Perne
Penetration test (only with the owner's written permission): illustration 1
IT outsourcing and security

Penetration test (only with the owner's written permission)

We work as a team: we run a penetration test of your website or service, simulating an attacker to see what can be exploited in practice. We use Burp Suite, OWASP ZAP and Nmap, and we re-check the results by hand without unnecessary noise. We work only with the written permission of the system owner, within agreed boundaries; we do not test other people's systems. You get a report that describes each vulnerability, the steps to reproduce it and advice on how to fix it.

from 60,000 ₸ (≈ $120) one-off

timeline: 5–14 working days

  • A written agreement on the testing boundaries and the owner's permission before work starts
  • Reconnaissance of exposed services, the attack surface and available APIs
  • Testing login, sessions, access rights and application logic flaws

Order

Message on WhatsApp
TelegramCall

The service name is added to the message for you.

This is a starting price; we give the final amount before work starts. USD is approximate.

What is included

  • A written agreement on the testing boundaries and the owner's permission before work starts
  • Reconnaissance of exposed services, the attack surface and available APIs
  • Testing login, sessions, access rights and application logic flaws
  • Manual testing with Burp Suite and OWASP ZAP, without blind scanning
  • Attempts to exploit findings within safe, agreed limits
  • A report with reproduction steps, risk rating and fix recommendations
  • A re-test of closed vulnerabilities, if the contract includes it

Who it is for

For companies and service owners who want to check how well their system holds up before a launch or after major changes, and who are ready to give written permission for testing. It does not fit if you need testing without the owner knowing, on someone else's website, or on a system you do not control.

Not included

To avoid surprises, here is what the base price does not cover and what is discussed separately:

  • Testing systems or websites without written permission from their owner
  • Actions that could damage data, take a service down or affect real customers
  • Fixing vulnerabilities in the code, unless agreed separately

FAQ

After payment the report belongs to you, and you may pass it to your team or a security contractor. We do not disclose the vulnerabilities we find to outsiders, and we delete temporary data when the work is finished.

The price includes one round of clarifications on the report: we explain items and adjust wording and priorities. A re-test after your fixes is included only if the contract says so, otherwise it is paid separately.

Usually 5 to 14 working days, most of which goes to manual testing and verifying findings. The timing depends on the size of the system and the number of user roles, and we will name an exact date once the boundaries are agreed.

Written permission from the system owner listing the addresses and systems that may be tested, the testing windows and an emergency contact. We also need test accounts for different roles, and if there are none we agree whether testing on a copy is acceptable.

No. We do not start work without written permission from the system owner, and we do not test other people's systems even at the request of third parties. If there is no permission, we offer a security audit in passive review mode instead.

Any test carries some risk, so we choose safe methods, limit the load and do not run dangerous actions without a separate agreement. It is best to test on a test copy or outside peak hours. We report any failure right away.

Most of the work runs in Burp Suite and OWASP ZAP, and network reconnaissance is done with Nmap. We run some checks by hand, because automated scanners often produce false alarms. The list of tools is stated in the report.

You may also need

Website security audit

Website security audit

We check your website for vulnerabilities and misconfigurations and give you a report with a clear list of fixes.

from 25,000 ₸ (≈ $50) one-off

Timeline: timeline: 3–7 working days

Website and server protection: WAF, backups, 2FA

Website and server protection: WAF, backups, 2FA

We set up protection for your website and server: request filtering, backups and two-factor login.

from 28,000 ₸ (≈ $55) one-off

Timeline: timeline: 3–7 working days

Shall we discuss your project?

The product name and a link to this page are filled into the WhatsApp message for you.

Message on WhatsApp
TelegramCall

Or send a request

We will reply in the channel you choose: WhatsApp, Telegram, phone or email. Your contact is used only to reply.

Service
How to reply

from 60,000 ₸ (≈ $120) one-off

Message on WhatsAppTelegramCall