Security testing
Web application and API penetration testing
I test your web application or API the way an attacker would: looking for ways to bypass authentication, access data that belongs to other users, inject code or abuse the business logic. Automated scanners are a starting point; the findings that matter usually need a person. I follow the OWASP Web Security Testing Guide (WSTG v4.2), cover the OWASP API Security Top 10 (2023) and verify against the OWASP ASVS 5.0.
Quoted individually, based on the scope.
What's included
- Authentication, sessions and password recovery.
- Access control between users, roles and tenants.
- Injection, file upload and server-side request forgery (SSRF).
- Business logic: flows that can be abused even when each step looks correct.
- API endpoints, tokens and the data they expose.
What you get
- A written report with each finding, its CVSS v4.0 severity, how to reproduce it and how to fix it.
- An executive summary for non-technical stakeholders.
- A call to walk your team through the results.
- A re-test of the fixed findings at no extra cost, within 90 days of the report.
Who it's for
- Products about to launch or after a major change.
- Companies that handle personal or financial data.
- Teams that need an independent test to show a client or partner.
Not included
- Testing systems without written authorization from their owner.
- Denial-of-service attacks or anything that could take production down.
- Social engineering of your staff, unless agreed in writing.
Process
How I work
-
Scope and authorization
We define what to test, how and when. Nothing starts without your written authorization.
-
Testing
Manual testing and review, supported by tools. If I find something critical, I tell you right away.
-
Report
You get every finding rated with CVSS v4.0, with the steps to reproduce it and the recommended fix.
-
Follow-up
I walk your team through the results and re-test the fixes at no extra cost, if you request it within 90 days of the report.
Frequently asked questions
Do you test in production?
Preferably in a staging environment that mirrors production. If it has to be production, we agree on limits and timing in writing first.
Do I need to give you the source code?
No. I can test black-box, with no prior information, or with user accounts and documentation. Source code access makes the test more thorough; we decide that when we define the scope.
Other services
- Cloud penetration testing (AWS) Testing and configuration review of AWS environments: permissions, exposure and secrets.
- Vulnerability assessment A broad review of your exposure, with risks ranked so you know what to fix first.
- Mobile penetration testing Security testing of Android and iOS apps and the APIs behind them.
- Secure code review A review of your code to find vulnerabilities before they reach production.
Have a system to test or review? Send me the scope
Tell me what you need tested (applications, APIs or environments), by when, and any constraints, and I'll reply with the next steps. I work in English and Spanish.
hello@santiagopassafiume.comLooking for development? Websites, applications and backend projects go through RyuLabs.