Secure
Network and infrastructure VAPT, from the internet and from inside
Vulnerability assessment and penetration testing of your servers, networks and cloud accounts. We show what an outsider can reach, what an insider can reach, and how to close it. Based in Accra, Ghana.
What we test
- External. Everything of yours that answers from the internet: websites, mail, VPN, remote access, cloud storage and forgotten test servers
- Internal. What someone already inside can reach: file shares, databases, admin panels and other machines
- Cloud. Storage open to the public, over-permissive accounts and exposed management interfaces
- Wi-Fi. Guest and staff networks, and whether one can reach the other
How we work
- Reconnaissance. We map your attack surface: domains, addresses, open ports and the services behind them. Clients are often surprised by what turns up here.
- Vulnerability assessment. We find the weaknesses and rank them.
- Exploit validation. With your permission, we use the weaknesses that matter to prove they are real and to show how far an attacker gets.
- Report and retest. Each finding comes with its severity, the proof and the fix. After you patch, we test again.
What you get
- A map of what you actually expose, including things you did not know were online
- Findings ranked by real-world impact, so you know what to fix first
- Proof for each one
- Specific remediation steps for your administrators
- A retest
Written permission first
We only test systems you own or have written permission to test. If something is hosted by a third party, such as a cloud provider, you are responsible for any permission that provider requires. The details are in our acceptable use policy.
The tools
Nmap, Nessus, Metasploit, Wireshark and Recon-ng, with manual testing on top.
Questions
- What does VAPT stand for?
- Vulnerability assessment and penetration testing. The assessment finds and ranks weaknesses across your systems. The penetration test proves which of them an attacker can use, and how far they get.
- What is the difference between an external and an internal test?
- An external test attacks what the internet can see, such as your website, mail server, VPN and cloud services. An internal test starts from inside your network, as a compromised laptop or a visitor on the office Wi-Fi would.
- Do you need to come to our office?
- Not for an external test. An internal test needs a connection into your network, either on site in Accra or through a device or VPN access you provide.
- Can the report be used for an audit or a client's security questionnaire?
- Tell us at the start who will read it and what they ask for, and we scope the test and the report to match.
- Do you retest after we fix things?
- Yes. The report is updated with the result of each retest.
Tell us what you need.
Send the brief and we reply with an approach, a scope and a fixed price. Go to the form, email hello@gravexlabs.dev or call +233 54 548 2961.