Offensive Security
Authorised penetration testing and adversary simulation
Manual, standards-based penetration tests that show how a real attacker would get in, always under written authorisation and an agreed scope.
Services
Web Application Penetration Test
Authenticated, manual testing of web applications against the OWASP Web Security Testing Guide and ASVS, including business-logic and access-control flaws.
- OWASP WSTG
- OWASP ASVS
- OWASP Top 10
API Penetration Test
Testing of REST and GraphQL APIs against the OWASP API Security Top 10: broken object-level authorisation, authentication, rate limiting and token handling.
- OWASP API Security Top 10
- REST
- GraphQL
Mobile Application Penetration Test
Static and dynamic testing of iOS and Android apps against OWASP MASVS and MASTG: data storage, transport security, reverse engineering and backend APIs.
- OWASP MASVS
- OWASP MASTG
- Frida
Network Penetration Test
External and internal infrastructure testing following PTES: exposed services, Active Directory attack paths, lateral movement and network segmentation.
- PTES
- Nmap
- BloodHound
Cloud Penetration Test
Adversarial testing of AWS, Azure and GCP environments: IAM privilege escalation, exposed storage and services, and cross-account trust abuse.
- AWS
- Microsoft Azure
- Google Cloud
Red Team & Social Engineering
Objective-based adversary simulation mapped to MITRE ATT&CK, including phishing campaigns and assumed-breach scenarios, to test detection and response.
- MITRE ATT&CK
- Phishing simulation
- Assumed breach
Remediation Retest
Verification testing of fixed findings from a previous penetration test, with an updated report and an attestation letter for customers and auditors.
- CVSS v3.1
- OWASP
Have a project to scope?
Tell us your objectives and constraints. We reply within one business day.