Pentest and audit
Types of pentest: web, API, mobile apps, infrastructure, cloud, people
Each type checks its own layer. Together they give the picture, separately only a fragment.
5 min read
A company rarely has one system. There is a website, an API behind it, a mobile app in front of it, everything runs in the cloud, and people hand out access. So pentesting is split by layer, and each has its own methodology.
Web applications
OWASP WSTG methodology. We check authentication, sessions, access rights between users, injections, file handling, business logic (for example, whether an order with a negative amount goes through).
API
OWASP API Security Top 10. The most common problem: access to other people's objects by identifier (BOLA), excessive data in responses, missing rate limits.
Mobile applications
OWASP MASVS and MASTG. We look at what the app stores on the device, how it talks to the server, whether it can be modified and client-side checks bypassed.
Infrastructure and network
PTES and NIST SP 800-115. External perimeter, internal network, Active Directory, segmentation, outdated services, weak passwords. This is where a path from one compromised machine to the whole domain is found most often.
Cloud
AWS, Azure, Google Cloud. Configuration mistakes: open buckets, excessive IAM roles, secrets in code, public metadata.
Social engineering
Phishing, calls, physical access. It tests people's habits, not technology. Done only under a separate agreement with clear boundaries.
Articles
What a pentest is and how it differs from a vulnerability scanner
A scanner finds known holes from a list. A pentester thinks like an attacker and chains small things into a real breach.
4 min readHow to prepare for a pentest so you do not overpay
Five things done before the start that save days of work.
3 min read