Web application VAPT
Testing of a web application the client owns or is authorized to have tested.
VAPT Services
Vulnerability Assessment and Penetration Testing for applications and infrastructure.
Testing is performed only with appropriate authorization and within an agreed scope.
Vulnerability assessment and penetration testing look for weaknesses in the systems the client has authorized. The description below is the order of the work. It is not a set of instructions for testing a system.
Engagements that can be scoped
API VAPT
Testing of interfaces that are included in the written scope.
Network VAPT
Testing of the network addresses and segments that were agreed.
Infrastructure VAPT
Testing of servers and related infrastructure in the agreed scope.
Mobile application VAPT
Testing of a mobile application the client is authorized to have tested.
Cloud security assessment
A review of cloud configuration for the accounts in scope.
Configuration review
A review of settings against the requirements the client names.
Vulnerability assessment
Identification of known weaknesses in the systems in scope.
Penetration testing
A controlled check of whether agreed weaknesses can be shown to matter, inside the rules of engagement.
Method
- 01
Scope Definition
Agree which systems, data, and times are included, and which are out of bounds.
- 02
Rules of Engagement
Agree the authorization, the contacts, and the limits on the test.
- 03
Reconnaissance
Learn what is in scope from information the client provides and from observation that stays inside that scope.
- 04
Vulnerability Assessment
Identify weaknesses that appear to apply to the systems in scope.
- 05
Controlled Exploitation
Where the rules allow it, confirm whether a weakness is real. The check stays inside the agreed scope.
- 06
Validation
Check that a reported weakness is understood correctly before it is treated as a finding.
- 07
Risk Analysis
Describe the business relevance of each finding for the client to judge.
- 08
Reporting
Write what was in scope, what was found, and what was not tested.
- 09
Remediation Guidance
Suggest the kind of fix the client can take to its own team or to a follow-on engagement.
- 10
Retesting
Check agreed fixes again, if retesting is part of the engagement.
Discuss Your Requirement
Testing starts only after the scope and the authorization are agreed.
Discuss Your Requirement