Penetration Test

Description

Penetration testing is a process designed to assess the security of a system by trying to bypass the existing defenses. They are usually performed as "black box" tests, meaning that the client only provides a minimal amount of information about the target. By having the same access as an attacker and using the same toolset, we are able to identify the weaknesses and vulnerabilities that could be used to compromise the system.
Once assessments are finished, we deliver a complete report detailing the techniques used, the vulnerabilities discovered, and that also suggests remediation steps to fix them.

Examples of Targets

Web Applications & APIs
Mobile Applications (Android, iOS, etc.)
Internet of Things (IoT)
Infrastructure (Cloud, VPN, etc.)

Security Audit

Description

Security audits provide a thorough security assessment of a system by performing an in-depth analysis of its inner-workings. They differ from penetration tests by their "white box" approach that requires any information that could help identifying vulnerabilities (e.g. source code, configuration files, etc.). This approach enables an easier and more efficient use of both static and dynamic analysis.
After completing the audit, you will receive a report highlighting the flaws identified as well as some recommendations on how to correct them.

Types of Audits

Code Audit: we manually and carefully review the source code provided (mobile application, driver, operating system, etc.).
Configuration Audit: we inspect the configuration and architecture of a system as well as its components (firewall, VPN, SELinux, etc.).

Research & Development

Research and development projects are the mainspring of our company. They usually have a longer time span and require very specific technical expertise.
The following domains are the ones we are the most proficient in:

Reverse Engineering: analyzing and understanding a binary of a given architecture (x86, x64, ARM, etc.) without having access to the source code or the documentation.
Vulnerability Research: identifying vulnerabilities in a complex code base or a component requiring reverse engineering.
Exploitation: developing an exploit for a given vulnerability, and improving its speed and stability.
Tools Development: writing highly-specialized tools to facilitate reverse engineering or vulnerability research (harnesses, fuzzers, emulators, IDA/Ghidra/Binary Ninja, etc.).

Trainings

We have given several trainings in the past on different topics related to offensive security, sometimes during international conferences such as TROOPERS, hardwear.io and Zer0Con. In the same spirit, we provide tailored trainings to our customers and strive to share our knowledge the best we can.