Cybersecurity · PWNED
Website pentest: penetration testing
Penetration testing shows whether a specific scenario works: someone else's order, an admin login, an exposed service, an action without permission. We work under contract and written permission. The report contains confirmed findings, then a retest.
What penetration testing is
It is an agreed check: can a person from outside or with an account do something they should not. We follow the OWASP Testing Guide and PTES. A scanner is only a hint. We confirm each finding by hand and describe it so it can be closed.
Site, API and roles
Authorization, business logic, access to other users' data, input handling and common OWASP Top 10 risks. For a store or an account area this is the core of a website pentest.
External perimeter
What is visible from the internet on the list in the contract: the site, mail, exposed panels and services. We do not go past that list.
Internal scope
A check from a staff account or the office network. Usually remote; on-site work is discussed separately when a panel is not visible from outside. Addresses, accounts and the work window are fixed before we start.
White, gray and black box
White box: source, a diagram and access. Gray box: some accounts or an architecture note. Black box: only the addresses in the contract, no accounts. You choose the level of access, and it is written into the brief.
How we agree
Before we start we lock the boundaries, a contact if something fails, and what is off limits. Load and destructive checks stay out unless you give separate consent and a window.
Report and retest
A summary for the owner and cards for the developer: severity, condition, impact and how to close it. After the fixes we retest the closed items.
Time and quote
Usually 1-3 weeks. The quote depends on apps, roles and whether the internal scope is included. The figure comes after a short description of the boundaries.
What stays out of scope
Mailings to staff and entry to a guarded site. We do not issue a compliance certificate after a pentest. If you need a look at the current state without trying a scenario, that is an audit, not a pentest.
FAQ
Is a pentest legal?
Yes, with a contract and the owner's written permission. We do not test without that consent.
What is a pentest quote made of?
From the number of apps and roles, whether the internal scope is included, and what access you give. We name the figure after the boundaries are described. Usually 1-3 weeks.
Will you take the site down?
No. We do not run load or destructive checks without separate consent and a window you set.
Pentest vs website security audit?
An audit describes state. A pentest checks whether a specific scenario works and confirms the finding.
What is penetration testing?
The same as a pentest: a check under written permission of whether an account or an outsider can do something they should not. The report and the retest are part of the work.
Which box should we choose?
A store with an account area usually needs gray box: customer and manager accounts plus the addresses. Black box fits when you only want what is visible from outside. White box is for when source exists and the logic needs a deeper look.
Notes on this service
Related services
Let's discuss your task
Send a request or message us on Telegram - we reply within an hour on business days with a clear next step.