Our hackbots
- Inventory every API surface, including versions nobody documented
- Run object-level and function-level authorization checks on every route
- Probe every feature that fetches a URL on the server side
API and cloud penetration testing
Your old API version is still answering.
The APIs behind your apps and the cloud accounts they run in, tested from outside and with a normal customer’s access.
Scope and deliverables
What we look at
- Object-level and function-level authorization on every route
- Old, undocumented and deprecated API versions
- Server-side requests toward internal services and cloud metadata
- Leaked keys, proven live or discarded, and over-broad roles
What you get
Issues mapped to the exact route and role, plus an inventory of every API surface we found.
Typical length
1 to 3 weeks
Methods aligned with
OWASP API Top 10, CVSS 3.1
Why it matters
Every app is a front end on top of an API, and the API is what an attacker talks to directly. The checks your interface performs mean nothing if the route behind it skips them.
We test REST and GraphQL APIs from the outside and with a normal customer’s access, then follow server-side requests and leaked keys into the cloud accounts behind them.
What we look for first
- 01
Broken object-level authorization
Routes that return or change a record without checking that it belongs to the caller.
- 02
Forgotten API versions
Old, undocumented and deprecated versions still answering on the same host.
- 03
Server-side request forgery
Features that fetch a URL and can be pointed at internal services or cloud metadata.
- 04
Leaked keys and over-broad roles
Keys proven live or discarded, and cloud roles that grant far more than the service needs.
How we test it
Hackbots for breadth. Hackers for depth. Every lead is proven or discarded by a researcher before it reaches your report.
Our researchers
- Test GraphQL queries, mutations and object IDs by hand
- Prove each leaked key live or dead
- Map every issue to the exact route and role
How an engagement runs
Five steps from the first call to the retest. You work directly with the researchers testing your systems at every one of them.
Scope
1 to 3 daysWe agree on assets, test accounts and rules of engagement, then send a fixed price.
Recon
First days of testingHackbots map every host, route and role. A researcher builds the threat model.
Exploit
Most of the windowHackbots run the matrix at scale while researchers test by hand and take each lead to the end.
Report and fix
Within 5 working daysVerified issues only, each with a CVSS 3.1 vector, replayable proof and a patch.
Retest
Free, within 90 daysWe confirm each fix and issue an updated report and attestation letter.
Related services
Web application penetration testing
Access control, account takeover, customer isolation and business logic in the product your users sign in to.
Mobile app penetration testing
iOS and Android apps, the data they keep on the device, and the API traffic underneath them.
Network and infrastructure penetration testing
Your external perimeter and, when in scope, the internal network an attacker reaches after a first foothold.
Tell us what you run. We’ll send a fixed quote.
No obligation and no sales sequence. A senior researcher reads every request and replies within one working day.