Skip to content
Services/Offensive operations01 / 06

We attack you before anyone else does.

We attack your web and mobile apps, APIs and networks with real attacker techniques, under a written scope and authorization.

Request an assessment
Follow the attack path
Authorization
Written & signed
Scope
Agreed
Method
Manual-first
engagement.loglive sim
RECON
INITIAL
PRIVILEGE
LATERAL
OBJECTIVE

Illustrative attack-path simulation. Not a real client.

(01)The kill chain

We don't stop at a list of isolated issues. We follow the full path from the first exposed detail to the objective, and show you where the chain can be cut.

01RECON

Reconnaissance

We map what any outsider can see: domains, exposed services, the technologies you run, and information leaked about your organization.

$ enum --passive --scope ./scope.txt
Where to cut itShrink what's exposed for no reason
02INITIAL ACCESS

Initial access

We look for the first foothold: a flaw in a web app or API, weak authentication, or targeted phishing when it's in scope.

$ probe https://app.example.sa --auth roles.json
Where to cut itClose the first door
03PRIVILEGE ESCALATION

Privilege escalation

From a regular account to higher privileges: we test roles, misconfigurations and unpatched systems.

$ check --roles user,admin --idor --mass-assign
Where to cut itEnforce least privilege
04LATERAL MOVEMENT

Lateral movement

We test whether an attacker can hop from one compromised system to others through reused passwords or excessive trust between systems.

$ pivot --via svc_backup --to 10.0.0.0/24
Where to cut itSegment networks, separate accounts
05OBJECTIVE

Objective

We reach the objective agreed in advance and prove the impact with safe evidence, without deleting or changing any data.

$ prove --objective crown-jewels --read-only
Where to cut itProtect what matters most
(02)Tactic matrix

Red team scenarios are built on tactics and techniques publicly documented in MITRE ATT&CK. Hover or tap any cell.

TA0043Reconnaissance
TA0001Initial Access
TA0002Execution
TA0003Persistence
TA0004Privilege Escalation
TA0005Defense Evasion
TA0006Credential Access
TA0007Discovery
TA0008Lateral Movement
TA0010Exfiltration
Cell readout
TA0001 › T1190
Exploit Public-Facing Application
Initial Access

The first way into your environment.

Inspired by MITRE ATT&CK. The techniques actually used depend on the agreed scope.

(03)Which one do you need?

Both are authorized attacks, but each one answers a different question.

PENTEST
Penetration test
RED TEAM
Red team
01The question
Where are the weaknesses in this system?
Could a real attacker reach our most valuable asset, and would we notice?
02Scope
Specific apps, APIs or networks, named up front.
An organization-wide objective, within agreed limits.
03Approach
Broad, systematic coverage following OWASP and PTES.
Stealthy, objective-driven scenarios built on MITRE ATT&CK.
04Who knows
Your technical team usually knows.
Only a small control group, so real response is tested.
05What you get
Verified findings with fix steps and a retest.
The full attack story, detection gaps, and lessons for your blue team.

Not sure? We'll pick the right one with you in the scoping call.

(04)What a finding looks like

SAMPLE-001Sample

Other customers' invoices can be read and edited by changing an ID in the API

0/ 10
Severity
High
Affected asset
api.example.sa /api/v2/invoices/{id}
Category
OWASP API1:2023 · Broken Object Level Authorization
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
GET /api/v2/invoices/10482 HTTP/1.1
Host: api.example.sa
Authorization: Bearer <token_customer_A>
 
HTTP/1.1 200 OK
{ "invoice": 10482, "customer": "B", ... }

Reproduce: sign in as customer A, then change the invoice number in the request to one that belongs to customer B.

A mock card to show the report format. The data is not real.

  1. 01

    Proven findings, not guesses

    Every finding comes with a safe proof of exploitation and clear reproduction steps.

  2. 02

    Realistic attack paths

    We chain small weaknesses the way attackers do, to show the real impact.

  3. 03

    Retest included

    After you fix, we verify every item and issue a final report.

(05)Rules of engagement

rules-of-engagement.txt
  1. 01Written authorization signed by an authorized person at your organization, before any testing.
  2. 02A clear scope: what's in and what's out, by system, address and account.
  3. 03A set testing window and named technical contacts on both sides.
  4. 04Stop conditions agreed in advance, and who we call immediately if needed.
  5. 05No denial-of-service and no deleting or changing data, unless explicitly approved.
  6. 06The minimum data needed in evidence, handled confidentially.
Client signature

What we need from you

  • A list of in-scope and out-of-scope systems and addresses
  • Test accounts for each user role
  • A testing window and a technical contact

How it runs

  1. 01 / 04
    Scope and rules of engagement
  2. 02 / 04
    Reconnaissance
  3. 03 / 04
    Manual exploitation
  4. 04 / 04
    Bilingual report and retest
(06)Payload

  • [✓]OWASP & PTES01
  • [✓]MITRE ATT&CK scenarios02
  • [✓]Free retest03
FrameworksOWASPECCNIAPCI DSS

When to call us

  • >_You're launching a new web app, mobile app or API.
  • >_A client or regulator is asking for an independent penetration test report.
  • >_Your architecture has changed significantly since the last test.
$ ./request-engagement --service offensive

Start with a short assessment, and we'll come back with a proposed scope and clear rules of engagement.

Start the assessment