Tip: Click a question to expand the answer.
What is “Web Hacking” and what’s the purpose?
We run an offensive engagement against your internet-facing web apps and APIs to find what real attackers would. The goal is to uncover attacker-viable paths to account takeover, data exposure, privilege escalation, or RCE - then help you fix them and verify the fixes.
What’s in scope vs. out of scope?
In scope: the assets you authorize - domains, subdomains, web applications, REST/GraphQL APIs, and edge services (e.g., WAF/CDN, object storage). Out of scope by default: social engineering and internal network testing (these can be explicitly added if you want). We only touch what you approve in writing.
How do you test - manual or automated?
Manual first. We lead with hands-on testing and use operator-controlled, optional AI assistance for recon and triage only - never on autopilot. Every finding is human-validated with clear proof and impact.
Is this safe to run on production?
Yes. We follow strict rules of engagement: rate limits, allowlists, maintenance windows if needed, and “kill switches.” Exploitation is proof-driven and minimally invasive - enough to demonstrate risk without causing disruption or damaging data.
What kinds of vulnerabilities do you look for?
Coverage includes authentication and session management flaws, access control issues (IDOR/BOLA), injection (SQLi, XSS, command/LDAP), SSRF, misconfigurations, and business-logic abuses. We’re comfortable with modern stacks - SPAs, REST/GraphQL, OAuth/OIDC, and cloud storage/CDNs.
How are findings reported?
You receive an executive readout and a technical report that maps each issue to the OWASP Top 10 (where applicable) with:
- Repro steps and the exact method used to find/validate
- Severity, clear impact, and prioritized remediation
- Screenshots/POCs where appropriate
Do you retest after we fix issues?
Yes. We include a free retest to verify remediation and update the report accordingly.
What do you need from us to start?
Authorized scope, testing windows, any WAF/CDN allowlisting, and at least one test account per role (plus API docs/keys for non-prod if applicable). If you have threat models or known pain points, we’ll incorporate them.
Will you fully exploit vulnerabilities?
We safely validate impact. Where exploitation could risk data integrity or availability, we use controlled proofs (e.g., targeted reads/writes, non-destructive payloads) to demonstrate the issue without collateral damage.
How is this different from a traditional pentest or a red team?
This is a focused, web-app and perimeter engagement - not a company-wide red team. Compared to checklist pentests, it’s manual-first, proof-driven, and logic-aware, with findings mapped to OWASP Top 10 and practical fixes.
