Service
We find it before the attacker does.
Web, mobile apps, APIs and external infrastructure. Black-box or gray-box, following OWASP and PTES; every finding is confirmed by exploitation.
- Web
- Mobile
- API
- Infrastructure
Why it matters
The problem
A scanner finds what is already known. A business-logic flaw, a privilege-escalation chain, a misconfigured integration are found by people. A pentest is exactly that human work: the system is tested the way an attacker thinks.
Our answer
The result is not a theoretical list: every finding is actually exploited, its impact is shown, and after the fix it is retested.
What is included
06 modulesPenetration testing
- Web
- Mobile
- API
- Infrastructure
- 01
Web applications
OWASP Top 10 and beyond: authentication, sessions, permissions, business logic, file upload.
- 02
Mobile applications
iOS and Android: local storage, transport security, API communication, resistance to reverse engineering.
- 03
APIs
REST and GraphQL: authorisation gaps, excessive data exposure, rate limits, object-level permissions.
- 04
External infrastructure
Exposed services, versions, configuration errors, forgotten subdomains.
- 05
Black-box and gray-box
With no knowledge or with an account: scope and depth are agreed with you.
- 06
Retest
After the fix, closed findings are confirmed and the ones still open are recorded.
How it goes
04 steps
- 01
Scope
What is tested, which methods are allowed and the time window are confirmed in writing.
- 02
Recon and scanning
The external surface is mapped and compared with the database of known vulnerabilities.
- 03
Manual testing
The part automation cannot see: logic, permissions, chains. A finding is confirmed by exploitation.
- 04
Report and retest
A report ranked by priority, advice on fixing, then a retest.
What you get
- 01
Technical report
Every finding: reproduction steps, evidence, impact, how to close it.
- 02
Management summary
Overall risk, the three most important issues, where to start.
- 03
Retest document
The final status of closed and still-open findings.
Questions
All servicesHow long does it take?
It depends on scope: one web application usually takes one to two weeks, a broad infrastructure longer. The timeline is stated at the scoping stage.
Is there a risk to the live system?
Dangerous actions (DoS, data modification) are excluded in advance or performed in a test environment. The time window is agreed with you.
Do you issue a formal statement?
Yes, a statement that the test was performed and its final status, for a regulator or partner.
How often should it be done?
After every major release and at least once a year. In between, BugOne provides continuous coverage.
Let’s start
Start with a free external check
Give us your domain and we return a first report on your external attack surface and leaked accounts. Nothing is installed, nothing is blocked; the scope is agreed based on the result.
- Subdomains, open ports and expired certificates
- Corporate accounts found in breaches
- The three most important issues and where to start