Security
We test your site before someone uninvited does.
Web application penetration testing, red team exercises on a scenario agreed in advance, and security assessment of servers and configuration. We work only with written authorisation, on a scope set in writing.
What we test
On sites we built or someone else did, hosted with us or anywhere else.
- Web application penetration testing
- Authentication and sessions, what one account can reach of another, how input is handled, file uploads, and the API behind the page. Tested by hand with the usual toolchain, not a scanner report handed over as it came.
- Red teaming on an agreed scenario
- We work towards a goal you set, inside the scope you set. At the end you also learn what your own logs and alerts caught, and what they missed.
- Security assessment of the server
- Versions and patch level, PHP and web server settings, TLS and security headers, what listens on the network, who can read the logs, and how far a single compromised account would get.
- Report, fixes, retest
- Every finding with the steps that led to it, what it allows, how serious it is and what to change. We can apply the fixes with you, and we test the same things again afterwards.
How it runs
The paperwork first
We agree in writing what may be tested, from which addresses, in what window, and what stays out. If the system is not yours, we need authorisation from whoever owns it. Without that we do not start.
Testing, on the record
We keep a record of what we ran and when, from known addresses. Anything odd in your own logs during that window can be matched against ours, and one phone call stops the work.
The report and the retest
You get the findings ranked by what they actually allow, with the steps to reproduce them, plus a short summary for people who do not read code. After you fix them, we test the same things again.
Questions
Do you work on systems you do not host?
Yes. Most of what we look at is somewhere else. We need written authorisation from whoever owns the system, and from the hosting provider where their terms ask for it.
What will you not do?
We do not work without written authorisation. We do not run denial of service. We stay inside the agreed scope, and we do not try to trick your staff unless that is part of the agreement.
What do I get at the end?
A report with each finding, how to reproduce it, how serious it is and what to change, a short summary for management, and a retest after the fixes.
How long does it take, and what does it cost?
It follows the size of the scope. Tell us what you want looked at and we come back with the window and the price before anything starts.
Can I start with something free?
Yes. Run your site through audit.crocky.host. It is automated, so it finds the obvious things, not the ones that need a person.
Tell us what you sell
We reply with the option that fits, the price and a deadline, before any payment. We write in Romanian or English.
Rather talk? Call +40 750 265 179 or message us on WhatsApp.
Prefer email? Write to sales@crocky.host
Request received.
We will reply by email, to the address you gave us.