// What it covers
The scope of the work.
01Authentication & sessions
02Access control & IDOR
03Injection (SQL, NoSQL, command)
04Business-logic flaws
05SSRF & request forgery
06File upload & path traversal
07XSS, CSRF & client-side
08API security
// What we need from you
The basics below — everything else is worked out together in the free scoping call.
▸Target URLs / API endpoints in scope
▸Environment to test — production or staging
▸Whether testing is authenticated
▸A point of contact during testing
// What you receive
Findings with proof-of-concept, business impact and concrete fixes your developers can apply.
Plus an executive summary for leadership and a retest of every fixed finding.
// How it runs
STEP 01ScopeFree call to agree targets, approach and timeline.
STEP 02TestManual-first testing. Critical issues flagged straight away.
STEP 03ReportPrioritised findings with clear, practical fixes.
STEP 04RetestYou fix, we verify and close each finding.
// More red team services