Package 2Recommended
Pentesting of logins, webshops and APIs
Extended is a pentest for small businesses with logins, customer data or an app. I test whether anyone can see or change things they should not have access to.
When a site has a login, looking at it from the outside is not enough. The most serious flaws often hide behind the login: a customer who can see someone else’s orders, an API that hands out data without asking, or a password reset that can be abused.
Extended includes everything in Basic and also tests the application itself with a test user. I also look at what is publicly available about you online, and at known vulnerabilities in the software you use. Afterwards, we go through the report together in a meeting.
A good fit if
- You have a webshop or a site with customer accounts
- You have an app or an API that other systems use
- You handle personal data and want to show that you have tested your security
Questions about the package
Why is Extended the recommended package?
Because most businesses today have a login, customer data or an integration somewhere. That is where serious flaws usually are, and Basic does not test it.
What do we need to provide?
Written permission, a contact person and a test user, ideally on a test environment if you have one. If you do not, we agree on how to test carefully on the live site.
What happens in the meeting?
We go through the report finding by finding. You can ask anything, and we agree on what to fix first.
Tell me about your website
Write briefly what you have and what worries you. I will get back to you with a proposal and a quote.
Reply within 1-2 working days.