We check everything: your platforms, your office network, your internal systems and any modules you add. It is built to fit, and you get the quote before we start.
Custom scope: everything in Rabbit Hole, plus an internal network and Active Directory pentest through the LOP BOX, multiple platforms and the chosen modules. A second Lop reviews every finding.
Duration
From 3 weeks
Start
We agree on the start date when we close the scope
A free scanner checks whether the door exists. A Lop tests whether it opens: with real accounts, by hand, and chaining small flaws that look like nothing alone and cost a lot together.
Automated scanners detect known signatures. Access control, session logic and vulnerability chains only show up with authenticated manual testing. Every finding is confirmed with a proof of concept and reviewed by a second Lop.
CustomWeb systemsWeb applications (OWASP WSTG)
Nobody gets into someone else’s account: passwords, password recovery and sessions.
Authentication, account recovery, session management and MFA.
Nobody can slip code or commands in through a form, a search box or a web address.
SQL, NoSQL, command and template injection; reflected, stored and DOM XSS.
Nobody can upload dangerous files disguised as a photo or a PDF.
File upload: type, content, name, path and server-side execution.
Your site cannot be used to trick your visitors or to reach your internal systems.
CSRF, open redirects, SSRF, clickjacking and misconfigured CORS.
Forgotten files and pages: backups, test panels, old versions.
Content discovery: exposed backups, .git and .env, staging environments and unlinked endpoints.
An error on screen does not reveal internal data, keys or code.
Error handling, stack traces, secrets in client-side code and information leaks.
Plugins, themes and site software with known flaws.
Components with known CVEs: CMS, plugins, themes and JavaScript libraries.
Your customers’ data travels protected and is not left exposed in the browser.
Cookies (Secure, HttpOnly, SameSite), security headers, CSP and sensitive data on the client.
Nobody can try thousands of passwords or flood your forms with a bot.
Rate limiting, user enumeration, captcha and anti-automation controls.
CustomUser typesRoles
One user cannot see another user’s orders, invoices or data.
Horizontal access control (IDOR) in views, downloads, exports and internal calls.
A regular user cannot reach admin functions.
Vertical privilege escalation and unprotected admin functions.
What is hidden on screen is also locked behind it.
Authorization enforced on the server, not the browser; tampered parameters and hidden fields.
Servers exposed to the internetExternal surface: ports and services
Everything of yours that is open to the internet, even what nobody remembers.
Subdomain discovery (DNS and certificate logs), ports and services.
Panels, databases or remote access that should not be visible from outside.
Exposed admin services: SSH, RDP, databases, hosting and CMS panels.
Old software with flaws attackers are already using.
Versions with known CVEs, prioritized by real exploitation (KEV and EPSS).
The secure connection, the browser padlock, is set up right.
TLS: protocols, ciphers, certificates and HSTS.
Nobody can take over a subdomain you stopped using.
Subdomain takeover and DNS records pointing to retired services.
Nobody sends mail in your nameSPF, DKIM and DMARC
Nobody sends emails that look like yours to your customers or suppliers.
SPF, DKIM and DMARC: records, policy and alignment.
Your email travels encrypted between servers.
STARTTLS, MTA-STS and TLS-RPT on your mail servers.
Your domain is not on blocklists that send your emails to spam.
Domain and sending IP reputation on blocklists.
Your Microsoft 365 or Google accountsM365 or Workspace configuration (CIS)
Every account has two-factor and no old doors are left without it.
MFA, conditional access and legacy authentication disabled.
Who is an admin, and who should no longer be one.
Privileged accounts, admin roles and inactive accounts.
Your documents are not shared with anyone who has the link.
External sharing and public links in OneDrive, SharePoint or Drive.
Rules that forward your mail outside and apps allowed to read it.
External forwarding, mailbox rules and third-party apps with OAuth grants.
There is a record and an alert if someone gets in where they should not.
Audit logging, alerts and mail filtering, per CIS Benchmark.
Connections between systemsREST and GraphQL APIs (OWASP API Top 10)
Nobody uses the API to see or change another user’s data.
Object and function level authorization (BOLA, BFLA) on every endpoint.
API permits and keys cannot be stolen or reused.
API authentication, token (JWT, OAuth) and key lifetime and revocation.
The API neither returns nor accepts more data than it should.
Excessive data exposure and mass assignment.
Nobody can overload the API or abuse its limits.
Resource consumption and missing usage limits (rate limiting).
Old versions and test environments of the API still left open.
API inventory: deprecated versions and exposed test endpoints.
Business rules: payments, coupons, limitsBusiness logic
Nobody pays less, duplicates a payment or ends up with a balance they should not have.
Tampering with the payment flow, prices and amounts on the client side.
Coupons cannot be stacked and promotion limits cannot be exceeded.
Coupon abuse, stacking and limits on promotions and stock.
Steps in a process cannot be skipped, such as confirming an order without paying.
State and order skips in multi-step processes, race conditions included.
One customer cannot see another’s dataTenant isolation (multi-tenant)
One customer never sees or touches another customer’s data.
Data isolation between tenants in queries, exports and files.
Changing an identifier does not drop you into another company’s account.
Tenant identifier tampering in tokens, routes and parameters.
A shared resource does not leak information between customers.
Leaks through caches, queues and storage shared between tenants.
Your cloudCloud configuration (AWS, GCP, Azure)
No file stores or databases are left open to the internet.
Exposed buckets, databases and services; encryption at rest and in transit (CIS).
Who can do what in your cloud, and who has more permissions than they need.
IAM permissions, over-privileged roles and long-lived keys.
There is a record of what happens and the networks are kept apart.
Logging and trails, security groups and network segmentation in the cloud.
The libraries your software usesDependency review (SCA)
Libraries in your software with known flaws.
Dependencies with known CVEs, prioritized by real exploitation (KEV and EPSS).
Unmaintained or too-old components.
Unsupported dependencies, pinned versions and risky licenses.
Your office network and internal systemsInternal network and Active Directory
If someone gets into the office, they cannot jump from one machine to all of them.
Lateral movement, internal network segmentation and exposed internal services.
A regular account does not end up as administrator of everything.
Active Directory: Kerberos, delegations, ACLs and paths to domain admin.
Reused passwords or passwords stored where they should not be on the internal network.
Reused passwords, passwords in memory or on shares; weak policies.
Everything in Dig and Rabbit Hole: your site, your email, your apps, your API and your cloud.Full Rabbit Hole base: web, API, external surface, email, Microsoft 365 or Workspace and cloud.
Your office network and Active Directory, through the LOP BOX.Internal network and Active Directory pentest through the LOP BOX, segmentation included.
Several platforms, defined in the custom scope.Several platforms or business units, agreed in the scoping workshop.
The modules you add: mobile apps, phishing, firewall, smart contracts or Wi-Fi.Chosen modules: OWASP MASVS (mobile), phishing simulation, firewall (CIS), smart contracts and on-site Wi-Fi.
Does not include
Tests that could take your service down. We never run them.Denial of service and any destructive test. Out of scope.
The physical infrastructure of the cloud provider or data center.Third-party data centers and hardware. Only your assets and your configuration.
Tricking your staff, unless you agree on the phishing simulation module.Social engineering outside the agreed phishing module.
Warren is built to fit. We give you the fixed quote before signing and never charge more halfway through.
Questions before you buy
How long does it take and how much does it cost?
From 3 weeks, depending on the scope. The price is fixed in the scoping workshop, before signing, and does not change halfway through.
What is the LOP BOX?
A virtual machine or a mini PC you install so we can reach your internal network. It connects to us over an encrypted outbound channel, with no inbound ports opened, and you switch it off when we finish.
Will it disrupt my business?
No. We work within a date window and a scope you sign beforehand, and we run no tests that take services down or delete data.
Want your whole company checked?
A custom scope, from 3 weeks, with the internal network included. We fix the price before signing.
