priorities, defines concrete actions and allocates resources, aligned with business objectives.vCISO: your security chief, without the payrollAn information security officer with committed hours each month, answering for your company's governance, risk and compliance before the board and before your clients.ISO/IEC 27001:2022 implementationWe take your organisation from where it stands today to an Information Security Management System ready to be audited and certified.ISO/IEC 27001:2022 internal auditWe audit your Information Security Management System with the same rigour the certification body will apply, so nothing surprises you on the real audit day.Law 21.719 and Law 21.595 complianceWe get your company ready for the Chilean personal data law before the regulator arrives, with documentation checked against the official text.Security toolingLicensing and rollout of the most widely used offensive and defensive tools on the market, with the technical support to make them actually pay off.Technology equipmentComputers, servers and specialised tooling for physical hacking, with architecture advice included.