Secure
Web application penetration testing, with a report your developers can act on
We attack your web app the way a real attacker would, with your written permission, and give you each finding with its severity, the proof and the fix. Based in Accra, Ghana.
What we test
Every engagement follows the OWASP Top 10 and goes beyond it where the app calls for it:
- Access control. Can one user read or change another user's data? Can a normal user reach admin functions?
- Authentication. Login, password reset, session handling, rate limits
- Injection. SQL injection, command injection and cross-site scripting
- Business logic. Skipping a payment step, reusing a voucher, changing a price in the request
- Configuration. Exposed admin panels, default credentials, missing security headers, verbose errors
- APIs. The endpoints behind your web and mobile apps
What you get
A report with:
- A one-page summary for the people who sign the budget
- The exact scope and dates of the test
- Each finding with its severity, the proof, the impact in business terms and a specific fix
- The scanner alerts we checked by hand and ruled out
- The result of each retest
We explain what belongs in a report, and what to reject, in What a pentest report should contain.
Written permission first
We only test systems you own or have written permission to test. Before we start, you sign an authorisation that lists the targets, the dates and what is out of bounds. The details are in our acceptable use policy.
How it runs
- Scope. We agree the targets, the user roles, the testing window and the contacts on each side.
- Test. Reconnaissance, mapping the attack surface, then manual testing. Anything critical is reported the day we find it, not at the end.
- Report and retest. You get the report and a walkthrough. Once you have fixed the findings, we test them again.
The tools
Burp Suite, OWASP ZAP, sqlmap, Nmap and Recon-ng, with manual testing on top. Tools find the easy problems. People find the rest.
Questions
- What is the difference between a vulnerability scan and a penetration test?
- A scan is an automated tool listing possible problems. A penetration test is a person using those tools and their own judgement to find out which problems are real, chain them together and show what an attacker could reach.
- Will the test take our site down?
- We agree a testing window with you and avoid anything likely to disrupt the service, such as denial of service. Testing a live system is never risk-free, so we ask you to have current backups.
- Do you need access to our source code?
- No. We can test with no inside knowledge, or with test accounts and documentation, which finds more in the same time. We agree which during scoping.
- Do you retest after we fix things?
- Yes. A fix is not done until someone tries the attack again and it fails, so the report is updated with the result of each retest.
- How much does a penetration test cost?
- It depends on the size of the app, the number of user roles and how deep you want us to go. Send the scope and we reply with a fixed price.
Tell us what you need.
Send the brief and we reply with an approach, a scope and a fixed price. Go to the form, email hello@gravexlabs.dev or call +233 54 548 2961.