CREST
Accredited company & testers
What we test
Four cloud surfaces. One engagement.
Each provider gets a manual, threat-modelled review against its real attack surface, control plane, identity, network, and workload. Intensity tunes per scope.
Amazon AWS
IMDSv1 SSRF, IAM role chaining, public S3 enumeration, Lambda over-privilege, EKS cluster-role abuse, KMS key-policy misuse, Cognito user-pool misconfig, Secrets Manager exposure.
Microsoft Azure
Managed identity over-scope, Storage Account SAS leak, Function App env exposure, AKS pod-identity abuse, Key Vault access policy bypass, Azure AD application consent, Logic App secret reuse.
Google Cloud Platform
Workload-identity confusion, service-account impersonation, Cloud Run scope abuse, GKE node pool escape, Secret Manager IAM gaps, Cloud Storage bucket policy bypass, Cloud Functions trigger replay.
Kubernetes
Pod escape via privileged container, RBAC bypass, etcd exposure, kubelet API abuse, sidecar/init container attack paths, NetworkPolicy gaps, admission-controller bypass, ServiceAccount token theft.
ExpertSpotlight
Meet the lead
A pentester who has shipped
edtech findings to regulators.
John Dill
vCISO at SecureLayer7
Leads engagements across LMS, SSO, LTI, and roster APIs. Published CVEs in identity-federation and session-handling components used across edtech SaaS. The pentester your CISO will meet on day one of scoping.
ExpertSpotlight-industries-edtech
/book/john-dill
Book a 30-min call
/media/john-dill-05799aa1.webp
John Dill, vCISO at SecureLayer7
Faq
Common procurement questions
What buyers ask
about edtech penetration testing.
Six questions district IT, CISOs, and product-security teams send before signing an edtech pentest SOW. Answered against our methodology and your auditor.
Do you handle FERPA and COPPA?
Yes. FERPA consent-boundary testing, COPPA age-gate verification, sibling-record IDOR, parent-proxy session boundary. Reports map to the law your audit serves.
Do you cover LTI 1.3, OneRoster, and OIDC?
Yes. LTI 1.3 launch parameter tampering, OneRoster API drift, OIDC scope confusion across LMS plus tool integrations, SAML signature wrap on legacy SSO.
Will testing affect live student data?
No. Engagements use staging or sanitized snapshots; live-prod is only used for read-mode probing. A PII handling agreement is signed before scope kickoff.
Is the report regulator-ready?
Yes. CREST severity, PII-handling notes per finding, regulator-ready PDF for FERPA, COPPA, SOC 2 Type II, ISO 27001, and state-privacy laws including SOPIPA and NY Ed Law 2-d.
Do you test proctoring and remote-assessment tools?
Yes. Webcam-stream exfil paths, browser-lockdown bypass, AI-detection evasion, and ID-doc liveness bypass on remote-assessment flows.
Do you include a re-test?
Free re-test after fixes ship. Written closure per finding, same scope, the proof-of-exploit reverts on patch.
Faq-industries-edtech
CtaBanner
CtaBanner-tear-sheet-edtech
Partner tear-sheet
Hand a 2-page EdTech tear-sheet to the buyer.
A printable summary your partner can drop into a pitch deck: named EdTech threats, methodology, compliance mapping, and the engagement leads to call. Saves as PDF from the browser.
Open the tear-sheet
/industries/edtech/tear-sheet
Download PDF
/industries/edtech/tear-sheet?print=1
light
left
TEAR-SHEET.
CtaBanner
Sample engagement report
See what arrives in your inbox.
A pre-vetted sample report: full roster-to-records kill chain, working PoC traces, FERPA consent diffs, and re-test scope. Sent on request after a 5-minute scoping call.
Talk to an edtech pentest expert
/contact-us
/media/services-real-report-v2-fb4632af.svg
Sample edtech pentest report, kill-chain · evidence · remediation
light
left
security-posture-review
REPORT.
CtaBanner-industries-edtech
Request an edtech sample finding
sample-download
## Q&A
Q: Do you handle FERPA and COPPA?
A: Yes. FERPA consent-boundary testing, COPPA age-gate verification, sibling-record IDOR, parent-proxy session boundary. Reports map to the law your audit serves.
Q: Do you cover LTI 1.3, OneRoster, and OIDC?
A: Yes. LTI 1.3 launch parameter tampering, OneRoster API drift, OIDC scope confusion across LMS plus tool integrations, SAML signature wrap on legacy SSO.
Q: Will testing affect live student data?
A: No. Engagements use staging or sanitized snapshots; live-prod is only used for read-mode probing. A PII handling agreement is signed before scope kickoff.
Q: Is the report regulator-ready?
A: Yes. CREST severity, PII-handling notes per finding, regulator-ready PDF for FERPA, COPPA, SOC 2 Type II, ISO 27001, and state-privacy laws including SOPIPA and NY Ed Law 2-d.
Q: Do you test proctoring and remote-assessment tools?
A: Yes. Webcam-stream exfil paths, browser-lockdown bypass, AI-detection evasion, and ID-doc liveness bypass on remote-assessment flows.
Q: Do you include a re-test?
A: Free re-test after fixes ship. Written closure per finding, same scope, the proof-of-exploit reverts on patch.
---
# Fintech Security Testing
https://securelayer7.net/industries/fintech
SecureLayer7 Fintech security testing across open-banking APIs, real-time payment rails, OAuth-2 + JWT fintech flows, card tokenization, custody, and KYC. Named chain classes: open-banking IDOR, OAuth-2 scope drift, JWT alg confusion, RTP race condition, tokenization-vault bypass, custody MPC threshold bypass, oracle manipulation. CREST-conducted, CERT-In empanelled, regulator-ready for PCI DSS, SOC 2, RBI, MAS, DORA.
Sl7WaptHero
Pentests for the APIs
that move money.
Modern fintech moves money through APIs the OWASP Top 10 was never written for. We chain open-banking IDOR, OAuth-2 confusion, and payment-rail race conditions into one proof-of-exploit. Reports accepted by PCI DSS, SOC 2, RBI, MAS, and DORA auditors.
Talk to a security expert
/contact-us
security-posture-review
See the fintech attack paths
#methodology
/media/vertical-fintech-81306101.svg
Four fintech surfaces, Open-banking APIs, Payment rails, Identity, Custody, converging on a payment-rail race-condition proof-of-exploit.
Open-banking
Payment rails
Identity
Custody
ShieldCheck
Fintech-specific chain classes
Open-banking IDOR, OAuth-2 scope drift, JWT alg confusion, RTP race, tokenization-vault bypass. Eight named classes, not OWASP boilerplate.
FileSearch
Working proof-of-exploit
Captured request traces, signed JWT diffs, race-window timing, and tokenization PAN paths. Not a checklist score.
RotateCcw
Re-test included
Every finding re-tested after your team ships the fix. Written closure per finding.
FINTECH.
top-right
outline
control
Sl7WaptHero-industries-fintech-0
IN
Sl7WaptHero
Pentests for the rails
that move Indian money.
Indian BFSI moves money through UPI, NEFT, IMPS, RTGS, and Account Aggregator APIs that the RBI Cyber Security Framework and SEBI CSCRF expect you to pentest. We chain UPI VPA enumeration, AA consent boundary drift, and eKYC tampering into one proof-of-exploit. Reports accepted by RBI, SEBI, IRDAI, CERT-In, and DPDPA auditors.
Talk to a security expert
/contact-us
security-posture-review
See the BFSI attack paths
#methodology
/media/vertical-fintech-81306101.svg
Four Indian BFSI surfaces, UPI/NEFT rails, Account Aggregator, eKYC, and custody, converging on a UPI VPA enumeration proof-of-exploit at the centre.
UPI / NEFT
AA
eKYC
Custody
ShieldCheck
Fintech-specific chain classes
Open-banking IDOR, OAuth-2 scope drift, JWT alg confusion, RTP race, tokenization-vault bypass. Eight named classes, not OWASP boilerplate.
FileSearch
Working proof-of-exploit
Captured request traces, signed JWT diffs, race-window timing, and tokenization PAN paths. Not a checklist score.
RotateCcw
Re-test included
Every finding re-tested after your team ships the fix. Written closure per finding.
BFSI.
top-right
outline
control
Sl7WaptHero-industries-fintech-IN
IN
BFSI security.
DoorCardRow
IN
Three ways we secure US fintech.
Open-banking APIs, BaaS sponsor-bank stacks, and KYC copilots each break differently. Pick the engagement that matches the risk your auditor will not catch.
BugDazz Autonomous
Continuous coverage between annual SOC 2 and PCI DSS 4.0 cycles. Catches drift on OAuth-2 scopes and open-banking endpoints the auditor only tested once.
See BugDazz
/products/autonomous-pentest
/media/card-autonomous-v3-bdc95d07.svg
Red team engagement
Multi-week adversary emulation without a heads-up, MITRE ATT&CK-mapped. Tests whether your SOC catches treasury fraud and SWIFT-adjacent settlement abuse before NYDFS 23 NYCRR 500 reporting kicks in.
Brief a red team
/services/red-team-assessment
/media/card-red-team-v2-76a8d1e6.svg
AI and LLM pentest
Tests the KYC copilots and support chatbots your bank now ships. Prompt injection, cross-tenant data exfil, and chained jailbreaks against the model and its tools.
See AI pentest
/services/ai-security-assessment
/media/card-ai-llm-v2-e44ba315.svg
DoorCardRow-2-pergm5
DoorCardRow
IN
Three ways we secure Indian BFSI.
UPI rails, Account Aggregator flows, and the chatbots your bank now ships each fail in different places. Pick the engagement that maps to the RBI deadline in front of you.
BugDazz Autonomous
Continuous coverage between your RBI-mandated annual VAPT and the next SEBI CSCRF review. Catches drift on UPI, IMPS, and AA consent APIs the auditor only tested once.
See BugDazz
/products/autonomous-pentest
/media/card-autonomous-v3-bdc95d07.svg
Red team engagement
Multi-week adversary emulation, no heads-up, MITRE ATT&CK-mapped. Tests whether your SOC detects nostro and RuPay settlement abuse inside the CERT-In 6-hour reporting window.
Brief a red team
/services/red-team-assessment
/media/card-red-team-v2-76a8d1e6.svg
AI and LLM pentest
Tests the eKYC copilots and vernacular support bots BFSI now ships. Prompt injection, cross-customer data exfil, and DPDPA 2023 boundary tests against the model and its tools.
See AI pentest
/services/ai-security-assessment
/media/card-ai-llm-v2-e44ba315.svg
DoorCardRow-3-1vhm61
TrustStrip
TrustStrip-industries-fintech
CredentialStrip
On record
Same accreditations on every engagement.
CREST is the standard for offensive security execution. CERT-In, SOC 2 Type II, and ISO/IEC 27001 cover how SecureLayer7 handles your customer data, your engagement record, and the keys that touch your payment rails.
center
CREST
Accredited company & testers
CERT-In
Empanelled auditor
SOC 2 Type II
Independently audited
ISO/IEC 27001
Information Security Management
Mapped to engagement requirements across
PCI DSS · SOC 2 Type II · ISO/IEC 27001 · RBI · MAS · DORA · NYDFS · GDPR · NIST CSF
AUDITED.
CredentialStrip-industries-fintech
dark
badge-row
TextSection
Why a PCI checklist isn't a pentest
A control marked compliant
is not a money path closed.
PCI DSS, SOC 2, and DORA grade controls. A fintech with every control green can still hand an attacker a signed JWT that drains a customer wallet. SecureLayer7's testers chain what the checklist calls compliant: an OAuth-2 PSP refresh-flow that downgrades scope, a tokenization vault that returns PAN under a forged HMAC, a UPI callback that races collection against settlement. Then we walk you through the proof your auditor will accept and your team will fix.
light
/media/aws-blast-v2-6db972a4.svg
Two columns, passing fintech checklist controls on the left, and the chained pentest path each one becomes on the right.
right
PROOF.
TextSection-industries-fintech
Sl7Overview
IN SCOPE.
Where we look across your fintech stack.
IDENTITY
OAuth-2, JWT, KYC
PSP/PISP/AISP flows, refresh-token reuse, alg-confusion, KYC document-replay and anti-fraud rule evasion.
MONEY MOVEMENT
RTP rails + tokenization
UPI, FedNow, PIX, SEPA-instant race conditions; double-spend windows; tokenization-vault bypass and BIN-range abuse.
OPEN BANKING
Consent APIs + TPPs
IDOR across consent grants, scope-downgrade, third-party-provider impersonation across the directory.
CUSTODY
Wallets + bridges
Hot-wallet key extraction, MPC threshold bypass, signing-oracle abuse, bridge withdrawal-replay and oracle manipulation.
Sl7Overview-industries-fintech
Sl7Stat
FINTECH ATTACK SURFACE.
8
FINTECH-SPECIFIC CHAIN CLASSES.
left
Sl7Stat-industries-fintech
01
IDOR + consent grant
Open-banking consent-grant ID collides across tenants. Attacker enumerates grants, reads or moves funds from another tenant’s account.
02
OAuth-2 scope drift
Refresh-token flow returns an access token with a wider scope than the original grant. Customer token escalates to admin scope on the PSP API.
03
JWT alg confusion
RS256/HS256 alg switch or kid hijack. Signed assertion forged with the public key, fintech API treats it as authentic and impersonates the customer.
04
RTP race condition
UPI, FedNow, PIX, or SEPA-instant callback races settlement. Two concurrent transfers debit once, credit twice. Reconciliation runs after the window closes.
05
Cert-pinning bypass
Mobile-trading app pin-bypass via Frida hook or repackage. Session cookie + device-binding token intercepted, trading account hijacked from the attacker’s device.
06
Tokenization-vault bypass
Vault returns PAN under a forged HMAC or replayed detokenize call. PAN exfiltrated without ever touching the PCI-scoped database.
07
Oracle manipulation
Crypto-bridge price oracle skewed, withdrawal-replay against the cheaper-leg side. Funds removed from the bridge before the oracle update lands.
What an attacker chains to move money out of a modern fintech stack.
Sl7WaptScope
Scope -
Eight fintech attack surfaces.
Tested by hand, every engagement.
Every fintech engagement is threat-modelled to your stack - the PSPs you front, the rails you settle on, the chains you bridge to. We exercise every named class by hand. No template, no auto-scan.
SCOPE.
Open banking + consent APIs
IDOR across consent grants, scope-downgrade, third-party-provider impersonation.
Real-time payment rails
Race conditions on UPI, FedNow, PIX, SEPA instant; double-spend windows.
OAuth-2 + JWT fintech flows
alg confusion, kid hijack, scope drift across PSP, PISP, AISP.
Card and tokenization
PAN exposure paths, tokenization-vault bypass, BIN-range abuse.
Custody and wallet
Hot-wallet key extraction, MPC threshold bypass, signing oracle abuse.
KYC + onboarding
Document liveness bypass, ID-doc replay, anti-fraud rule evasion.
Crypto on-ramps + bridges
Withdrawal-replay, slippage abuse, oracle manipulation.
Mobile trading apps
Cert-pinning bypass, root-detect bypass, deep-link account takeover.
Sl7WaptScope-industries-fintech
Sl7WaptMethodology
FINTECH PENTEST METHODOLOGY.
Eight phases.
Compliance-aware, closed-loop.
Threat-modelled to your PSPs, payment rails, and regulator. Not a template we run against every fintech.
01
Compliance + payment-rail surface mapping
PCI scope boundary, RBI / MAS / DORA reach, third-party-provider directory, and the rails you actually settle on. Defined before any traffic.
02
OAuth-2 + JWT audit
Every flow exercised: auth-code, client-credentials, refresh, PISP, AISP. Token signing keys, kid rotation, scope grants, refresh reuse.
03
Open-banking + consent boundary testing
IDOR across consent grants, scope-downgrade, third-party-provider impersonation across the directory of registered TPPs.
04
Payment-rail race + double-spend probe
UPI, FedNow, PIX, SEPA-instant callbacks raced against settlement. Reconciliation windows mapped, double-spend windows captured live.
05
Mobile + trading-app runtime
Frida hook, cert-pinning bypass, root-detect bypass, deep-link account takeover. Tested on the iOS and Android build your customers actually run.
06
Chained finding + regulator-ready report
Findings correlated, chained into kill-chains, scored with CREST severity. PDF formatted for the regulator your audit serves.
07
Free re-test
Every finding re-tested after fixes ship, at no extra cost. Written closure for each finding.
08
Detection-engineering handoff
Each proof-of-exploit handed to your SOC with detection logic, log signatures, and the alert rule your platform team can deploy on day one.
PHASES
Sl7WaptMethodology-industries-fintech
timeline
ResourceShowcase
Insights
Fintech security
Resources.
OAuth-2 drift, RTP race conditions, and the open-banking bugs our reviewers keep finding in production fintech APIs.
light
manual
https://blog.securelayer7.net/feed/
Fintech
Read more
https://blog.securelayer7.net/wp-content/uploads/2025/06/CVE-2025-4318-RCE-in-AWS-Amplify-Studio.jpg
Fintech API security illustration
Fintech
Why OAuth-2 refresh-flow scope drift is the most under-reported fintech bug
How a refresh-token flow returned wider scope than the original grant, and the one-line fix nobody in the directory had shipped.
https://blog.securelayer7.net/
Read more
https://blog.securelayer7.net/wp-content/uploads/2025/01/January-Securelayer7-Blog-image-4.jpg
Real-time payment rail race-condition diagram
Fintech
Real-time payment rails: where the race window actually opens
UPI, FedNow, PIX, SEPA instant: the reconciliation gap, the callback path, and the test we run on every engagement.
https://blog.securelayer7.net/
Read more
https://blog.securelayer7.net/wp-content/uploads/2024/08/Securelayer7-August-2024-1.jpg
Open banking consent grant boundary diagram
Fintech
Open-banking consent grants: the IDOR pattern auditors miss
Where consent-grant IDs collide across tenants, why the directory does not catch it, and the boundary test your pentester should be running.
https://blog.securelayer7.net/
Read more
Adjacent disciplines
API Penetration Testing
/services/api-penetration-testing
Application Security Testing
/services/application-security-testing
Mobile App Pentest
/services/mobile-app-pentest
Cloud Penetration Testing
/services/cloud-penetration-testing
Smart Contract Audit
/services/smart-contract-audit
Proof of work
Published CVE research
/security-advisories
Talk to a security expert
/contact-us
LAB.
ResourceShowcase-industries-fintech
ExpertSpotlight
Meet your engagement lead
One lead who knows
fintech threat models.
John Dill
vCISO at SecureLayer7
John scopes fintech engagements against your PSP topology, open-banking directory, and the rails you settle on. He guides the pod from kick-off through final report and re-test.
Scopes single-PSP, multi-PSP, and full open-banking-directory engagements against your real risk model.
Owns kick-off, mid-engagement check-ins, and live walkthrough of every finding.
Drives remediation review and re-test until every money-movement path is closed.
10+
Years in offensive security
300+
Engagements led
99.7%
On-time delivery rate
/media/john-dill-05799aa1.webp
John Dill, vCISO at SecureLayer7
Ready to scope a fintech pentest? Book 30 minutes with John to walk through your PSP topology, rails, and timeline.
Book a 30-min call
/book/john-dill
SL7 Lab. Published CVE research.
/security-advisories
dark
EXPERT.
ExpertSpotlight-industries-fintech
Field CISO at SecureLayer7
John maps fintech engagements against PSPs, payment rails, and the open-banking directory your regulators index. He carries every finding to proof-of-exploit, with request traces and JWT diffs the platform team can act on.
Faq
Common procurement questions
What fintech buyers ask
before signing the SOW.
Six questions procurement teams send before signing a fintech pentest SOW. Answered against our methodology and your regulator.
Do you cover open-banking PISP / AISP testing?
Yes. Consent-grant boundary, scope downgrade, and third-party-provider impersonation across the directory. Tested against the live directory your fintech is registered in, not a sandbox.
Do you understand RBI, DORA, MAS, and NYDFS?
Yes. Reports map severity to the regulator your audit serves. SecureLayer7 is CERT-In empanelled, so the PDF ships in the format Indian regulators expect by default; MAS, RBI, NYDFS, and DORA formats are produced on request.
Do you test card and tokenization separately?
Yes. PAN exposure paths, vault bypass, and BIN-range abuse, plus a PCI scope-segmentation review. Findings tagged against the PCI control they break.
Is the report regulator-ready?
Yes. CREST severity, a working proof-of-exploit per finding, and a regulator-ready PDF accepted across PCI DSS, SOC 2, ISO 27001, RBI, MAS, and DORA review cycles.
Do you handle custody and wallet?
Yes. Hot-wallet key extraction, MPC threshold bypass, signing-oracle abuse, plus on-chain analytics work for engagement-recovery scenarios.
Do you include a re-test?
Free re-test of the same scope after fixes ship. Proof-of-exploit reverts on patch and we sign written closure per finding.
Have a procurement question not listed here?
Talk to a security expert
security-posture-review
ANSWERS.
Faq-industries-fintech
Do you cover open-banking PISP / AISP testing?
Yes. Consent-grant boundary, scope downgrade, third-party-provider impersonation across the directory.
Do you understand RBI, DORA, MAS, and NYDFS?
Yes. Reports map severity to the regulator your audit serves; CERT-In empanelled means the format Indian regulators expect by default.
Do you test card and tokenization separately?
Yes. PAN exposure paths, vault bypass, BIN-range abuse, plus PCI scope segmentation review.
Is the report regulator-ready?
Yes. CREST severity, working proof-of-exploit per finding, regulator-ready PDF for PCI DSS, SOC 2, ISO 27001, RBI, MAS, DORA.
Do you handle custody and wallet?
Yes. Hot-wallet key extraction, MPC threshold bypass, signing-oracle abuse, on-chain analytics for engagement-recovery.
Do you include a re-test?
Free re-test after fixes ship. Written closure per finding.
CtaBanner
CtaBanner-tear-sheet-fintech
Partner tear-sheet
Hand a 2-page FinTech tear-sheet to the buyer.
A printable summary your partner can drop into a pitch deck: named FinTech threats, methodology, compliance mapping, and the engagement leads to call. Saves as PDF from the browser.
Open the tear-sheet
/industries/fintech/tear-sheet
Download PDF
/industries/fintech/tear-sheet?print=1
light
left
TEAR-SHEET.
CtaBanner
Sample engagement report
See what arrives in your inbox.
A pre-vetted sample fintech report: full kill chain across open-banking + RTP, working PoC traces, JWT diffs, and re-test scope. Sent on request after a 5-minute scoping call.
Talk to a fintech pentest expert
/contact-us
/media/services-real-report-v2-fb4632af.svg
Sample fintech pentest report, kill-chain · evidence · remediation
light
left
security-posture-review
REPORT.
CtaBanner-industries-fintech
Request the sample fintech report
sample-download
## Q&A
Q: Do you cover open-banking PISP / AISP testing?
A: Yes. Consent-grant boundary, scope downgrade, and third-party-provider impersonation across the directory. Tested against the live directory your fintech is registered in, not a sandbox.
Q: Do you understand RBI, DORA, MAS, and NYDFS?
A: Yes. Reports map severity to the regulator your audit serves. SecureLayer7 is CERT-In empanelled, so the PDF ships in the format Indian regulators expect by default; MAS, RBI, NYDFS, and DORA formats are produced on request.
Q: Do you test card and tokenization separately?
A: Yes. PAN exposure paths, vault bypass, and BIN-range abuse, plus a PCI scope-segmentation review. Findings tagged against the PCI control they break.
Q: Is the report regulator-ready?
A: Yes. CREST severity, a working proof-of-exploit per finding, and a regulator-ready PDF accepted across PCI DSS, SOC 2, ISO 27001, RBI, MAS, and DORA review cycles.
Q: Do you handle custody and wallet?
A: Yes. Hot-wallet key extraction, MPC threshold bypass, signing-oracle abuse, plus on-chain analytics work for engagement-recovery scenarios.
Q: Do you include a re-test?
A: Free re-test of the same scope after fixes ship. Proof-of-exploit reverts on patch and we sign written closure per finding.
---
# Healthtech Security Testing
https://securelayer7.net/industries/healthtech
SecureLayer7 Healthtech security testing for digital health, telemedicine, FHIR/HL7 vendors, and EHR/EMR platforms. Named chain classes: FHIR resource over-exposure, HL7 v2 ADT tampering at the integration engine, EHR SAML signature wrap, telehealth WebRTC TURN PHI exfil, DICOM C-STORE injection, patient-portal IDOR. Regulator-ready reports for HIPAA, HITRUST CSF, SOC 2 Type II, and ISO/IEC 27001. CREST-conducted, CERT-In empanelled. Standard HIPAA BAA signed before any traffic; PHI handled inside the encrypted engagement boundary; free re-test after fixes ship.
Sl7WaptHero
Pentests for FHIR, HL7, and the EHR.
Without breaking the shift.
PHI moves through FHIR, HL7 v2, and telehealth WebRTC streams that audit checklists treat as black boxes. Our pentests open them: FHIR resource over-exposure, HL7 integration-engine tampering, and live WebRTC PHI leaks. Reports accepted by HIPAA, HITRUST, SOC 2, and ISO 27001 auditors.
Talk to a security expert
/contact-us
security-posture-review
See the PHI attack paths
#methodology
/media/vertical-healthtech-6952fc2c.svg
Four healthtech surfaces, FHIR, HL7, EHR/SSO, telehealth, converging on a chained PHI-exfil proof-of-exploit at the centre.
FHIR
HL7
EHR/SSO
Telehealth
ShieldCheck
PHI under BAA
Encrypted boundary
FileSearch
Auditor accepted
HIPAA · HITRUST · SOC 2 · ISO 27001
RotateCcw
Re-test
Free, written closure
HEALTH.
top-right
outline
Sl7WaptHero-0-healthtech
IN
Sl7WaptHero
Pentests for ABDM, ABHA,
and the EHRs that ride them.
Indian healthtech ships PHI through ABDM endpoints, ABHA-linked consent artefacts, HIP/HIU exchanges, and telehealth WebRTC. Our pentests open FHIR R4 resource over-exposure, ABDM consent boundary drift, and HPR/HFR role escalation. Reports accepted by NHA, CERT-In, DPDPA, and ISO 27001 auditors.
Talk to a security expert
/contact-us
security-posture-review
See the ABDM attack paths
#methodology
/media/vertical-healthtech-6952fc2c.svg
Four Indian healthtech surfaces, ABDM endpoints, ABHA consent, HPR/HFR registries, and telehealth WebRTC, converging on a chained PHI exfil proof-of-exploit at the centre.
ABDM
ABHA
HPR/HFR
Telehealth
PHI under BAA
Encrypted boundary
Auditor accepted
HIPAA · HITRUST · SOC 2 · ISO 27001
Re-test
Free, written closure
ABDM.
top-right
outline
Sl7WaptHero-industries-healthtech-IN
IN
Healthtech security.
DoorCardRow
IN
Three ways we test healthtech.
Pick the engagement that matches the surface. FHIR R4 endpoints, EHR SSO paths, and clinical copilots each fail differently. So we test them differently.
BugDazz Autonomous
Continuous coverage of FHIR R4 and HL7 v2 endpoints between human engagements. Catches PHI exposure drift the day a scheduling API ships, not at the next HITRUST cycle.
See BugDazz
/products/autonomous-pentest
/media/card-autonomous-v3-bdc95d07.svg
Red team engagement
Multi-week adversary emulation across EHR, billing APIs, and telehealth WebRTC. Tests whether your SOC catches the path a ransomware operator actually traverses.
Brief a red team
/services/red-team-assessment
/media/card-red-team-v2-76a8d1e6.svg
AI and LLM pentest
Tests clinical scribes, patient chatbots, and summary copilots for prompt injection, PHI exfil chains, and over-prescription manipulation. HIPAA and SOC 2 evidence included.
See AI pentest
/services/ai-security-assessment
/media/card-ai-llm-v2-e44ba315.svg
DoorCardRow-2-kltk8n
DoorCardRow
IN
Three ways we test ABDM-era healthtech.
ABHA-linked consent flows, HIP and HIU exchanges, and clinical copilots each fail at different layers. Each gets its own engagement shape.
BugDazz Autonomous
Continuous coverage of ABDM endpoints, HPR and HFR lookups, and HIP / HIU exchanges between human engagements. Catches consent-artefact drift before your next CERT-In audit.
See BugDazz
/products/autonomous-pentest
/media/card-autonomous-v3-bdc95d07.svg
Red team engagement
Multi-week adversary emulation across ABHA-linked consent, billing flows, and telehealth WebRTC. Tests SOC detection on the paths a ransomware crew uses against Indian hospital chains.
Brief a red team
/services/red-team-assessment
/media/card-red-team-v2-76a8d1e6.svg
AI and LLM pentest
Tests clinical copilots, patient chatbots, and scribe agents for prompt injection, PHI exfil chains, and over-prescription manipulation. DPDPA 2023 and ISO 27001 evidence included.
See AI pentest
/services/ai-security-assessment
/media/card-ai-llm-v2-e44ba315.svg
DoorCardRow-3-o437gw
TrustStrip
TrustStrip-industries-healthtech
CredentialStrip
On record
Same accreditations on every engagement.
CREST is the standard for offensive security execution. CERT-In, SOC 2 Type II, and ISO/IEC 27001 cover how SecureLayer7 handles your PHI, your patient data, and your engagement record. HIPAA BAA executed before any traffic.
center
CREST
Accredited company & testers
CERT-In
Empanelled auditor
SOC 2 Type II
Independently audited
ISO/IEC 27001
Information Security Management
Mapped to engagement requirements across
HIPAA · HITRUST CSF · SOC 2 Type II · ISO/IEC 27001 · GDPR · NIST CSF · 21 CFR Part 11 · and others
AUDITED.
CredentialStrip-1-healthtech
dark
badge-row
TextSection
Why a HIPAA gap-assessment isn't a pentest
A control marked present
is not a path closed.
HIPAA gap-assessments check whether a control exists. A pentest reports what an attacker can do with that control in place. We chain FHIR consent boundary drift, HL7 v2 integration-engine tampering, and telehealth WebRTC TURN abuse into a working proof-of-exploit your CISO and clinical-ops team can act on, then re-test until every PHI path is closed.
light
/media/aws-blast-v2-6db972a4.svg
Two columns: HIPAA controls marked present on the left, the chained PHI-exfil path each one becomes on the right.
right
PHI.
TextSection-3-healthtech
Sl7WaptScope
IN SCOPE.
Eight categories.
Every PHI-touching surface in the stack.
FHIR, HL7 v2, EHR/SSO, telehealth, bedside devices, DICOM, the patient portal, and the mobile health app. The chain an attacker walks is rarely one of these alone.
SCOPE.
Sl7WaptScope-2-healthtech
FHIR APIs
Resource over-exposure across patient consent, search-parameter abuse, bulk-export drift.
HL7 v2 integration
Message tampering at the integration engine, MLLP injection, ADT/ORU forgery (Mirth, Rhapsody, NextGen Connect).
EHR + SSO
Session takeover via OAuth, SAML signature wrap, scope drift across charting and ordering.
Telehealth + WebRTC
TURN server PHI leakage, SDP injection, recording-bucket exposure, session-record exfil.
Bedside + DICOM
Infusion-pump CAN/serial pivot, vital-sign monitor MQTT abuse, DICOM service injection, study-UID tampering, anonymization bypass.
Patient portal + mobile
PHI IDOR, password-reset replay, MFA-fallback abuse, parent-proxy boundary, biometric bypass, deep-link auth, Keychain/Keystore drift.
Sl7Stat
HEALTHTECH ATTACK SURFACE.
8
PHI-EXPOSURE PATHS WE TEST.
left
Sl7Stat-industries-healthtech
What an attacker chains to walk PHI out of a modern healthtech stack.
01
FHIR resource over-exposure
Patient consent boundary drift, search-parameter abuse, bulk-export sub-resource leak, cross-patient read from a single low-scope token.
02
HL7 v2 ADT tampering
Integration-engine message rewrite, MLLP injection at the listener, ADT^A40 forgery merges patient identities and rewrites order history.
03
EHR SAML signature wrap
XML signature wrap on the SSO assertion, scope drift from a charting role into the ordering role, prescription write-path reached without a clinician seat.
04
Telehealth WebRTC TURN exfil
TURN server allocated on an untrusted relay, SDP injected to redirect media, encounter audio and screen-share PHI walked off to attacker storage.
05
DICOM service injection
C-STORE accepted from a forged AE title, study-instance UID tampering replaces an oncology study mid-read, anonymization layer bypassed on export.
06
Patient portal IDOR
Guardian/parent-proxy boundary collapses on a sibling record, MFA-fallback path replayed, full PHI history rendered to the wrong account.
07
Bedside MQTT pump command
Connected infusion pump on a flat clinical VLAN, MQTT broker abused for a control-plane write, dosage command crafted without the pump console.
Sl7WaptMethodology
HEALTHTECH PENTEST METHODOLOGY.
Eight phases.
PHI-handled, closed-loop.
Scoped to your HIPAA boundary, EHR vendor flow, integration engine, and patient-facing surfaces. Not a template we run against every healthcare client.
01
HIPAA + HITRUST scope mapping
PHI handling agreement signed under BAA before any traffic. Boundary, data classes in scope, and clinical-ops blackout windows agreed in writing.
02
FHIR + consent boundary
Resource over-exposure across Patient, Observation, Encounter, MedicationRequest. Search-parameter abuse, _include drift, bulk-export sub-resource leak, SMART-on-FHIR scope tested to consent break.
03
HL7 v2 + integration engine
Mirth, Rhapsody, NextGen Connect probed for MLLP injection, message-flow tampering, ADT/ORU forgery, and identity-merge abuse across upstream and downstream feeds.
04
EHR + SSO chain
Epic, Cerner, Athena (or vendor-equivalent) flows: OAuth scope drift, SAML signature wrap, session-takeover paths between charting, ordering, billing, and pharmacy.
05
Telehealth + WebRTC
TURN/STUN topology, SDP injection, encounter-recording storage exposure, parent-proxy boundary on guardian sessions. Recording-bucket audit included.
06
Bedside / DICOM pivot
Where in scope: infusion pumps, vital-sign monitors, lab analyzers, PACS workstations, DICOM C-STORE injection, study-UID tampering, anonymization bypass.
07
Chained finding + HIPAA-grade report
Findings correlated, chained into a working PHI-exfil transcript, scored CREST severity, written with PHI-handling notes per finding. Regulator-ready PDF for HIPAA, HITRUST, SOC 2 Type II, ISO 27001.
08
Free re-test + detection handoff
Every finding re-tested after fixes ship at no extra cost. Detection-engineering handoff to your CISO and clinical-ops team, what to alert on, what to suppress, what stays in the SIEM.
PHASES
Sl7WaptMethodology-4-healthtech
timeline
RawHtml
RawHtml-methodology-expert-divider
ExpertSpotlight
Meet our expert
One lead fluent in
PHI and HIPAA scope.
John Dill
vCISO at SecureLayer7
John scopes healthtech engagements against your HIPAA boundary, EHR vendor flow, and clinical-ops blackout windows. He guides the pod from kick-off through final report and re-test.
Scopes FHIR, HL7 v2, EHR/SSO, telehealth, and bedside engagements against your real PHI flow.
Owns kick-off, mid-engagement check-ins, and live walkthrough of every PHI-exfil path.
Drives remediation review and re-test until every PHI path is closed and your CISO has written closure.
10+
Years in offensive security
300+
Engagements led
99.7%
On-time delivery rate
/media/john-dill-05799aa1.webp
John Dill, vCISO at SecureLayer7
Ready to scope a healthtech pentest? Book 30 minutes with John to walk through your HIPAA boundary, EHR vendor flow, and clinical-ops window.
Book a 30-min call
/book/john-dill
SL7 Lab. Published CVE research.
/security-advisories
dark
EXPERT.
ExpertSpotlight-6-healthtech
Field CISO at SecureLayer7
John maps healthtech engagements against FHIR, HL7 v2, the integration engine, and the EHR vendor flow your auditors keep flagging. Every finding is carried to proof-of-exploit, with PHI-handling notes and patch evidence the platform team can act on.
Faq
Common procurement questions
What buyers ask
about healthtech penetration testing.
Six questions procurement, compliance, and clinical-ops teams send before signing a healthtech pentest SOW. Answered against our methodology and your auditor.
Do you sign a BAA?
Yes. A standard HIPAA Business Associate Agreement is executed before engagement kick-off. All PHI is handled inside the encrypted boundary, with PHI-handling notes per finding and a documented destruction step at engagement close.
Will you break our EHR or shift workflow?
No. Engagements are scheduled to your maintenance window. Invasive tests run on non-prod replicas; live-prod is touched only for read-mode probing. Clinical-ops blackout windows are written into the SOW.
Do you cover FHIR + HL7 v2 + DICOM?
Yes. All three. Plus the integration engine between them, Mirth Connect, Rhapsody, NextGen Connect, or your vendor equivalent. Patient portal, mobile health app, telehealth WebRTC, and bedside / connected-device pivots covered where in scope.
Is the report HIPAA-ready?
Yes. CREST-mapped severity, PHI-handling notes per finding, a regulator-ready PDF accepted across HIPAA, HITRUST CSF, SOC 2 Type II, and ISO/IEC 27001 review cycles. CERT-In empanelled signature for Indian filings.
Do you test bedside or connected medical devices?
Yes, where in scope. Infusion pumps, vital-sign monitors, lab analyzers, PACS workstations, telemetry gateways. CAN/serial pivot, MQTT broker abuse, DICOM service injection. Patient-safety guardrails written into the test plan.
Do you include a re-test?
Yes. Free re-test of the same scope after fixes ship. Written closure per finding, signed by the engagement lead. The PHI-exfil transcript is replayed against the patched system; closure only signs when the path is gone.
Have a procurement question not listed here?
Talk to a security expert
security-posture-review
ANSWERS.
Faq-7-healthtech
Do you sign a BAA?
Yes. A standard HIPAA Business Associate Agreement is executed before engagement kick-off. All PHI is handled inside the encrypted boundary, with PHI-handling notes per finding and a documented destruction step at engagement close.
Will you break our EHR or shift workflow?
No. Engagements are scheduled to your maintenance window. Invasive tests run on non-prod replicas; live-prod is touched only for read-mode probing. Clinical-ops blackout windows are written into the SOW.
Do you cover FHIR + HL7 v2 + DICOM?
Yes. All three. Plus the integration engine between them, Mirth Connect, Rhapsody, NextGen Connect, or your vendor equivalent. Patient portal, mobile health app, telehealth WebRTC, and bedside / connected-device pivots covered where in scope.
Is the report HIPAA-ready?
Yes. CREST-mapped severity, PHI-handling notes per finding, a regulator-ready PDF accepted across HIPAA, HITRUST CSF, SOC 2 Type II, and ISO/IEC 27001 review cycles. CERT-In empanelled signature for Indian filings.
Do you test bedside or connected medical devices?
Yes, where in scope. Infusion pumps, vital-sign monitors, lab analyzers, PACS workstations, telemetry gateways. CAN/serial pivot, MQTT broker abuse, DICOM service injection. Patient-safety guardrails written into the test plan.
Do you include a re-test?
Yes. Free re-test of the same scope after fixes ship. Written closure per finding, signed by the engagement lead. The PHI-exfil transcript is replayed against the patched system; closure only signs when the path is gone.
CtaBanner
CtaBanner-tear-sheet-healthtech
Partner tear-sheet
Hand a 2-page HealthTech tear-sheet to the buyer.
A printable summary your partner can drop into a pitch deck: named HealthTech threats, methodology, compliance mapping, and the engagement leads to call. Saves as PDF from the browser.
Open the tear-sheet
/industries/healthtech/tear-sheet
Download PDF
/industries/healthtech/tear-sheet?print=1
light
left
TEAR-SHEET.
CtaBanner
Sample engagement report
See what arrives in your inbox.
A pre-vetted sample healthtech report: full PHI-exfil kill chain, working PoC traces, FHIR / HL7 / EHR fix guidance, and re-test scope. Sent on request after a 5-minute scoping call.
Talk to a healthtech pentest expert
/contact-us
/media/services-real-report-v2-fb4632af.svg
Sample healthtech pentest report, kill-chain · evidence · remediation
light
left
security-posture-review
REPORT.
CtaBanner-8-healthtech
Request a healthtech sample finding
sample-download
## Q&A
Q: Do you sign a BAA?
A: Yes. A standard HIPAA Business Associate Agreement is executed before engagement kick-off. All PHI is handled inside the encrypted boundary, with PHI-handling notes per finding and a documented destruction step at engagement close.
Q: Will you break our EHR or shift workflow?
A: No. Engagements are scheduled to your maintenance window. Invasive tests run on non-prod replicas; live-prod is touched only for read-mode probing. Clinical-ops blackout windows are written into the SOW.
Q: Do you cover FHIR + HL7 v2 + DICOM?
A: Yes. All three. Plus the integration engine between them, Mirth Connect, Rhapsody, NextGen Connect, or your vendor equivalent. Patient portal, mobile health app, telehealth WebRTC, and bedside / connected-device pivots covered where in scope.
Q: Is the report HIPAA-ready?
A: Yes. CREST-mapped severity, PHI-handling notes per finding, a regulator-ready PDF accepted across HIPAA, HITRUST CSF, SOC 2 Type II, and ISO/IEC 27001 review cycles. CERT-In empanelled signature for Indian filings.
Q: Do you test bedside or connected medical devices?
A: Yes, where in scope. Infusion pumps, vital-sign monitors, lab analyzers, PACS workstations, telemetry gateways. CAN/serial pivot, MQTT broker abuse, DICOM service injection. Patient-safety guardrails written into the test plan.
Q: Do you include a re-test?
A: Yes. Free re-test of the same scope after fixes ship. Written closure per finding, signed by the engagement lead. The PHI-exfil transcript is replayed against the patched system; closure only signs when the path is gone.
---
# Retail Security Testing
https://securelayer7.net/industries/retail
SecureLayer7 Retail security testing across checkout, coupon engine, loyalty ledger, PCI tokenization, POS and self-checkout kiosk, customer-data API, and mobile retail app. Named chain classes: checkout race condition, coupon stacking to cart-zeroing, loyalty replay to free redemption, PAN tokenization-vault bypass, kiosk supervisor-mode escape. Reports accepted by PCI DSS 4.0, SOC 2, GDPR, CCPA, and CERT-In review cycles. CREST-conducted, CERT-In empanelled, staging or sanitized prod replica data handling, free re-test of the same scope after fixes ship.
Sl7WaptHero
Retail security.
Pentests for the checkout, the kiosk,
and the loyalty engine.
Checkout races, coupon-stacking logic, and loyalty-points fraud are business-logic flaws scanners cannot reason about. Our pentests stage them end-to-end with reproducible PoCs. Reports accepted by PCI DSS, SOC 2, GDPR, and CCPA auditors.
Talk to a security expert
/contact-us
security-posture-review
See the retail attack paths
#methodology
/media/vertical-retail-25916ef2.svg
Retail attack surface, checkout, coupon engine, loyalty wallet, kiosk, and customer API converging on a single proof-of-exploit transcript.
Checkout
Coupon
Loyalty
Kiosk
ShieldCheck
Retail stack, end to end
Checkout, coupon, loyalty, kiosk, mobile, customer API. One engagement, one Org-wide proof.
FileSearch
Working proof-of-exploit
Captured webhook replays, cart-state traces, IDOR transcripts, kiosk supervisor escape video. Not a scan score.
RotateCcw
Re-test included
Every finding re-tested after your team ships the fix. Written closure per path.
RETAIL.
top-right
outline
control
Sl7WaptHero-industries-retail-0
IN
Sl7WaptHero
Retail security.
Pentests for UPI checkout, ONDC,
and the loyalty engine.
Indian retail clears payment through UPI, RuPay, and RBI CoFT tokens. ONDC adds seller, logistics, and fulfilment protocols to the same surface. Our pentests stage UPI collect-request abuse, ONDC protocol replay, and loyalty-points fraud as reproducible PoCs. Reports accepted by PCI DSS 4.0, RBI, CERT-In, and DPDPA auditors.
Talk to a security expert
/contact-us
security-posture-review
See the UPI/ONDC attack paths
#methodology
/media/vertical-retail-25916ef2.svg
Four Indian retail surfaces, UPI/ONDC checkout, coupon engine, loyalty wallet, and kiosk, converging on a coupon-stack abuse proof-of-exploit at the centre.
UPI / ONDC
Coupon
Loyalty
Kiosk
ShieldCheck
Retail stack, end to end
Checkout, coupon, loyalty, kiosk, mobile, customer API. One engagement, one Org-wide proof.
FileSearch
Working proof-of-exploit
Captured webhook replays, cart-state traces, IDOR transcripts, kiosk supervisor escape video. Not a scan score.
RotateCcw
Re-test included
Every finding re-tested after your team ships the fix. Written closure per path.
ONDC.
top-right
outline
control
Sl7WaptHero-industries-retail-IN
IN
DoorCardRow
IN
Retail security past the PCI checkbox.
PCI ASV scans run quarterly. Your checkout, coupon engine, and loyalty wallet ship weekly. Three ways we close the gap.
BugDazz Autonomous
Continuous coverage on Stripe and Adyen checkout APIs, coupon engines, and loyalty endpoints. Catches business-logic drift between PCI DSS 4.0 ASV scans.
See BugDazz
/products/autonomous-pentest
/media/card-autonomous-v3-bdc95d07.svg
Red team engagement
Multi-week emulation against POS terminals, in-store kiosks, OMS fulfillment, and loyalty wallet APIs. Tests whether your SOC detects the chain, not just the entry.
Brief a red team
/services/red-team-assessment
/media/card-red-team-v2-76a8d1e6.svg
AI and LLM pentest
Tests shopping assistants and pricing copilots for prompt injection, coupon stacking, dynamic-pricing manipulation, and customer-PII exfil under CCPA and CPRA.
See AI pentest
/services/ai-security-assessment
/media/card-ai-llm-v2-e44ba315.svg
DoorCardRow-2-kdqasy
DoorCardRow
IN
Retail security for the UPI and ONDC stack.
UPI collect, RuPay tokens, and ONDC seller APIs all ship on different release trains. Three ways we test the surfaces your auditor will not.
BugDazz Autonomous
Continuous coverage on UPI checkout (collect and push), UPI Lite, RuPay rails, and RBI CoFT token vaults. Holds the line between CERT-In audits.
See BugDazz
/products/autonomous-pentest
/media/card-autonomous-v3-bdc95d07.svg
Red team engagement
Multi-week emulation across POS, in-store kiosks, ONDC seller and logistics protocols, and eRUPI voucher flows. Tests fulfilment hand-offs and detection, not just perimeter.
Brief a red team
/services/red-team-assessment
/media/card-red-team-v2-76a8d1e6.svg
AI and LLM pentest
Tests vernacular shopping assistants and recommendation copilots for prompt injection, coupon stacking, dynamic-pricing abuse, and customer-PII exfil under DPDPA 2023.
See AI pentest
/services/ai-security-assessment
/media/card-ai-llm-v2-e44ba315.svg
DoorCardRow-3-fzp8r3
TrustStrip
TrustStrip-industries-retail
Sl7WaptScope
Scope
Eight retail attack surfaces.
Not just the storefront.
Retail breaches walk out of the things scanners cannot see: a coupon stack, a race between two checkout tabs, a loyalty redemption replayed after the points were burned. We test the chain that turns one logic flaw into walked-out money or merchandise.
Checkout and payment integration
Race conditions, Adyen / Stripe / Razorpay webhook tampering, BIN-range abuse, 3DS bypass, refund-after-shipping replay.
Coupon, promo, and pricing engine
Coupon stacking, price-tier downgrade, GWP redemption replay, region-locked promo escape, cart-zeroing chain.
Loyalty and rewards
Points double-credit, tier-cliff exploitation, referral fraud, redemption-window race, account merge takeover.
Inventory and order
Order tampering, oversold-item exploitation, returns-fraud chain, refund manipulation, partial-ship abuse.
PCI DSS scope and tokenization
PAN exposure paths, tokenization-vault bypass, scope-segmentation drift, BIN-range abuse, CDE network leak.
POS and self-checkout kiosk
Receipt and log tampering, kiosk supervisor-mode escape, weight-check bypass, kiosk-network pivot to back-of-house.
Customer-data API
Order-history IDOR, address-book replay, account-merge takeover, GDPR data-export drift, password-reset relay.
Mobile retail app
Cert-pinning bypass, deep-link account takeover, in-store-mode payload tamper, scanner-API abuse, gift-card brute force.
SCOPE.
top-right
outline
foreground
Sl7WaptScope-industries-retail-1
CredentialStrip
On record
Same accreditations on every retail engagement.
CREST is the standard for offensive security execution. CERT-In, SOC 2 Type II, and ISO/IEC 27001 cover how SecureLayer7 handles your PAN scope, your customer data, and your engagement record.
center
CREST
Accredited company & testers
CERT-In
Empanelled auditor
SOC 2 Type II
Independently audited
ISO/IEC 27001
Information Security Management
Mapped to engagement requirements across
PCI DSS 4.0 · SOC 2 Type II · ISO/IEC 27001 · GDPR · CCPA · CERT-In · NIST CSF
AUDITED.
CredentialStrip-industries-retail-2
dark
badge-row
Sl7Stat
RETAIL ATTACK SURFACE.
8
RETAIL-SPECIFIC CHAIN CLASSES.
left
Sl7Stat-industries-retail-3
01
Checkout race to double-charge or oversell
Multi-tab checkout with shared cart state, inventory and payment debit race past stock count, customer pays twice or walks with an oversold SKU.
02
Coupon stack to cart-zeroing
Stacking SKU coupon, cart coupon, loyalty multiplier, and free-shipping promo past intended floor; order total resolves to zero or negative.
03
Loyalty replay to free redemption
Redemption call replayed inside the points-balance window; same points burn twice; merchandise ships against credit that was already cleared.
04
Webhook replay to refund-after-shipping
Payment-gateway webhook replayed with stale signature window; refund posts after the order already shipped from warehouse.
05
PAN tokenization-vault bypass
Token-detokenize endpoint reachable from a non-CDE service, full PAN exposure outside scope, PCI DSS segmentation collapses.
06
Kiosk supervisor-mode escape
Self-checkout exits to store-mode admin via debug touch sequence or USB HID payload; price overrides, void receipts, kiosk-network pivot.
07
Customer-API IDOR to order-history exfil
Order-history endpoint trusts customer ID from header, sequential ID enumeration walks every order, name + address + last-four-PAN exfiltrated.
What an attacker chains to walk money or merchandise out of a modern retail stack.
Sl7WaptMethodology
RETAIL PENTEST METHODOLOGY.
Eight phases.
PCI-scoped, closed-loop.
Threat-modelled to your payment rails, coupon engine, loyalty ledger, and kiosk fleet. Not a template we run against every storefront.
01
Scope and PCI mapping
PCI DSS 4.0 scope, payment-rail provider audit, Adyen / Stripe / Razorpay / PayU / CCAvenue boundary, CDE segmentation map confirmed before any traffic.
02
Checkout race and logic probe
Multi-tab, multi-currency, multi-region cart state. Race windows, inventory-payment ordering, partial-ship abuse, refund-after-shipping replay.
03
Coupon and promo engine fuzz
Stacking floor, tier downgrade, region-lock escape, GWP redemption replay, free-shipping abuse, store-credit recursion.
04
Loyalty and rewards integrity
Double-credit on signup, redemption race, referral fraud, tier-cliff abuse, points-to-cash conversion drift, account-merge takeover.
05
PCI tokenization and segmentation review
Tokenization-vault bypass, BIN-range abuse, scope-segmentation drift, CDE network leak path, key-rotation gap.
06
POS and kiosk runtime
Self-checkout supervisor-mode escape, weight-check bypass, USB HID payload, receipt and log tampering, kiosk-network pivot.
07
Mobile and in-store-mode runtime
Frida hook, cert-pinning bypass, deep-link account takeover, in-store-mode payload tamper, scanner-API replay, gift-card brute force.
08
Chained finding, regulator-ready report, re-test
Every finding chained into a working exploit, mapped to PCI DSS 4.0, SOC 2, GDPR, CCPA. Free re-test of the same scope after fixes land.
PHASES
Sl7WaptMethodology-industries-retail-4
timeline
ResourceShowcase
Insights
Retail security
Resources.
Coupon stacking, loyalty replay, and PCI scope drift, drawn from the retail engagements our reviewers keep walking.
light
manual
https://blog.securelayer7.net/feed/
Retail
Read more
PCI DSS 4.0 segmentation diagram
PCI DSS
PCI DSS 4.0: segmentation, tokenization, and the pentest scope buyers miss
Where PCI scope quietly grows, and the segmentation checks an auditor will accept.
/security-advisories
Read more
Coupon stacking abuse cart screenshot
Retail
Coupon stacking, cart-zeroing, and the promo engine race
How a tier downgrade, a stacked GWP, and a free-shipping promo combine to settle a cart at zero.
/security-advisories
Read more
Loyalty replay attack diagram
Retail
Loyalty replay: free redemption inside the points-balance window
Why loyalty ledgers leak points faster than gift-card systems, and the API surface that lets it happen.
/security-advisories
Read more
Adjacent disciplines
Web Application Penetration Testing
/services/web-application-penetration-testing
API Penetration Testing
/services/api-penetration-testing
Mobile App Penetration Testing
/services/mobile-app-pentest
Cloud Penetration Testing
/services/cloud-penetration-testing
Red Team Assessment
/services/red-team-assessment
Proof of work
Published CVE research
/security-advisories
Talk to a security expert
/contact-us
LAB.
ResourceShowcase-industries-retail-5
ExpertSpotlight
Meet our expert
One lead who knows
PCI and peak traffic.
John Dill
vCISO at SecureLayer7
John scopes retail engagements against your PCI DSS boundary, payment-rail provider, coupon engine, and kiosk fleet. He guides the pod from kick-off through final report and re-test.
Scopes single-brand, multi-banner, and franchise retail engagements against your real PCI scope.
Owns kick-off, mid-engagement check-ins, and live walkthrough of every chained finding.
Drives remediation review and re-test until every retail attack path is closed.
10+
Years in offensive security
300+
Engagements led
99.7%
On-time delivery rate
/media/john-dill-05799aa1.webp
John Dill, vCISO at SecureLayer7
Ready to scope a retail pentest? Book 30 minutes with John to walk through your PCI scope, payment rails, loyalty ledger, and kiosk fleet.
Book a 30-min call
/book/john-dill
SL7 Lab. Published CVE research.
/security-advisories
dark
EXPERT.
ExpertSpotlight-industries-retail-6
Field CISO at SecureLayer7
John maps retail engagements against the payment rail, the coupon engine, and the kiosk fleet your auditors keep flagging. He carries every finding to proof-of-exploit, with PCI-mapped evidence the platform team can act on.
Faq
Common procurement questions
What retail buyers ask
about a pentest.
Six questions retail security and procurement teams send before signing a SOW. Answered against our methodology and your auditor.
Do you cover PCI DSS 4.0?
Yes. Scope segmentation review, tokenization-vault audit, BIN-range abuse, CDE network leak paths, all mapped to PCI DSS 4.0 requirements with a regulator-ready PDF.
Do you test our payment-gateway integration?
Yes. Adyen, Stripe, Razorpay, PayU, and CCAvenue webhook signing, 3DS flows, refund and chargeback paths, BIN-range abuse, replay windows, all exercised against the live integration boundary.
Will testing affect live checkout?
No. Engagements run against staging or sanitized prod replicas. Live prod is only used for read-mode probing. Test windows are coordinated with your release calendar.
Do you cover POS and self-checkout kiosks?
Yes. Supervisor-mode escape, weight-check bypass, receipt and log tampering, USB HID payloads, and kiosk-network pivot into back-of-house. On-site if needed, remote where the fleet permits.
Is the report regulator-ready?
Yes. CREST-mapped severity, working proof-of-exploit per finding, code-level fix guidance, and a regulator-ready PDF accepted across PCI DSS, SOC 2, ISO/IEC 27001, GDPR, CCPA, and CERT-In review cycles.
Do you include a re-test?
Yes. Every retail engagement includes a free re-test of the same scope after fixes land. Proof-of-exploit reverts on patch; closure is signed in writing per finding.
Have a procurement question not listed here?
Talk to a security expert
security-posture-review
ANSWERS.
Faq-industries-retail-7
Do you cover PCI DSS 4.0?
Yes. Scope segmentation review, tokenization-vault audit, BIN-range abuse, CDE leak paths, mapped to PCI DSS 4.0 with a regulator-ready PDF.
Do you test our payment-gateway integration?
Yes. Adyen, Stripe, Razorpay, PayU, CCAvenue webhook signing, 3DS flows, refund and chargeback paths, BIN-range abuse, replay windows.
Will testing affect live checkout?
No. Staging or sanitized prod replicas; live prod only for read-mode probing; coordinated with your release window.
Do you cover POS and self-checkout kiosks?
Yes. Supervisor-mode escape, weight-check bypass, receipt and log tampering, USB HID, kiosk-network pivot to back-of-house.
Is the report regulator-ready?
Yes. CREST severity, working proof-of-exploit, regulator-ready PDF for PCI DSS, SOC 2, ISO 27001, GDPR, CCPA, CERT-In.
Do you include a re-test?
Free re-test of the same scope after fixes ship. Written closure per finding.
CtaBanner
Sample engagement report
See what arrives in your inbox.
A pre-vetted sample retail report: full kill chain from checkout race through loyalty replay, working PoC traces, IDOR transcripts, PCI scope mapping, and re-test scope. Sent on request after a 5-minute scoping call.
Talk to a retail pentest expert
/contact-us
/media/services-real-report-v2-fb4632af.svg
Sample retail pentest report, kill-chain · evidence · remediation
light
left
security-posture-review
REPORT.
CtaBanner-industries-retail-8
Read a retail sample finding
sample-download
## Q&A
Q: Do you cover PCI DSS 4.0?
A: Yes. Scope segmentation review, tokenization-vault audit, BIN-range abuse, CDE network leak paths, all mapped to PCI DSS 4.0 requirements with a regulator-ready PDF.
Q: Do you test our payment-gateway integration?
A: Yes. Adyen, Stripe, Razorpay, PayU, and CCAvenue webhook signing, 3DS flows, refund and chargeback paths, BIN-range abuse, replay windows, all exercised against the live integration boundary.
Q: Will testing affect live checkout?
A: No. Engagements run against staging or sanitized prod replicas. Live prod is only used for read-mode probing. Test windows are coordinated with your release calendar.
Q: Do you cover POS and self-checkout kiosks?
A: Yes. Supervisor-mode escape, weight-check bypass, receipt and log tampering, USB HID payloads, and kiosk-network pivot into back-of-house. On-site if needed, remote where the fleet permits.
Q: Is the report regulator-ready?
A: Yes. CREST-mapped severity, working proof-of-exploit per finding, code-level fix guidance, and a regulator-ready PDF accepted across PCI DSS, SOC 2, ISO/IEC 27001, GDPR, CCPA, and CERT-In review cycles.
Q: Do you include a re-test?
A: Yes. Every retail engagement includes a free re-test of the same scope after fixes land. Proof-of-exploit reverts on patch; closure is signed in writing per finding.
---
# Startup Security and Pentest Buyer Guide
https://securelayer7.net/industries/startups
Penetration testing for startups by SecureLayer7. Pre-Series A pricing. SOC 2 / ISO 27001 compliance ready. Self-serve scoping.
Sl7WaptHero
Sl7WaptHero-industries-startups-US
Startup security.
Pentests that clear your
next security review.
The deal in your pipeline asks for SOC 2 Type II and a current pentest report. Your stack is Auth0 or Clerk, Postgres RLS or schema-per-tenant, Stripe Connect, signed webhooks, an admin API your support team uses every day. Our engagements stage tenant isolation drift, signing bypass, and admin-API IDOR as reproducible PoCs. Reports map to SOC 2 CC controls, ISO 27001 Annex A, and the customer security questionnaire your buyer just sent.
Talk to a security expert
/contact-us
security-posture-review
See the startup pentest plan
/penetration-testing-for-startups
Tenant
Auth
Webhook
Admin
ShieldCheck
Tenant boundaries, by hand
Cross-tenant IDOR across record IDs, slugs, integration tokens, search APIs, and Stripe Connect account IDs.
FileSearch
Working proof-of-exploit
Captured Clerk session bypass, Auth0 scope drift, webhook replay traces. Not a checklist score.
RotateCcw
Re-test included
Every finding re-tested after fixes ship. Written closure for SOC 2 Type II and customer-procurement evidence.
STARTUP.
top-right
outline
/media/vertical-tech-b5777943.svg
Four startup SaaS surfaces (tenant partitions, auth, webhooks, admin APIs) converging on a tenant-isolation drift proof-of-exploit at the centre.
IN
Sl7WaptHero
Sl7WaptHero-industries-startups-IN
Startup security.
Pentests for SaaS shipping into India,
from your first enterprise deal on.
Your Indian enterprise buyer reads the same SOC 2 your global customer signs. CERT-In adds 6-hour breach reporting and 180-day log retention. STQC empanelment is what GoI buyers on GeM require. DPDPA 2023 governs how you process Indian users. The stack we exercise: tenant isolation (Postgres RLS, schema isolation), Auth0 or Clerk or Supabase Auth, signed webhooks, admin APIs, Stripe or Razorpay payment surfaces. Reports accepted by SOC 2 Type II, ISO 27001, CERT-In, and DPDPA scoping.
Talk to a security expert
/contact-us
security-posture-review
See the startup pentest plan
/penetration-testing-for-startups
Tenant
Auth
Webhook
Admin
ShieldCheck
Tenant boundaries, by hand
Cross-tenant IDOR across record IDs, slugs, integration tokens, search APIs, and UPI / Razorpay flows.
FileSearch
Working proof-of-exploit
Captured Clerk session bypass, Auth0 scope drift, webhook replay traces. Not a checklist score.
RotateCcw
Re-test included
Every finding re-tested after fixes ship. Written closure for SOC 2, ISO 27001, and DPDPA evidence.
STARTUP.
top-right
outline
/media/vertical-tech-b5777943.svg
Four startup SaaS surfaces (tenant partitions, auth, webhooks, admin APIs) converging on a tenant-isolation drift proof-of-exploit at the centre.
IN
DoorCardRow
DoorCardRow-industries-startups-US
IN
Three ways we test an early-stage SaaS.
Auth, tenant isolation, webhook signing, admin APIs, the AI feature you just shipped. Pick the engagement that fits the gate in front of you.
BugDazz Autonomous
Continuous coverage between SOC 2 Type II cycles. Catches drift on tenant isolation, Clerk or Auth0 scopes, webhook HMAC and timestamp checks, admin APIs. Re-tests every push.
See BugDazz
/products/autonomous-pentest
/media/card-autonomous-v3-bdc95d07.svg
Red team engagement
For the Series B buyer asking, have you ever had a red team test you. MITRE ATT&CK-mapped, no heads-up to your on-call. Output reads like an incident write-up.
Brief a red team
/services/red-team-assessment
/media/card-red-team-v2-76a8d1e6.svg
AI and LLM pentest
Tests the customer-facing copilot you just shipped. Prompt injection, cross-tenant data exfil via retrieval, function-call abuse, system-prompt extraction.
See AI pentest
/services/ai-security-assessment
/media/card-ai-llm-v2-e44ba315.svg
DoorCardRow
DoorCardRow-industries-startups-IN
IN
Three ways we test an Indian SaaS startup.
SOC 2 for your global customers, plus CERT-In 6-hour reporting, 180-day log retention, STQC for GoI buyers, DPDPA 2023 for Indian users. Pick the engagement your auditor and your buyer both accept.
BugDazz Autonomous
Continuous coverage of tenant isolation, Auth0 or Clerk or Supabase Auth scopes, webhook signing, admin APIs. Evidence packs map to CERT-In log-retention and DPDPA breach timelines.
See BugDazz
/products/autonomous-pentest
/media/card-autonomous-v3-bdc95d07.svg
Red team engagement
Adversary emulation against production admin APIs and tenant boundaries. Scoped for RBI-adjacent fintech-SaaS and GoI buyers. Reports cite CERT-In 6-hour reporting paths.
Brief a red team
/services/red-team-assessment
/media/card-red-team-v2-76a8d1e6.svg
AI and LLM pentest
Tests customer copilots and internal agents for prompt injection, cross-tenant data exfil via retrieval, function-call abuse, system-prompt extraction. STQC empanelment maintained for GeM listing.
See AI pentest
/services/ai-security-assessment
/media/card-ai-llm-v2-e44ba315.svg
TrustStrip
TrustStrip-industries-startups
CredentialStrip
CredentialStrip-industries-startups
On record
The accreditations your buyer's security team checks.
CREST sets the standard for offensive execution. CERT-In, SOC 2 Type II, and ISO/IEC 27001 cover how SecureLayer7 handles your tenant data, your customer records, and the audit-evidence trail your buyer asked for.
center
CREST
Accredited company & testers
CERT-In
Empanelled auditor
SOC 2 Type II
Independently audited
ISO/IEC 27001
Information Security Management
Report mapped for
SOC 2 Type II · ISO/IEC 27001 · GDPR · NIST CSF · HIPAA · PCI DSS
AUDITED.
badge-row
dark
TextSection
TextSection-industries-startups
Why a startup pentest is different
Your buyer is asking for evidence,
not a 200-page report.
An enterprise pentest is scoped against committees: AppSec, IR, compliance, a CISO. Yours is scoped against a security questionnaire (CAIQ, SIG Lite), a SOC 2 Type II auditor, and the customer's security team reviewing your trust center on a Thursday afternoon. We scope tight, turn in two to three weeks, and write the report against the artifact your buyer pastes into Drata or Vanta. One platform team gets the findings. The next deal moves.
light
right
PROOF.
Sl7WaptScope
Sl7WaptScope-industries-startups
Scope.
Every surface in a startup stack.
Not just the OWASP top ten.
Eight surfaces we exercise on every startup engagement. Tenant isolation and auth sit at the top; background workers and SSO close the loop.
SCOPE.
Multi-tenant isolation
Postgres RLS bypass, schema isolation drift, cross-tenant IDOR across record IDs, slugs, integration tokens, search APIs.
Auth (Auth0, Clerk, Supabase, custom JWT)
Session bypass, OAuth scope drift, JWT verification gaps, refresh-token replay, social-login account takeover.
Webhook signing (HMAC + timestamp)
Secret leakage, signature wrap, replay-window abuse, Stripe-style timestamp tolerance flaws, event-source spoofing.
Admin APIs and impersonation
Super-admin endpoint reachability, support-impersonation paths to production data, internal-tool allowlist drift.
Customer-facing copilot (LLM + retrieval)
Prompt injection, cross-tenant exfil through RAG, function-call abuse, system-prompt extraction, unsafe tool calls.
Payment integration (Stripe Connect)
Account-ID enumeration, payment-intent tampering, refund-logic abuse, Connect onboarding bypass, webhook race on charge state.
SSO and SCIM (Series B readiness)
SAML signature wrap, OAuth scope drift, SCIM admin-role escalation, JIT-provisioning race for Okta, Azure AD, Google Workspace.
Background workers and queues
Queue poisoning, job-scope drift across tenants, retry-storm abuse, worker-secret exposure, scheduled-job impersonation.
Sl7Overview
Sl7Overview-industries-startups
STAGE GATES.
The gates a pentest clears.
FIRST ENTERPRISE DEAL
SOC 2 Type II
Procurement asks for current pentest evidence. Report maps to CC4 and CC7 controls your auditor reviews.
CUSTOMER REVIEW
CAIQ / SIG Lite
Vendor security questionnaire wants pentest scope, frequency, and remediation evidence. We answer the questions in the report.
SERIES B DILIGENCE
Pentest history
Lead investor's diligence partner asks for two-year pentest history with re-test closure. Free re-test gives you the closure file.
TRUST CENTER
Evidence pack
Drata or Vanta wants an attestation letter plus the redacted report. Both arrive in the engagement closing email.
AI FEATURE LAUNCH
Copilot pentest
Customer asks how you tested the LLM feature. Prompt-injection, retrieval-exfil, and function-call abuse covered in the same engagement.
ISO 27001
Annex A.12.6.1
Technical vulnerability assessment with re-test maps to Annex A.12.6.1. Same report, no second engagement.
Sl7Stat
Sl7Stat-industries-startups
STARTUP ATTACK SURFACE.
7
CHAIN CLASSES WE SEE IN SERIES A AND B SAAS.
What an attacker chains to cross tenants in an early-stage SaaS that shipped fast and audited later.
left
01
Postgres RLS bypass to cross-tenant read
Missing policy on a JSONB column or an unindexed admin query, returning rows from a tenant the request had no right to read.
02
Clerk or Auth0 session reuse to admin takeover
Refresh-token replay, social-login linking, or scope drift granting workspace-admin to a user who signed up an hour ago.
03
Webhook signing bypass to state poisoning
Missing header treated as valid, replay-window left at five minutes, injected events flipping subscription, role, or integration state.
04
Admin API IDOR via support impersonation
Support tool exposed past its allowlist, impersonation endpoint reachable from a customer session, full cross-tenant read.
05
Prompt injection to cross-tenant retrieval exfil
Customer-facing copilot reads from a shared vector index, attacker-supplied content steers retrieval into another tenant's documents.
06
Stripe Connect account-ID enumeration
Sequential account IDs and weak ownership checks let an attacker view or refund charges on a different connected account.
07
Background job poisoning to tenant crossover
Queue payload trusted across tenant context, worker executes a job scoped to the wrong tenant, side effects land in the wrong workspace.
Sl7WaptMethodology
Sl7WaptMethodology-industries-startups
STARTUP METHODOLOGY.
Five phases.
Tight scope, fast turn.
Scoped to your tenant model, your auth provider, and the one customer deal in front of you. Two to three weeks from kick-off to report.
PHASES
timeline
01
Scope against the deal in front of you
Tenant model, auth provider, payment surface, and AI feature inventoried in a 45-minute kick-off. SOW signed inside one business day.
02
Auth and tenant boundary audit
Postgres RLS, schema isolation, Clerk or Auth0 or Supabase scopes, JWT verification, refresh-token replay. Cross-tenant IDOR walked by hand.
03
Webhook, admin API, and integration probe
HMAC signing, replay-window, Stripe Connect ownership checks, super-admin reachability, support-impersonation paths.
04
AI feature and worker review
Prompt injection, cross-tenant retrieval exfil, function-call abuse, queue poisoning, job-scope drift across tenants.
05
Chained finding, report, and free re-test
Findings chained into tenant-crossing paths. CREST severity, mapped to SOC 2 CC and ISO 27001 Annex A. Free re-test after fixes, written closure per finding for your Drata or Vanta evidence file.
RawHtml
RawHtml-methodology-expert-divider
ExpertSpotlight
ExpertSpotlight-industries-startups
Meet our expert
One named lead,
seed to Series C.
John Dill
vCISO at SecureLayer7
Field CISO at SecureLayer7
John scopes startup engagements against the tenant model, the auth provider, and the customer deal driving the timeline. He guides the pod from kick-off through final report and free re-test.
John has scoped pentests for Series A through Series C SaaS that needed evidence in two to three weeks. He carries every finding to proof-of-exploit, with code and audit notes the platform team can act on the same day.
Scopes startup engagements against your tenant model, auth provider, and the customer deal driving the timeline.
Owns kick-off, mid-engagement check-ins, and live walkthrough of every chained finding.
Drives remediation review and free re-test until every tenant-crossing path is closed.
10+
Years in offensive security
300+
Engagements led
99.7%
On-time delivery rate
/media/john-dill-05799aa1.webp
John Dill, vCISO at SecureLayer7
Ready to scope a startup pentest? Book 30 minutes with John to walk through your tenant model, auth stack, and the deal driving the timeline.
Book a 30-min call
/book/john-dill
SL7 Lab. Published CVE research.
/security-advisories
dark
EXPERT.
Faq
Faq-industries-startups
Founder questions
What founders ask
before signing a startup pentest.
Seven questions we hear from founders and technical leads at Series A and Series B SaaS. Answered against our methodology and your auditor.
ANSWERS.
Question not listed here?
Talk to a security expert
security-posture-review
We're 8 engineers. How fast can you turn?
Two to three weeks from kick-off to report on a typical Series A or B scope. SOW signed inside one business day. Re-test runs after your fixes ship, free of charge.
Do you accept our SOC 2 auditor's scope?
Yes. We scope against the same trust-services criteria your auditor reviews. CREST severity maps to SOC 2 CC controls and ISO 27001 Annex A. Customers paste the PDF into Drata or Vanta without revision rounds.
Will the report read for our customer's security team?
Yes. The report carries CREST severity, working proof-of-exploit per finding, and a regulator-ready PDF that the customer's security team accepts without follow-up. Trust-center attestation letter included.
Can you do it remotely and async?
Yes. Kick-off and walkthrough on video, daily updates in a shared channel, mid-engagement check-in at the half-way mark. No on-site requirement.
We just shipped an AI feature. Can you test it in the same engagement?
Yes. Prompt injection, cross-tenant retrieval exfil, function-call abuse, and system-prompt extraction covered alongside the web and API scope. One SOW, one report.
What's your fixed price for a Series A SaaS pentest?
We scope, not price-list. The form takes 90 seconds, the SOW arrives the same day, and the price reflects the actual surfaces you ship (tenant model, auth provider, AI feature, integrations).
Do you sign an NDA?
Yes. Mutual NDA before scoping, signed by SecureLayer7 leadership. We also work against your paper if your customer or counsel requires it.
CtaBanner
CtaBanner-industries-startups
Next security review
Scope a pentest that clears your next security review.
Tenant model, auth provider, payment surface, and the AI feature you just shipped, exercised by a CREST-conducted pod. Report mapped to SOC 2 CC controls, ISO 27001 Annex A, and the customer security questionnaire your buyer just sent. Free re-test after fixes ship.
Talk to a security expert
/contact-us
light
left
security-posture-review
REVIEW.
See the startup pentest plan
/penetration-testing-for-startups
## Q&A
Q: We're 8 engineers. How fast can you turn?
A: Two to three weeks from kick-off to report on a typical Series A or B scope. SOW signed inside one business day. Re-test runs after your fixes ship, free of charge.
Q: Do you accept our SOC 2 auditor's scope?
A: Yes. We scope against the same trust-services criteria your auditor reviews. CREST severity maps to SOC 2 CC controls and ISO 27001 Annex A. Customers paste the PDF into Drata or Vanta without revision rounds.
Q: Will the report read for our customer's security team?
A: Yes. The report carries CREST severity, working proof-of-exploit per finding, and a regulator-ready PDF that the customer's security team accepts without follow-up. Trust-center attestation letter included.
Q: Can you do it remotely and async?
A: Yes. Kick-off and walkthrough on video, daily updates in a shared channel, mid-engagement check-in at the half-way mark. No on-site requirement.
Q: We just shipped an AI feature. Can you test it in the same engagement?
A: Yes. Prompt injection, cross-tenant retrieval exfil, function-call abuse, and system-prompt extraction covered alongside the web and API scope. One SOW, one report.
Q: What's your fixed price for a Series A SaaS pentest?
A: We scope, not price-list. The form takes 90 seconds, the SOW arrives the same day, and the price reflects the actual surfaces you ship (tenant model, auth provider, AI feature, integrations).
Q: Do you sign an NDA?
A: Yes. Mutual NDA before scoping, signed by SecureLayer7 leadership. We also work against your paper if your customer or counsel requires it.
---
# Tech SaaS Security Testing
https://securelayer7.net/industries/tech
SecureLayer7 Tech SaaS security testing across multi-tenant SaaS, dev-tools, and API-first platforms. Named chain classes: cross-tenant IDOR, SAML signature wrap, SCIM role-escalation, webhook signing bypass, audit-log tampering, admin-API exposure, dependency confusion. SOC 2 Type II + ISO 27001 + GDPR ready. CREST-conducted, CERT-In empanelled. Working proof-of-exploit per finding, procurement-ready PDF, free re-test.
Sl7WaptHero
Sl7WaptHero-industries-tech
Tech security.
Pentests for multi-tenant SaaS,
the way your auditor will read them.
Multi-tenant isolation, webhook signing, SCIM provisioning, admin APIs, the surfaces your auditor flags and your customer-procurement teams test in their security review. Our engagements stage isolation drift, signing bypass, and admin-API IDOR as reproducible PoCs. Reports accepted by SOC 2 Type II, ISO 27001, GDPR, and customer-procurement teams.
Talk to a security expert
/contact-us
security-posture-review
See the SaaS attack paths
#methodology
Tenant
Identity
Webhook
Audit
ShieldCheck
Tenant boundaries, by hand
Cross-tenant IDOR across record IDs, slugs, integration tokens, search APIs, and billing meters.
FileSearch
Working proof-of-exploit
Captured SAML wrap, SCIM role-escalation transcripts, webhook replay traces. Not a checklist score.
RotateCcw
Re-test included
Every finding re-tested after fixes ship. Written closure for SOC 2 + ISO 27001 evidence.
SAAS.
top-right
outline
/media/vertical-tech-b5777943.svg
IN
Sl7WaptHero
Sl7WaptHero-industries-tech-IN
Tech security.
Pentests for SaaS shipping into India,
on CERT-In timelines.
Indian buyers and regulators read the same SOC 2 your global auditor signs. CERT-In adds 6-hour breach reporting, 180-day log retention, and STQC asks for proof on GeM-listed SaaS. Our engagements stage multi-tenant isolation drift, webhook-signing bypass, and admin-API IDOR as reproducible PoCs. Reports accepted by SOC 2 Type II, ISO 27001, CERT-In, and DPDPA.
Talk to a security expert
/contact-us
security-posture-review
See the SaaS attack paths
#methodology
Tenant
Identity
Webhook
Admin
ShieldCheck
Tenant boundaries, by hand
Cross-tenant IDOR across record IDs, slugs, integration tokens, search APIs, and billing meters.
FileSearch
Working proof-of-exploit
Captured SAML wrap, SCIM role-escalation transcripts, webhook replay traces. Not a checklist score.
RotateCcw
Re-test included
Every finding re-tested after fixes ship. Written closure for SOC 2 + ISO 27001 evidence.
SAAS.
top-right
outline
/media/vertical-tech-b5777943.svg
IN
Four multi-tenant SaaS surfaces, tenant partitions, identity, webhooks, and admin APIs, converging on a tenant-isolation drift proof-of-exploit at the centre.
DoorCardRow
IN
Three ways we test multi-tenant SaaS.
Tenant isolation, webhook signing, SCIM, admin APIs, customer-facing copilots. Pick the engagement that fits where your product is right now.
BugDazz Autonomous
Runs between SOC 2 cycles against tenant boundaries, OAuth scopes, SCIM flows, webhook HMAC and timestamp checks, and admin APIs. Re-tests every push.
See BugDazz
/products/autonomous-pentest
/media/card-autonomous-v3-bdc95d07.svg
Red team engagement
Adversary emulation against your production admin APIs and customer-tenant boundaries, with no warning to the on-call rotation. Output reads like an incident write-up.
Brief a red team
/services/red-team-assessment
/media/card-red-team-v2-76a8d1e6.svg
AI and LLM pentest
Tests customer copilots and internal agents for prompt injection, cross-tenant data exfil via retrieval, function-call abuse, and system-prompt extraction.
See AI pentest
/services/ai-security-assessment
/media/card-ai-llm-v2-e44ba315.svg
DoorCardRow-2-ek13im
DoorCardRow
IN
Three ways we test Indian SaaS.
SOC 2 plus CERT-In 6-hour reporting, 180-day log retention, STQC for GeM listing, RBI for fintech-SaaS, DPDPA 2023. Pick the engagement your auditor and your buyer both accept.
BugDazz Autonomous
Continuous coverage of tenant isolation, SCIM, webhook signing, and admin APIs between SOC 2 audits. Evidence packs map to CERT-In log-retention and DPDPA breach timelines.
See BugDazz
/products/autonomous-pentest
/media/card-autonomous-v3-bdc95d07.svg
Red team engagement
Adversary emulation against production admin APIs and tenant boundaries, scoped for RBI fintech-SaaS and GoI buyers. Reports cite CERT-In 6-hour reporting paths.
Brief a red team
/services/red-team-assessment
/media/card-red-team-v2-76a8d1e6.svg
AI and LLM pentest
Tests customer copilots and internal agents for prompt injection, cross-tenant data exfil, function-call abuse, and system-prompt extraction. STQC empanelment maintained for GeM listing.
See AI pentest
/services/ai-security-assessment
/media/card-ai-llm-v2-e44ba315.svg
DoorCardRow-3-ftl3z5
TrustStrip
TrustStrip-industries-tech
CredentialStrip
CredentialStrip-industries-tech
On record
The accreditations your procurement team checks.
CREST sets the standard for offensive execution. CERT-In, SOC 2 Type II, and ISO/IEC 27001 cover how SecureLayer7 handles your tenant data, your customer records, and your audit-evidence trail.
center
CREST
Accredited company & testers
CERT-In
Empanelled auditor
SOC 2 Type II
Independently audited
ISO/IEC 27001
Information Security Management
Report mapped for
SOC 2 Type II · ISO/IEC 27001 · GDPR · NIST CSF · HIPAA · PCI DSS
AUDITED.
badge-row
dark
TextSection
TextSection-industries-tech
Why a SOC 2 audit isn't a pentest
A control marked effective
is not a tenant boundary held.
SOC 2 Type II tells your auditor that the control runs. It does not tell anyone whether a paying tenant can read another tenant's data through an admin-API parameter that nobody on your team has touched in six months. SecureLayer7's pentesters chain the surfaces the audit grades green: a webhook signature that fails open on a missing header, a SCIM provisioning race that grants workspace-admin to a deactivated user, an audit-log endpoint that accepts an injected event with the wrong tenant ID. Then we walk the proof your auditor will accept and your team will fix.
light
right
PROOF.
Sl7WaptScope
Sl7WaptScope-industries-tech
Scope
Every SaaS attack surface.
Not just the OWASP top ten.
Six surfaces we exercise on every tech SaaS engagement. Multi-tenant isolation and identity sit at the top; data-export and supply-chain close the loop.
SCOPE.
Multi-tenant isolation
Cross-tenant IDOR across record IDs, slug prediction, integration-token replay, search-API boundary leaks, billing-meter tampering.
OAuth, SSO, SCIM provisioning
SAML signature wrap, OAuth scope drift, SCIM admin-role escalation, JIT-provisioning race across Okta, Azure AD, Google Workspace, Jumpcloud.
Admin API and internal tools
Retool-class admin exposure, super-admin scope creep, internal-API allowlist drift, support-impersonation paths to production data.
Webhook signing and replay
Webhook-secret leakage, signature wrap, replay-window abuse, integration-partner trust boundary, event-source spoofing.
Audit log and SOC 2 evidence
Log tampering, retention bypass, audit-event injection, after-the-fact rewrite, tenant-scoped log exfil.
Data export, rate-limit, supply chain
Bulk-export drift, GDPR subject-access boundary, per-tenant rate-limit bypass, free-tier escape, dependency confusion, secrets-in-history.
Sl7Overview
Sl7Overview-industries-tech
IN SCOPE.
Where we look across a tech SaaS stack.
TENANT
Isolation and IDOR
Record-level, workspace-level, organization-level boundaries probed across IDs, slugs, search APIs, and integration tokens.
IDENTITY
OAuth, SAML, SCIM
Scope drift, signature wrap, role-escalation, JIT race across every supported IDP.
INTEGRATIONS
Webhooks and admin APIs
Signing bypass, replay-window abuse, super-admin scope, internal-tool exposure.
EVIDENCE
Audit log and GDPR
Log integrity, retention, audit-event injection, subject-access boundary, bulk-export drift.
Sl7Stat
Sl7Stat-industries-tech
TECH SAAS ATTACK SURFACE.
8
MULTI-TENANT CHAIN CLASSES.
What an attacker chains to cross tenant boundaries in a modern SaaS stack.
left
01
Cross-tenant IDOR
Record-ID, slug, or integration-token leak across workspaces, exfiltrating another tenant's customer data through the same product API.
02
SAML signature wrap to admin takeover
IDP response re-wrapped to swap the subject, granting workspace-admin or org-owner in a single sign-on flow.
03
SCIM role-escalation to workspace admin
SCIM patch on a deactivated user races provisioning, lands an attacker role inside the target tenant before deprovisioning settles.
04
Webhook signing bypass to state poisoning
Missing signature header treated as valid, replay-window left open, injected events flip billing, role, or integration state.
05
Audit-log tampering to SOC 2 evidence gap
Log retention bypass or audit-event injection rewrites the trail, breaking the evidence chain your auditor needs for CC controls.
06
Admin-API exposure to super-admin access
Internal-tool allowlist drift or support-impersonation endpoint reachable from outside, granting cross-tenant read or write.
07
Dependency confusion to build-pipeline RCE
Namespace squat or registry-priority flip lands attacker code inside CI, with secrets and signing keys reachable from the build runner.
Sl7WaptMethodology
Sl7WaptMethodology-industries-tech
TECH SAAS METHODOLOGY.
Eight phases.
Tenant-aware, evidence-ready.
Threat-modelled to your tenant graph, IDP topology, and integration partners. Not a template we run against every SaaS.
PHASES
timeline
01
Tenant model and boundary mapping
Record-level, workspace-level, and organization-level boundaries documented before any traffic. Integration-token graph and admin-scope inventory captured.
02
OAuth, SCIM, SSO chain audit
Every auth flow, every role, every IDP. Scope drift, signature wrap, SCIM admin-role escalation, JIT race exercised across Okta, Azure AD, Google Workspace, Jumpcloud.
03
Admin-API surface enumeration
Super-admin, support-admin, billing-admin scopes mapped. Internal-tool allowlist tested from outside. Retool-class exposure walked by hand.
04
Webhook signing and replay probe
Secret leakage paths, signature wrap, replay-window abuse, integration-partner trust boundary. Event-source spoofing chained to state poisoning.
05
Audit-log integrity and retention review
Log tampering paths, retention bypass, audit-event injection, tenant-scoped log exfil. Evidence chain mapped to SOC 2 CC controls.
06
Data export and GDPR boundary
Bulk-export drift, subject-access-request boundary, deletion-request bypass, billing-meter tampering. Per-tenant rate-limit and free-tier escape probed.
07
Source code and dependency audit
Secrets-in-history, dependency confusion, namespace squatting, build-pipeline reachability. Supply-chain audit for production registries.
08
Chained finding, report, and free re-test
Findings chained into tenant-crossing paths, scored CREST severity, mapped to SOC 2 CC and ISO 27001 Annex A. Free re-test after fixes ship, written closure per finding.
RawHtml
RawHtml-methodology-expert-divider
ExpertSpotlight
ExpertSpotlight-industries-tech
Meet our expert
One lead who knows
multi-tenant SaaS.
John Dill
vCISO at SecureLayer7
Field CISO at SecureLayer7
John scopes tech SaaS engagements against your tenant model, IDP topology, and integration partners. He guides the pod from kick-off through final report and free re-test.
John maps SaaS engagements against the tenant boundary, the SSO flow, and the webhook signing path your customer-security questionnaires keep asking about. He carries every finding to proof-of-exploit, with code and audit evidence the platform team can act on.
Scopes single-product and multi-product engagements against your real tenant model and IDP topology.
Owns kick-off, mid-engagement check-ins, and live walkthrough of every chained finding.
Drives remediation review and free re-test until every tenant-crossing path is closed.
10+
Years in offensive security
300+
Engagements led
99.7%
On-time delivery rate
/media/john-dill-05799aa1.webp
John Dill, vCISO at SecureLayer7
Ready to scope a SaaS pentest? Book 30 minutes with John to walk through your tenant model, IDP topology, and timeline.
Book a 30-min call
/book/john-dill
SL7 Lab. Published CVE research.
/security-advisories
dark
EXPERT.
Faq
Faq-industries-tech
Common procurement questions
What buyers ask
about SaaS penetration testing.
Six questions procurement and security-review teams send before signing a SaaS pentest SOW. Answered against our methodology and your auditor.
ANSWERS.
Have a procurement question not listed here?
Talk to a security expert
security-posture-review
Do you cover SOC 2 Type II and ISO 27001 readiness?
Yes. CREST severity is mapped to SOC 2 CC controls and ISO 27001 Annex A. Customers ship our PDF directly to procurement and audit teams without revision rounds.
Do you test SCIM and SAML separately?
Yes. SCIM admin-role escalation, JIT-provisioning race, SAML signature wrap, OAuth scope drift across every supported IDP (Okta, Azure AD, Google Workspace, Jumpcloud).
Do you cover multi-tenant isolation?
Yes. Cross-tenant IDOR across record IDs, slug prediction, integration-token replay, search-API boundary leaks, billing-meter tampering. Tested at record, workspace, and organization level.
Do you audit our webhook signing?
Yes. Secret leakage paths, signature wrap, replay-window abuse, integration-partner trust boundary. Event-source spoofing chained to state poisoning where reachable.
Is the report regulator-ready and procurement-ready?
Yes. CREST severity, working proof-of-exploit per finding, regulator-ready PDF for SOC 2 Type II, ISO 27001, and GDPR. Customer-procurement teams accept the PDF without revision rounds.
Do you include a re-test?
Free re-test of the same scope after fixes ship. Written closure per finding for your SOC 2 and ISO 27001 evidence file.
CtaBanner
CtaBanner-industries-tech
Sample engagement report
See what arrives in your inbox.
A pre-vetted sample SaaS pentest report: full tenant-crossing kill chain, working proof-of-exploit traces, SOC 2 CC and ISO 27001 Annex A mapping, and re-test scope. Sent on request after a 5-minute scoping call.
Talk to a security expert
/contact-us
light
left
security-posture-review
REPORT.
Request a SaaS sample finding
sample-download
/illustrations/sample-report.svg
Sample SaaS pentest engagement report cover
## Q&A
Q: Do you cover SOC 2 Type II and ISO 27001 readiness?
A: Yes. CREST severity is mapped to SOC 2 CC controls and ISO 27001 Annex A. Customers ship our PDF directly to procurement and audit teams without revision rounds.
Q: Do you test SCIM and SAML separately?
A: Yes. SCIM admin-role escalation, JIT-provisioning race, SAML signature wrap, OAuth scope drift across every supported IDP (Okta, Azure AD, Google Workspace, Jumpcloud).
Q: Do you cover multi-tenant isolation?
A: Yes. Cross-tenant IDOR across record IDs, slug prediction, integration-token replay, search-API boundary leaks, billing-meter tampering. Tested at record, workspace, and organization level.
Q: Do you audit our webhook signing?
A: Yes. Secret leakage paths, signature wrap, replay-window abuse, integration-partner trust boundary. Event-source spoofing chained to state poisoning where reachable.
Q: Is the report regulator-ready and procurement-ready?
A: Yes. CREST severity, working proof-of-exploit per finding, regulator-ready PDF for SOC 2 Type II, ISO 27001, and GDPR. Customer-procurement teams accept the PDF without revision rounds.
Q: Do you include a re-test?
A: Free re-test of the same scope after fixes ship. Written closure per finding for your SOC 2 and ISO 27001 evidence file.
---
# Learn | SecureLayer7
https://securelayer7.net/learn
A working library of security explainers. Each topic starts with what the failure mode is in plain language, why it matters for your business, and what an attacker actually does. The technical detail follows for readers who want to go deeper.
Sl7QuartzHero
learn-hub-hero
Learn
Security, explained
by the pentesters who break it.
Plain explanations of how attackers compromise modern systems and what to do about it. Written for security leaders and people new to cybersecurity, by the people who do this work for a living.
centered
LearnArticle
learn-topics
Topics
A working library of security explainers. Each topic starts with what the failure mode is in plain language, why it matters for your business, and what an attacker actually does. The technical detail follows for readers who want to go deeper.
2026-06-09
2026-06-09
Shubham Khandare
Delivery Manager, SecureLayer7
https://www.linkedin.com/in/shubham-kandhare-06846732a/
All services
/our-services
pentest
Penetration Testing
The fundamentals. What a pentest is, how it differs from other security activities, the methodology stages, and what a useful report contains.
- [What is Penetration Testing?](/learn/pentest/what-is-penetration-testing)
- [Penetration Test vs Vulnerability Assessment](/learn/pentest/pentest-vs-vulnerability-assessment)
- [Penetration Test vs Bug Bounty](/learn/pentest/pentest-vs-bug-bounty)
- [Penetration Test vs Red Team](/learn/pentest/pentest-vs-red-team)
- [Black Box vs Gray Box vs White Box](/learn/pentest/black-box-vs-gray-box-vs-white-box-pentest)
- [CREST vs CERT-In](/learn/pentest/crest-vs-cert-in)
- [Pentest Methodology Stages](/learn/pentest/pentest-methodology-stages)
- [Pentest Report Formats](/learn/pentest/pentest-report-formats)
[Open the Penetration Testing topics ->](/learn/pentest)
active-directory
Active Directory Security
Active Directory controls who can log in to what across a Windows network, which makes it the prize in almost every enterprise breach. How AD actually gets attacked, from enumeration to full domain control.
- [What is Active Directory?](/learn/active-directory/what-is-active-directory)
- [AD Enumeration and BloodHound](/learn/active-directory/active-directory-enumeration-bloodhound)
- [Kerberoasting](/learn/active-directory/kerberoasting)
- [AS-REP Roasting](/learn/active-directory/as-rep-roasting)
- [NTLM Relay and Pass-the-Hash](/learn/active-directory/ntlm-relay-pass-the-hash)
- [ACL and Delegation Abuse](/learn/active-directory/acl-and-delegation-abuse)
- [AD CS Attacks (ESC1 to ESC8)](/learn/active-directory/ad-cs-esc-attacks)
- [DCSync, Golden and Silver Tickets](/learn/active-directory/dcsync-golden-silver-tickets)
privilege-escalation
Privilege Escalation
How an attacker turns a small foothold into full control of a machine: root on Linux, SYSTEM on Windows. The real paths and how to find them.
- [What is Privilege Escalation?](/learn/privilege-escalation/what-is-privilege-escalation)
- [Linux Privilege Escalation](/learn/privilege-escalation/linux-privilege-escalation)
- [Windows Privilege Escalation](/learn/privilege-escalation/windows-privilege-escalation)
lateral-movement
Lateral Movement and Pivoting
How one compromised machine becomes many: reusing credentials and remote-execution tools to spread across the network, and tunneling through a foothold to reach internal systems.
- [What is Lateral Movement?](/learn/lateral-movement/what-is-lateral-movement)
- [What is Network Pivoting?](/learn/lateral-movement/what-is-network-pivoting)
- [What is PsExec?](/learn/lateral-movement/what-is-psexec)
- [What is SSH tunneling?](/learn/lateral-movement/what-is-ssh-tunneling)
containers
Containers and Kubernetes
How one weak pod becomes a cluster takeover: container escapes, the Docker runtime risks, and the Kubernetes attack surface.
- [What is a Container Escape?](/learn/containers/what-is-a-container-escape)
- [What is Kubernetes Security?](/learn/containers/what-is-kubernetes-security)
- [What is a privileged container?](/learn/containers/what-is-a-privileged-container)
- [What is an exposed kubelet?](/learn/containers/what-is-an-exposed-kubelet)
credential-access
Credential Access and Dumping
How attackers steal the passwords, hashes, and tickets that move them across a network, from memory, registry hives, disk, and the wire.
- [What is Credential Access?](/learn/credential-access/what-is-credential-access)
- [What is Credential Dumping?](/learn/credential-access/what-is-credential-dumping)
- [What is the SAM database?](/learn/credential-access/what-is-the-sam-database)
- [What is LLMNR poisoning?](/learn/credential-access/what-is-llmnr-poisoning)
persistence
Persistence and Backdoors
How attackers keep access after the first compromise, surviving reboots and password resets via registry keys, scheduled tasks, services, web shells, and rogue accounts.
- [What is Persistence?](/learn/persistence/what-is-persistence)
- [What is a Backdoor?](/learn/persistence/what-is-a-backdoor)
- [What is a web shell?](/learn/persistence/what-is-a-web-shell)
- [What is a rootkit?](/learn/persistence/what-is-a-rootkit)
ai-security
AI Security
Attacks against LLM-backed applications: prompt injection, RAG poisoning, jailbreaking, model extraction, agentic-system risks, training poisoning, and the OWASP LLM Top 10 (2025).
- [OWASP LLM Top 10 (2025): Every Risk Explained](/learn/ai-security/owasp-llm-top-10)
- [What is Prompt Injection?](/learn/ai-security/prompt-injection)
- [What is Indirect Prompt Injection?](/learn/ai-security/indirect-prompt-injection)
- [What is LLM Jailbreaking?](/learn/ai-security/llm-jailbreaking)
- [What is RAG Poisoning?](/learn/ai-security/rag-poisoning)
- [What is Model Extraction?](/learn/ai-security/model-extraction)
- [What is Agentic AI Security?](/learn/ai-security/agentic-ai-security)
- [What is Training Data Poisoning?](/learn/ai-security/training-data-poisoning)
- [What is AI Red Teaming?](/learn/ai-security/ai-red-teaming)
- [LLM Output Validation: Defense Patterns That Actually Work](/learn/ai-security/llm-output-validation)
[Open the AI Security topics →](/learn/ai-security)
application-security
Application Security
How web applications get compromised, and the architectural decisions that prevent it. The most common flaw classes still drive most modern breaches.
- [What is SQL Injection?](/learn/application-security/sql-injection)
- [What is Cross-Site Scripting (XSS)?](/learn/application-security/cross-site-scripting)
- [What is Server-Side Request Forgery (SSRF)?](/learn/application-security/ssrf)
- [What is Insecure Direct Object Reference (IDOR)?](/learn/application-security/idor)
- [JWT Security: Common Attacks and Defenses](/learn/application-security/jwt-attacks)
[Open the Application Security topics ->](/learn/application-security)
web-exploitation
Web Exploitation
The server-side flaws that turn a web input into file read, data theft, and remote code execution. The deeper techniques testers reach for once they are past the front door.
- [What is Server-Side Template Injection (SSTI)?](/learn/web-exploitation/what-is-ssti)
- [What is Insecure Deserialization?](/learn/web-exploitation/what-is-insecure-deserialization)
- [What is XXE?](/learn/web-exploitation/what-is-xxe)
- [What is OS Command Injection?](/learn/web-exploitation/what-is-os-command-injection)
- [What are File Upload Vulnerabilities?](/learn/web-exploitation/what-are-file-upload-vulnerabilities)
- [What is HTTP Request Smuggling?](/learn/web-exploitation/what-is-http-request-smuggling)
- [What is LFI and RFI?](/learn/web-exploitation/what-is-lfi-and-rfi)
- [What is NoSQL Injection?](/learn/web-exploitation/what-is-nosql-injection)
[Open the Web Exploitation topics ->](/learn/web-exploitation)
smart-contract-security
Smart Contract Security
On-chain code is public, immutable, and holds real money, so a single bug can be drained in one transaction. How audits work and the web3 vulnerabilities they catch.
- [What is a Smart Contract Audit?](/learn/smart-contract-security/what-is-a-smart-contract-audit)
- [What is a reentrancy attack?](/learn/smart-contract-security/what-is-a-reentrancy-attack)
- [What is a flash loan attack?](/learn/smart-contract-security/what-is-a-flash-loan-attack)
- [What is oracle manipulation?](/learn/smart-contract-security/what-is-oracle-manipulation)
cloud-security
Cloud Security
How cloud environments actually get compromised in 2026: not by zero-days in the cloud provider, but by misconfigured IAM, instance metadata abuse, leaky storage, and pivot paths through Kubernetes.
- [AWS Penetration Testing: Scope and Methodology](/learn/cloud-security/aws-pentest)
- [What is the IMDSv1 Attack?](/learn/cloud-security/imdsv1-attacks)
- [S3 Bucket Misconfigurations](/learn/cloud-security/s3-misconfig)
- [AWS IAM Privilege Escalation](/learn/cloud-security/iam-privesc-aws)
- [What is Kubernetes Penetration Testing?](/learn/cloud-security/k8s-pentesting)
[Open the Cloud Security topics ->](/learn/cloud-security)
api-security
API Security
Modern applications are mostly APIs with a thin user interface on top. The attack surface moved with them.
- [OWASP API Security Top 10 (2023)](/learn/api-security/owasp-api-top-10)
- [What is BOLA?](/learn/api-security/bola)
- [What is Broken Authentication in APIs?](/learn/api-security/broken-authentication)
- [What is GraphQL Penetration Testing?](/learn/api-security/graphql-pentesting)
- [API Rate Limit Bypass](/learn/api-security/rate-limit-bypass)
[Open the API Security topics ->](/learn/api-security)
mobile-security
Mobile App Security
How iOS and Android apps get compromised, what the OWASP mobile standards ask for, and the techniques testers use to get past on-device protections.
- [What is Mobile App Penetration Testing?](/learn/mobile-security/what-is-mobile-app-pentesting)
- [Android vs iOS Pentesting](/learn/mobile-security/android-vs-ios-pentest)
- [What is OWASP MASVS?](/learn/mobile-security/owasp-masvs)
- [What is OWASP MASTG?](/learn/mobile-security/owasp-mstg)
- [What is Frida?](/learn/mobile-security/frida-basics)
- [Certificate Pinning Bypass](/learn/mobile-security/certificate-pinning-bypass)
- [Root and Jailbreak Detection Bypass](/learn/mobile-security/root-jailbreak-detection-bypass)
- [Mobile API Testing](/learn/mobile-security/mobile-api-testing)
[Open the Mobile App Security topics ->](/learn/mobile-security)
OWASP GenAI Security Project
https://genai.owasp.org/
OWASP
MITRE ATT&CK
https://attack.mitre.org/
MITRE
MITRE ATLAS
https://atlas.mitre.org/
MITRE
AI Penetration Testing
/services/ai-security-assessment
Application Security Testing
/services/application-security-testing
Cloud Penetration Testing
/services/cloud-penetration-testing
Smart Contract Audit
/services/smart-contract-audit
CtaBanner
learn-hub-cta
Engage SecureLayer7
Reading is good. Testing is better.
Reading the explainer tells you the failure mode. An engagement tells you whether your system has it. Move from definition to verdict on your specific stack.
Talk to a security expert
30-min scoping call, fixed-price proposal in 48 hours.
See all services
/our-services
security-posture-review
---
# Active Directory Security
https://securelayer7.net/learn/active-directory
A working library of plain-language Active Directory security explainers, ordered the way a real attack unfolds: foundations, enumeration with BloodHound, credential attacks like Kerberoasting and AS-REP Roasting, NTLM relay and Pass-the-Hash, ACL and delegation abuse, AD CS ESC attacks, and the DCSync and Golden Ticket end-game.
Sl7QuartzHero
learn-ad-hero
Active Directory · Learn
Active Directory security,
in plain terms.
Active Directory controls who can log in to what across a Windows network, which makes it the prize in almost every enterprise breach. This section explains, in plain language, how AD actually gets attacked: the enumeration, the credential attacks, the permission abuse, and the end-game techniques that lead to full domain control.
centered
LearnArticle
learn
Topics
Active Directory is the identity backbone of most Windows networks, and the path attackers take through it is well-worn: enumerate the directory, harvest or crack credentials, abuse over-broad permissions, and chain it all up to Domain Admin. This section breaks each step into a plain-language explainer with the real technical names a defender needs to recognise. Start with the foundations, then follow the attack chain.
2026-06-27
2026-06-27
John Dill
Red Team Lead, SecureLayer7
All services
/our-services
topics
Topics
- [What is Active Directory?](/learn/active-directory/what-is-active-directory): domains, Domain Controllers, Kerberos, NTLM, and why AD is the first target.
- [AD Enumeration and BloodHound](/learn/active-directory/active-directory-enumeration-bloodhound): mapping users, permissions, and the shortest path to Domain Admin.
- [Kerberoasting](/learn/active-directory/kerberoasting): cracking service-account passwords from a Kerberos ticket, with no privileges.
- [AS-REP Roasting](/learn/active-directory/as-rep-roasting): cracking accounts that skip Kerberos pre-authentication.
- [NTLM Relay and Pass-the-Hash](/learn/active-directory/ntlm-relay-pass-the-hash): why a stolen hash is as good as a password, and how relay works.
- [ACL and Delegation Abuse](/learn/active-directory/acl-and-delegation-abuse): when GenericAll, WriteDACL, and Kerberos delegation become attack paths.
- [AD CS Attacks (ESC1 to ESC8)](/learn/active-directory/ad-cs-esc-attacks): how certificate misconfigurations lead to Domain Admin and persistence.
- [DCSync, Golden and Silver Tickets](/learn/active-directory/dcsync-golden-silver-tickets): the end-game attacks and total domain compromise.
key-terms
Key terms explained
Plain-language definitions of the names that come up across these attacks. Each page covers what the term is, the attack it enables, and how to defend.
**Kerberos and tickets**
- [What is a Kerberos ticket (TGT and TGS)?](/learn/active-directory/what-is-a-kerberos-ticket)
- [What is the KRBTGT account?](/learn/active-directory/what-is-krbtgt)
- [What is a Service Principal Name (SPN)?](/learn/active-directory/what-is-an-spn)
- [What is a Golden Ticket?](/learn/active-directory/what-is-a-golden-ticket)
- [What is a Silver Ticket?](/learn/active-directory/what-is-a-silver-ticket)
- [What is Pass-the-Ticket?](/learn/active-directory/what-is-pass-the-ticket)
**Credentials and lateral movement**
- [What is LSASS?](/learn/active-directory/what-is-lsass)
- [What is Mimikatz?](/learn/active-directory/what-is-mimikatz)
- [What is Pass-the-Hash?](/learn/active-directory/what-is-pass-the-hash)
- [What is NTDS.dit?](/learn/active-directory/what-is-ntds-dit)
- [What is DS-Replication-Get-Changes?](/learn/active-directory/what-is-ds-replication-get-changes)
**Recon, permissions and delegation**
- [What is BloodHound?](/learn/active-directory/what-is-bloodhound)
- [What is a Domain Controller?](/learn/active-directory/what-is-a-domain-controller)
- [What is RBCD?](/learn/active-directory/what-is-rbcd)
- [What is unconstrained delegation?](/learn/active-directory/what-is-unconstrained-delegation)
- [What is SYSVOL and GPP passwords?](/learn/active-directory/what-is-sysvol-gpp-passwords)
**AD Certificate Services (ESC series)**
- [What is ESC1?](/learn/active-directory/what-is-esc1)
- [What is ESC2?](/learn/active-directory/what-is-esc2)
- [What is ESC3?](/learn/active-directory/what-is-esc3)
- [What is ESC4?](/learn/active-directory/what-is-esc4)
- [What is ESC5?](/learn/active-directory/what-is-esc5)
- [What is ESC6?](/learn/active-directory/what-is-esc6)
- [What is ESC7?](/learn/active-directory/what-is-esc7)
- [What is ESC8?](/learn/active-directory/what-is-esc8)
**Defenses**
- [What is a gMSA?](/learn/active-directory/what-is-a-gmsa)
- [What is LAPS?](/learn/active-directory/what-is-laps)
- [What is Credential Guard?](/learn/active-directory/what-is-credential-guard)
- [What is the Protected Users group?](/learn/active-directory/what-is-protected-users-group)
how-to-read
How to read this section
The articles are ordered the way a real attack unfolds.
- **Foundations** first: what AD is and how Kerberos and NTLM work.
- **Reconnaissance** next: enumeration and BloodHound, the map every attacker draws.
- **Credential attacks**: Kerberoasting, AS-REP Roasting, and the NTLM hash and relay attacks.
- **Permission and trust abuse**: ACL and delegation paths, and AD Certificate Services.
- **The end-game**: DCSync and ticket forgery, which mark full compromise.
Each explainer ends with how a penetration test surfaces that specific weakness in your own environment.
MITRE ATT&CK Enterprise Matrix
https://attack.mitre.org/matrices/enterprise/windows/
MITRE
Microsoft: Best Practices for Securing Active Directory
https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/best-practices-for-securing-active-directory
Microsoft
NIST SP 800-115 Technical Guide to Security Testing
https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-115.pdf
NIST
Learn home
/learn
Penetration Testing
/learn/pentest
All services
/our-services
CtaBanner
learn-ad-cta
Scope an engagement
Test your Active Directory before an attacker does.
We run internal and Active Directory penetration tests that follow the real path from one low-privilege user to Domain Admin, then hand your team a report with reproducible evidence and a fix for every step. Free re-test included.
Talk to a security expert
30-min scoping call, fixed-price proposal in 48 hours.
See all services
/our-services
security-posture-review
## Q&A
Q: What does this Active Directory section cover?
A: It explains how AD gets attacked end to end: enumeration, Kerberoasting, AS-REP Roasting, NTLM relay and Pass-the-Hash, ACL and delegation abuse, AD CS attacks, and DCSync and ticket forgery.
Q: Who is it for?
A: Defenders, IT teams, and anyone scoping an internal or Active Directory penetration test who wants the plain-language version of each technique with the real technical names.
---
# ACL and Delegation Abuse in Active Directory
https://securelayer7.net/learn/active-directory/acl-and-delegation-abuse
Active Directory delegation grants fine-grained rights like password reset and group edit. Attackers chain ACL rights such as GenericAll, WriteDACL and ForceChangePassword, and abuse Kerberos delegation (unconstrained, constrained, resource-based) to impersonate privileged users. These are configuration abuses, not software bugs, so scanners miss them and only graph analysis or a hands-on tester finds the path.
Sl7QuartzHero
hero-acl
Active Directory · Learn
ACL and
delegation abuse.
Most Active Directory takeovers do not exploit a software bug. They abuse permissions that were granted on purpose: the right to reset a password, edit a group, or impersonate a user. Here is how everyday delegation turns into a path to Domain Admin.
centered
LearnArticle
learn
Active Directory · Learn
Active Directory lets administrators delegate fine-grained rights: who can reset whose password, edit which group, or modify which object’s permissions. Attackers abuse these **ACLs (access control lists)** by chaining rights like **GenericAll**, **WriteDACL**, and **ForceChangePassword** into a route to privilege. **Kerberos delegation**, a feature that lets a service act on a user’s behalf, has its own abuses (**unconstrained**, **constrained**, and **resource-based** delegation) that can let an attacker impersonate anyone, including a Domain Admin. None of it is a vulnerability in the classic sense. It is configuration, which is why it hides in plain sight.
2026-06-27
2026-06-27
John Dill
Red Team Lead, SecureLayer7
All services
/our-services
acls
ACL abuse: rights as rungs
Every object in Active Directory has an **ACL** describing who can do what to it. Delegated administration relies on this: the helpdesk can reset passwords, a team lead can manage their group. The problem is that these rights are often broader than intended and accumulate over years.
The rights attackers chain include:
- **GenericAll**: full control of an object, enough to reset its password or take it over.
- **GenericWrite**: write attributes, which enables tricks like adding an SPN to make an account kerberoastable (**targeted Kerberoasting**).
- **WriteDACL**: rewrite the object’s permissions and grant yourself anything.
- **ForceChangePassword**: reset a user’s password without the old one.
- **AddMember**: add yourself or a controlled account to a privileged group.
BloodHound exists precisely to find where these rights connect into a path.
targeted
A worked example: targeted Kerberoasting
Suppose your compromised user has **GenericWrite** over a service account. On its own that looks minor. But you can:
1. Write a fake **SPN** onto that account using your GenericWrite.
2. Now that it has an SPN, **Kerberoast** it: request its ticket and crack the password offline.
3. If the cracked account is privileged, you have escalated.
This is how a single, boring-looking permission becomes a full escalation. The lesson: in AD, the danger is in how rights **combine**, not in any one right alone.
delegation
Kerberos delegation abuse
**Delegation** lets a service act on behalf of a user, for example a web app reaching a database as the logged-in user. Three flavours, three abuses:
- **Unconstrained delegation**: a server with this can capture the **TGT** of any user who connects, then impersonate them anywhere. If you can coerce a Domain Admin or a Domain Controller to connect, you win.
- **Constrained delegation**: limited to specific services, but **S4U** tricks can still let an attacker who controls the account impersonate other users to those services.
- **Resource-based constrained delegation (RBCD)**: configured on the target object via the `msDS-AllowedToActOnBehalfOfOtherIdentity` attribute. If an attacker can write that attribute (often via **GenericWrite** or **WriteDACL**), they can grant a controlled machine the right to impersonate any user to the target, including a Domain Admin.
defense
How to defend
Defence is about pruning and tiering:
- **Audit ACLs regularly** with BloodHound and remove rights that no longer serve a purpose, especially WriteDACL and GenericAll on sensitive objects.
- **Avoid unconstrained delegation** entirely on anything but Domain Controllers, and mark privileged accounts as **"sensitive and cannot be delegated."**
- **Protect the RBCD attribute.** Restrict who can write `msDS-AllowedToActOnBehalfOfOtherIdentity` and watch for changes to it.
- **Tier administration** so that control of a low-value object never chains up to a Tier 0 asset.
Why this hides
Scanners look for missing patches. ACL and delegation abuse use **working, intended features**, so a vulnerability scan returns clean while the path to Domain Admin sits wide open. Only graph analysis or a hands-on tester finds it.
Microsoft: Best Practices for Securing Active Directory
https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/best-practices-for-securing-active-directory
Microsoft
MITRE ATT&CK Enterprise Matrix
https://attack.mitre.org/matrices/enterprise/windows/
MITRE
Microsoft: Active Directory Certificate Services
https://learn.microsoft.com/en-us/windows-server/identity/ad-cs/
Microsoft
Active Directory security topics
/learn/active-directory
AD enumeration and BloodHound
/learn/active-directory/active-directory-enumeration-bloodhound
Kerberoasting
/learn/active-directory/kerberoasting
AD Certificate Services (ESC) attacks
/learn/active-directory/ad-cs-esc-attacks
Penetration Testing
/learn/pentest
All services
/our-services
Faq
faq
Common questions
Active Directory, asked often
left
mono-caps
neutral
q1
What is an ACL in Active Directory?
An access control list defines who can do what to an object: read it, reset its password, edit its group membership, or change its permissions. Delegated administration relies on ACLs, and over-broad ACLs are what attackers abuse.
q2
What is targeted Kerberoasting?
When an attacker holds GenericWrite over an account, they write a Service Principal Name onto it so it becomes kerberoastable, then crack its password offline. It turns a write permission into a full escalation.
q3
What is resource-based constrained delegation abuse?
RBCD is configured by writing the msDS-AllowedToActOnBehalfOfOtherIdentity attribute on a target. If an attacker can write that attribute, they let a controlled machine impersonate any user to the target, including a Domain Admin.
q4
Why do vulnerability scanners miss this?
Because nothing is unpatched or broken. These attacks abuse intended delegation and permission features that are working as designed, so only graph analysis or a hands-on penetration test reveals the path.
q5
How do we find our exposure?
Run BloodHound against your directory and have a tester walk the highest-risk paths. The output is the exact set of ACLs and delegation settings to prune, in priority order.
Need your Active Directory tested?
Talk to a security expert
security-posture-review
CtaBanner
cta-acl
Scope an engagement
Test your Active Directory before an attacker does.
We run internal and Active Directory penetration tests that follow the real path from one low-privilege user to Domain Admin, then hand your team a report with reproducible evidence and a fix for every step. Free re-test included.
Talk to a security expert
30-min scoping call, fixed-price proposal in 48 hours.
See all services
/our-services
security-posture-review
## Q&A
Q: Why do scanners miss ACL and delegation abuse?
A: Because nothing is unpatched. These attacks abuse intended delegation features working as designed, so only graph analysis or a penetration test reveals the path.
Q: What is RBCD abuse?
A: If an attacker can write the msDS-AllowedToActOnBehalfOfOtherIdentity attribute on a target, they let a controlled machine impersonate any user to it, including a Domain Admin.
---
# Active Directory Enumeration and BloodHound
https://securelayer7.net/learn/active-directory/active-directory-enumeration-bloodhound
Enumeration reads Active Directory over LDAP to list users, groups, sessions and permissions, most of it available to any authenticated user. BloodHound turns that data into a graph and computes the shortest path to Domain Admin through abusable rights such as GenericAll, WriteDACL and group membership. Defenders should run it to find and cut those paths.
Sl7QuartzHero
hero-ad-enum
Active Directory · Learn
AD enumeration
and BloodHound.
Before any attack on Active Directory comes enumeration: collecting every user, group, permission, and trust, then turning that pile of data into a map of attack paths. BloodHound is the tool that draws the map. Here is what it sees and why defenders should run it too.
centered
LearnArticle
learn
Active Directory · Learn
Enumeration is the reconnaissance phase of an Active Directory attack: reading the directory to list users, groups, computers, sessions, and permissions, most of which any authenticated user can query over **LDAP**. **BloodHound** ingests that data and renders it as a graph, then finds the shortest path from an account you control to Domain Admin by following abusable rights like **GenericAll**, **WriteDACL**, and group membership. Because the same query that helps an attacker helps a defender, mapping your own graph is one of the highest-value AD security exercises.
2026-06-27
2026-06-27
John Dill
Red Team Lead, SecureLayer7
All services
/our-services
what
What enumeration collects
Active Directory is, by design, readable. Any authenticated account can query the directory over **LDAP** and pull back a large amount of structure:
- **Users and groups**, including who belongs to privileged groups like Domain Admins.
- **Computers**, operating systems, and which ones are Domain Controllers.
- **Sessions**: which users are currently logged in to which machines, which reveals where privileged credentials are exposed.
- **Permissions (ACLs)**: who can reset whose password, modify whose group membership, or edit which object.
- **Trusts** between domains and forests.
Tooling like the PowerShell module **PowerView** and the **SharpHound** collector automate this gathering.
bloodhound
What BloodHound does with it
**BloodHound** takes the collected data and stores it as a graph: nodes are users, groups, and computers; edges are relationships like "is a member of," "can reset the password of," or "has a session on."
The power is the query "shortest path to Domain Admins." Instead of a human eyeballing thousands of permissions, BloodHound highlights the exact chain: *your user* can write to *this group*, which can reset *this admin account*, which is a member of *Domain Admins*. What looked like noise becomes a three-hop route to total control.
edges
The abusable rights to recognise
A handful of permission edges turn up again and again as the rungs of the ladder:
- **GenericAll / GenericWrite**: full or broad control over an object, often enough to reset its password or grab its credentials.
- **WriteDACL**: the right to rewrite an object’s permissions, so you grant yourself whatever access you need.
- **AddMember**: the right to add accounts to a group, including privileged groups.
- **ForceChangePassword**: reset another user’s password without knowing the old one.
Individually these are normal delegated-admin features. Strung together by BloodHound, they are an attack path.
defender
Why defenders run it first
The same map an attacker builds after breaking in, a defender can build any time. Running BloodHound against your own directory surfaces the unintended paths: the helpdesk group that can reset a domain admin, the stale service account everyone forgot had WriteDACL on a sensitive OU.
Fixing the graph means cutting edges, removing a needless permission, emptying an over-privileged group, so the shortest path to Domain Admin gets longer or disappears. That is far more effective than hardening individual machines.
Defender move
Treat BloodHound as a recurring audit, not a one-off. Re-run it after any major directory change and watch whether new short paths to Tier 0 (your Domain Controllers and admin accounts) have appeared.
Microsoft: Best Practices for Securing Active Directory
https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/best-practices-for-securing-active-directory
Microsoft
MITRE ATT&CK Enterprise Matrix
https://attack.mitre.org/matrices/enterprise/windows/
MITRE
NIST SP 800-115 Technical Guide to Security Testing
https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-115.pdf
NIST
Active Directory security topics
/learn/active-directory
What is Active Directory
/learn/active-directory/what-is-active-directory
ACL and delegation abuse
/learn/active-directory/acl-and-delegation-abuse
Kerberoasting
/learn/active-directory/kerberoasting
Penetration Testing
/learn/pentest
All services
/our-services
Faq
faq
Common questions
Active Directory, asked often
left
mono-caps
neutral
q1
Is running BloodHound against my own network safe?
Yes. The default SharpHound collection reads the directory the same way any authenticated user can. It is non-destructive reconnaissance. Treat the resulting data as sensitive, because it is a literal map of how to take over your domain.
q2
What is the difference between BloodHound and PowerView?
PowerView is a PowerShell toolkit for ad-hoc directory queries. BloodHound, fed by the SharpHound collector, stores everything as a graph and computes attack paths automatically. They are complementary.
q3
What does "shortest path to Domain Admin" mean?
It is a graph query that finds the fewest abusable steps from an account you control to membership of a domain-admin-equivalent group. Each step is a permission or relationship an attacker can exploit.
q4
Can attackers do this without admin rights?
Yes. Most enumeration only needs one ordinary authenticated account, which is exactly why it is the first thing an attacker does after gaining any foothold.
q5
How do we reduce what enumeration reveals?
You cannot stop authenticated reads entirely, but you can shrink the attack surface: remove unnecessary ACLs, tier your administrative accounts, limit where privileged users log in, and monitor for mass LDAP collection.
Need your Active Directory tested?
Talk to a security expert
security-posture-review
CtaBanner
cta-ad-enum
Scope an engagement
Test your Active Directory before an attacker does.
We run internal and Active Directory penetration tests that follow the real path from one low-privilege user to Domain Admin, then hand your team a report with reproducible evidence and a fix for every step. Free re-test included.
Talk to a security expert
30-min scoping call, fixed-price proposal in 48 hours.
See all services
/our-services
security-posture-review
## Q&A
Q: Is running BloodHound against my own network safe?
A: Yes. Default collection is non-destructive reconnaissance using normal authenticated reads. Treat the output as sensitive because it maps how to take over your domain.
Q: Can attackers enumerate without admin rights?
A: Yes. Most enumeration needs only one ordinary authenticated account, which is why it is the first post-foothold step.
---
# AD CS Attacks (ESC1 to ESC8)
https://securelayer7.net/learn/active-directory/ad-cs-esc-attacks
Active Directory Certificate Services is the in-house certificate authority on many Windows networks. The ESC1 to ESC8 misconfigurations let a low-privileged user request or forge a certificate that authenticates as a privileged account, taking them to Domain Admin in minutes. Certificates outlive password resets, so the attack is also persistence. Defend by auditing templates with Certipy and disabling NTLM on enrolment endpoints.
Sl7QuartzHero
hero-adcs
Active Directory · Learn
AD CS attacks
(ESC1 to ESC8).
Active Directory Certificate Services issues the certificates that prove identity inside a Windows network. A handful of common misconfigurations, catalogued as ESC1 through ESC8, let an attacker mint a certificate that says they are a Domain Admin. Here is the plain version of the most impactful AD attack class of recent years.
centered
LearnArticle
learn
Active Directory · Learn
**Active Directory Certificate Services (AD CS)** is the in-house certificate authority many Windows networks run to issue certificates for logon, VPN, and more. Security researchers have publicly documented a family of misconfigurations, numbered **ESC1 to ESC8**, where a low-privileged user can request or forge a certificate that authenticates them as a **privileged account**. Because a certificate can be used to get a Kerberos ticket, a single bad template setting can take an attacker from ordinary user to Domain Admin in minutes, often quietly. Tools like **Certipy** automate finding and abusing these paths.
2026-06-27
2026-06-27
John Dill
Red Team Lead, SecureLayer7
All services
/our-services
what
What AD CS is and why it matters
**AD CS** is Microsoft’s certificate authority role. Organisations run it to issue digital certificates that machines and users present to prove who they are, for smart-card logon, VPN, Wi-Fi, web services, and more.
The catch: a certificate that proves identity is, in effect, a credential. If an attacker can convince the certificate authority to issue a certificate that names a **Domain Admin** as the subject, they can then use that certificate to authenticate as that admin. The trust the whole network places in AD CS is exactly what makes its misconfigurations so powerful.
esc
The ESC family, in plain terms
Security researchers documented the misconfiguration classes **ESC1 to ESC8**. A few of the common ones:
- **ESC1**: a certificate template lets a low-privileged user request a certificate **and specify any identity** (subject), so they ask for one as a Domain Admin and get it.
- **ESC2 / ESC3**: overly permissive templates or agent certificates that can be repurposed to enrol on behalf of others.
- **ESC4**: the attacker has **write access to a template** and edits it to become vulnerable, then exploits it.
- **ESC6**: a CA-wide flag that lets requesters specify the subject regardless of template.
- **ESC8**: an **NTLM relay** to the certificate authority’s web enrolment endpoint, often combined with coercing a Domain Controller to authenticate, yielding a DC certificate.
The details differ, but the outcome is the same: a certificate that authenticates as someone privileged.
impact
Why it is so dangerous
AD CS abuse is favoured for three reasons:
- **It often needs only a low-privileged user** to reach Domain Admin in one or two steps.
- **Certificates are long-lived.** A stolen or forged certificate can remain valid for a year or more, surviving the password resets that would otherwise evict an attacker. This makes it a stealthy **persistence** mechanism, not just an escalation.
- **It is under-monitored.** Many teams do not watch certificate enrolment the way they watch logons, so the abuse is quiet.
defense
How to defend
AD CS hardening has become a standard project:
- **Audit every certificate template** for the ESC conditions, especially templates that allow the requester to supply the subject and that permit low-privileged enrolment. **Certipy** and PSPKIAudit can find them.
- **Remove the "supply subject in request" right** where it is not strictly needed, and tighten enrolment permissions.
- **Disable NTLM** on the CA web enrolment endpoints and enforce signing to kill ESC8 relay.
- **Monitor certificate issuance** and treat a certificate request that names a privileged identity as a high-severity alert.
- **Revoke and reissue** if abuse is suspected, since a forged certificate is not cleared by a password reset.
Persistence warning
A certificate attack is not just escalation. Because certificates outlive password changes, an attacker who mints one can quietly return for months. After any AD CS incident, assume issued certificates are compromised and reissue.
Microsoft: Active Directory Certificate Services
https://learn.microsoft.com/en-us/windows-server/identity/ad-cs/
Microsoft
MITRE ATT&CK Enterprise Matrix
https://attack.mitre.org/matrices/enterprise/windows/
MITRE
NIST SP 800-115 Technical Guide to Security Testing
https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-115.pdf
NIST
Active Directory security topics
/learn/active-directory
ACL and delegation abuse
/learn/active-directory/acl-and-delegation-abuse
NTLM relay and Pass-the-Hash
/learn/active-directory/ntlm-relay-pass-the-hash
DCSync and Golden Tickets
/learn/active-directory/dcsync-golden-silver-tickets
Penetration Testing
/learn/pentest
All services
/our-services
Faq
faq
Common questions
Active Directory, asked often
left
mono-caps
neutral
q1
What is AD CS?
Active Directory Certificate Services is the in-house certificate authority a Windows network runs to issue certificates for logon, VPN, and other services. Because certificates prove identity, they function as credentials.
q2
What does ESC1 mean?
ESC1 is a misconfiguration where a certificate template lets a low-privileged user request a certificate and specify any subject identity. They request one as a Domain Admin and use it to authenticate as that admin.
q3
Why are certificate attacks used for persistence?
Certificates are valid for long periods and survive password resets. An attacker who forges or steals one can return for months, even after the compromised password is changed, so reissuing certificates is required to fully evict them.
q4
What tool finds these issues?
Certipy and PSPKIAudit enumerate templates and CA settings and flag the ESC conditions. A penetration test uses them to show which certificate path actually reaches Domain Admin in your environment.
q5
Is AD CS abuse common?
Yes. Since the technique was published, AD CS misconfigurations have become one of the most reliable escalation paths testers and attackers find, because the role is widely deployed and rarely audited for these specific settings.
Need your Active Directory tested?
Talk to a security expert
security-posture-review
CtaBanner
cta-adcs
Scope an engagement
Test your Active Directory before an attacker does.
We run internal and Active Directory penetration tests that follow the real path from one low-privilege user to Domain Admin, then hand your team a report with reproducible evidence and a fix for every step. Free re-test included.
Talk to a security expert
30-min scoping call, fixed-price proposal in 48 hours.
See all services
/our-services
security-posture-review
## Q&A
Q: What does ESC1 mean?
A: A certificate template that lets a low-privileged user request a certificate and specify any subject. They request one as a Domain Admin and authenticate as that admin.
Q: Why are certificate attacks used for persistence?
A: Certificates stay valid for long periods and survive password resets, so an attacker who forges one can return for months until certificates are reissued.
---
# AS-REP Roasting
https://securelayer7.net/learn/active-directory/as-rep-roasting
AS-REP Roasting attacks Active Directory accounts that have Kerberos pre-authentication disabled. The Domain Controller returns an AS-REP encrypted with the account password hash to anyone who asks, so the attacker cracks it offline. Unlike Kerberoasting it can work without valid credentials. The fix is removing the do-not-require-pre-authentication flag.
Sl7QuartzHero
hero-asrep
Active Directory · Learn
AS-REP
Roasting.
AS-REP Roasting targets accounts configured without Kerberos pre-authentication. For those accounts an attacker can pull a crackable hash without even knowing a password first. Here is the simple version of how it works and the one setting that causes it.
centered
LearnArticle
learn
Active Directory · Learn
AS-REP Roasting is an Active Directory attack against accounts that have **Kerberos pre-authentication disabled**. Normally the Domain Controller proves you know the password before issuing a ticket. With pre-auth off, the DC returns a response (the **AS-REP**) encrypted with the account’s password hash to anyone who asks, so the attacker cracks it offline. Unlike Kerberoasting, it can be done **without any valid credentials** if the attacker can guess or list usernames, which makes the "do not require pre-authentication" flag a setting worth hunting down and removing.
2026-06-27
2026-06-27
John Dill
Red Team Lead, SecureLayer7
All services
/our-services
preauth
What pre-authentication is
When you request a Kerberos ticket, the Domain Controller normally insists you first prove you know your password by sending a timestamp encrypted with your password hash. That step is **pre-authentication**, and it stops a stranger from harvesting crackable material for your account.
Some accounts have a flag set, **"Do not require Kerberos pre-authentication."** It exists for old or non-Windows systems that could not perform the step. Any account with that flag is exposed.
how
How the attack works
The mechanics are short:
1. The attacker asks the Domain Controller for a ticket for a target user, skipping pre-authentication.
2. Because pre-auth is not required for that account, the DC replies with an **AS-REP** that contains data encrypted with the user’s password hash.
3. The attacker takes that offline and cracks it, just like Kerberoasting.
Impacket’s **GetNPUsers** and **Rubeus** can both find vulnerable accounts and pull the hashes. If the attacker has no credentials yet, they can still try a list of likely usernames, since the request itself needs no login.
vs-kerb
How it differs from Kerberoasting
The two are cousins, and people mix them up:
- **Kerberoasting** targets accounts with an **SPN** (service accounts) and needs **one valid domain account** to request the tickets.
- **AS-REP Roasting** targets accounts with **pre-auth disabled** (often regular users) and can be attempted with **no credentials at all** if usernames are known or guessable.
Both end the same way: an offline crack of a password hash. Both are defeated by strong passwords, but the misconfiguration that enables AS-REP Roasting is unique to it.
defense
How to defend against it
The fix is direct:
- **Audit for the flag.** Find every account with "Do not require Kerberos pre-authentication" set and remove it unless a documented legacy system truly needs it.
- **Strong passwords** on any account that must keep the flag, so an offline crack fails.
- **Tier your accounts** so that even a cracked legacy account is not also a privileged one.
- **Monitor** for AS-REP requests for accounts that do not require pre-auth, which are abnormal in a healthy domain.
The setting to hunt
Search your directory for the `DONT_REQUIRE_PREAUTH` flag. In most environments it is set on a handful of forgotten accounts, and clearing it removes the attack outright.
Microsoft: Kerberos Authentication Overview
https://learn.microsoft.com/en-us/windows-server/security/kerberos/kerberos-authentication-overview
Microsoft
MITRE ATT&CK Enterprise Matrix
https://attack.mitre.org/matrices/enterprise/windows/
MITRE
NIST SP 800-115 Technical Guide to Security Testing
https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-115.pdf
NIST
Active Directory security topics
/learn/active-directory
Kerberoasting
/learn/active-directory/kerberoasting
What is Active Directory
/learn/active-directory/what-is-active-directory
NTLM relay and Pass-the-Hash
/learn/active-directory/ntlm-relay-pass-the-hash
Penetration Testing
/learn/pentest
All services
/our-services
Faq
faq
Common questions
Active Directory, asked often
left
mono-caps
neutral
q1
What is Kerberos pre-authentication?
It is the step where you prove you know your password, by sending an encrypted timestamp, before the Domain Controller issues a ticket. It stops strangers from harvesting crackable data for an account.
q2
Can AS-REP Roasting really work with no credentials?
Yes, if the attacker can list or guess valid usernames. The request that pulls the crackable AS-REP does not require the attacker to be logged in, which is the key difference from Kerberoasting.
q3
How is this different from Kerberoasting?
Kerberoasting targets service accounts that have an SPN and needs one valid domain account. AS-REP Roasting targets accounts with pre-authentication disabled and can be attempted without any credentials.
q4
Why would pre-authentication ever be disabled?
It was a compatibility option for older or non-Windows Kerberos clients that could not perform the step. Today it is almost always a leftover misconfiguration rather than a real requirement.
q5
How do we find exposed accounts?
An internal penetration test or directory audit lists every account with the do-not-require-pre-authentication flag, the exact set an attacker would roast. Clearing the flag where it is not needed removes the risk.
Need your Active Directory tested?
Talk to a security expert
security-posture-review
CtaBanner
cta-asrep
Scope an engagement
Test your Active Directory before an attacker does.
We run internal and Active Directory penetration tests that follow the real path from one low-privilege user to Domain Admin, then hand your team a report with reproducible evidence and a fix for every step. Free re-test included.
Talk to a security expert
30-min scoping call, fixed-price proposal in 48 hours.
See all services
/our-services
security-posture-review
## Q&A
Q: Can AS-REP Roasting work with no credentials?
A: Yes, if the attacker can list or guess valid usernames. The request that pulls the crackable AS-REP does not require being logged in.
Q: How is it different from Kerberoasting?
A: Kerberoasting targets SPN service accounts and needs one valid account. AS-REP Roasting targets accounts with pre-auth disabled and can run without credentials.
---
# DCSync, Golden Tickets and Silver Tickets
https://securelayer7.net/learn/active-directory/dcsync-golden-silver-tickets
DCSync abuses Domain Controller replication rights to make a real DC hand over any password hash, including KRBTGT. With the KRBTGT hash an attacker forges a Golden Ticket, a self-made TGT granting access as anyone for years. A Silver Ticket forges one service ticket using that service account hash. These mark full domain compromise, and recovery requires resetting KRBTGT twice.
Sl7QuartzHero
hero-dcsync
Active Directory · Learn
DCSync, Golden
and Silver tickets.
These are the end-game attacks. DCSync steals every password hash in the domain by pretending to be a Domain Controller. A Golden Ticket forges Kerberos tickets at will. Together they represent total, durable control of Active Directory. Here is what each one means in plain language.
centered
LearnArticle
learn
Active Directory · Learn
These three techniques mark **full domain compromise**. **DCSync** abuses the replication right that Domain Controllers use to sync with each other: an attacker who holds it asks a real DC to hand over any account’s password hash, including the **KRBTGT** account that signs all Kerberos tickets. With the KRBTGT hash, an attacker forges a **Golden Ticket**, a self-made TGT that grants access as anyone, to anything, for as long as they like. A **Silver Ticket** is the narrower version: a forged service ticket for one specific service, using that service account’s hash. They are detection-evasive and persistent, which is why reaching this stage means a domain rebuild, not just a password reset.
2026-06-27
2026-06-27
John Dill
Red Team Lead, SecureLayer7
All services
/our-services
dcsync
DCSync: stealing every hash without touching a DC
Domain Controllers keep each other in sync by **replicating** directory data, including password hashes, between themselves. That replication is a legitimate, built-in privilege.
**DCSync** abuses it. An attacker who has gained the replication rights (**DS-Replication-Get-Changes** and its "All" variant), which certain privileged groups and accounts hold, simply **asks a real Domain Controller to replicate** an account’s secrets to them. The DC complies, because the request looks like normal DC-to-DC traffic. No malware on the DC, no database theft, just a protocol request that returns the hash of any account the attacker names, up to and including every Domain Admin and the all-important **KRBTGT** account. Mimikatz and **secretsdump** perform it in one command.
golden
Golden Tickets: forging trust itself
Every Kerberos **TGT** is signed with the password hash of one special account, **KRBTGT**. The whole domain trusts anything signed with that key.
Once an attacker has the **KRBTGT hash** (usually via DCSync), they can **forge their own TGT**, a **Golden Ticket**, that claims to be any user, in any group, including Domain Admins. The Domain Controllers accept it because it is signed with the key they trust. A Golden Ticket can grant access to everything, can be made valid for years, and survives the compromised user changing their password, because it does not depend on that user’s password at all. It is the ultimate persistence.
silver
Silver Tickets: the quieter cousin
A **Silver Ticket** is more surgical. Instead of forging a TGT signed by KRBTGT, the attacker forges a **service ticket (TGS)** for one specific service, signed with **that service account’s hash**.
The trade-off: a Silver Ticket only opens one service (say, a specific file server or database), but it is **quieter**, because it never contacts the Domain Controller to request the ticket. For a targeted, low-noise foothold on a particular system, it is the preferred forgery.
response
Why this means rebuild, and how to delay it
Reaching DCSync and Golden Tickets is **full compromise**. Because a Golden Ticket is independent of normal passwords, the only complete remediation is to **reset the KRBTGT account password twice** (to invalidate forged tickets) and, in serious cases, rebuild trust from clean ground.
To make attackers’ lives harder before that point:
- **Restrict replication rights.** Audit who holds DS-Replication-Get-Changes-All; it should be almost no one.
- **Protect Tier 0.** Domain Admin credentials should never land on ordinary machines where they can be dumped to enable DCSync in the first place.
- **Rotate KRBTGT regularly** so any unknown Golden Ticket has a shorter shelf life.
- **Monitor for replication requests** from anything that is not a Domain Controller, which is a strong DCSync signal.
The hard truth
Everything earlier in this section, Kerberoasting, relay, ACL abuse, AD CS, exists to **reach this stage**. The defensive goal is to make the chain to DCSync long and loud, because once an attacker is here, recovery means a KRBTGT double-reset and often a domain rebuild.
MITRE ATT&CK Enterprise Matrix
https://attack.mitre.org/matrices/enterprise/windows/
MITRE
Microsoft: Kerberos Authentication Overview
https://learn.microsoft.com/en-us/windows-server/security/kerberos/kerberos-authentication-overview
Microsoft
NIST SP 800-115 Technical Guide to Security Testing
https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-115.pdf
NIST
Active Directory security topics
/learn/active-directory
NTLM relay and Pass-the-Hash
/learn/active-directory/ntlm-relay-pass-the-hash
AD enumeration and BloodHound
/learn/active-directory/active-directory-enumeration-bloodhound
What is Active Directory
/learn/active-directory/what-is-active-directory
Penetration Testing
/learn/pentest
All services
/our-services
Faq
faq
Common questions
Active Directory, asked often
left
mono-caps
neutral
q1
What is DCSync?
DCSync abuses the replication right that Domain Controllers use to sync with each other. An attacker holding that right asks a real DC to hand over any account’s password hash, including KRBTGT, without running anything on the DC itself.
q2
What is a Golden Ticket?
A forged Kerberos TGT signed with the KRBTGT account’s hash. Because the domain trusts anything signed with that key, the attacker can impersonate any user in any group, for years, independent of password changes.
q3
How is a Silver Ticket different?
A Silver Ticket is a forged service ticket for one specific service, signed with that service account’s hash. It is narrower than a Golden Ticket but quieter, because it never contacts the Domain Controller.
q4
How do you recover from a Golden Ticket?
Because forged tickets do not depend on a user’s password, you must reset the KRBTGT account password twice to invalidate them, and in serious compromises rebuild domain trust from clean ground.
q5
Can this be detected?
Partly. Replication requests from a host that is not a Domain Controller are a strong DCSync signal, and ticket anomalies can flag forgeries. But the most reliable defence is preventing attackers from reaching the credentials that make these attacks possible.
Need your Active Directory tested?
Talk to a security expert
security-posture-review
CtaBanner
cta-dcsync
Scope an engagement
Test your Active Directory before an attacker does.
We run internal and Active Directory penetration tests that follow the real path from one low-privilege user to Domain Admin, then hand your team a report with reproducible evidence and a fix for every step. Free re-test included.
Talk to a security expert
30-min scoping call, fixed-price proposal in 48 hours.
See all services
/our-services
security-posture-review
## Q&A
Q: What is a Golden Ticket?
A: A forged Kerberos TGT signed with the KRBTGT hash. The domain trusts it, so the attacker impersonates any user for years, independent of password changes.
Q: How do you recover from a Golden Ticket?
A: Reset the KRBTGT account password twice to invalidate forged tickets, and in serious cases rebuild domain trust from clean ground.
---
# Kerberoasting Explained
https://securelayer7.net/learn/active-directory/kerberoasting
Kerberoasting is an Active Directory attack where any authenticated user requests a Kerberos service ticket for an account with a Service Principal Name. The ticket is encrypted with the service account password hash, so the attacker cracks it offline with Hashcat. It needs no privileges and is near-silent. Defend with Group Managed Service Accounts and long passphrases.
Sl7QuartzHero
hero-kerb
Active Directory · Learn
Kerberoasting
explained simply.
Kerberoasting lets any ordinary domain user request an encrypted ticket for a service account and then crack its password offline, with no special privileges and almost no noise. Here is how the attack works and why weak service-account passwords make it so dangerous.
centered
LearnArticle
learn
Active Directory · Learn
Kerberoasting is an Active Directory attack where a normal authenticated user requests a Kerberos **service ticket (TGS)** for any account that has a **Service Principal Name (SPN)**. Part of that ticket is encrypted with the service account’s password hash, so the attacker takes it offline and brute-forces the password with tools like **Hashcat**. It needs no elevated rights and triggers no failed-logon alarms, which is why service accounts with weak, non-expiring passwords are one of the most reliable footholds toward Domain Admin.
2026-06-27
2026-06-27
John Dill
Red Team Lead, SecureLayer7
All services
/our-services
how
How the attack works
Kerberos was built so that the ticket for a service is encrypted with that **service account’s password**. That design detail is the whole vulnerability.
1. Any authenticated user asks the Domain Controller for a service ticket (**TGS**) for a target service, identified by its **SPN**. The DC hands it over because requesting tickets is a normal, allowed action.
2. Part of the returned ticket is encrypted with the service account’s NTLM hash, often using the weak **RC4** algorithm.
3. The attacker takes the ticket offline and runs a password-cracking tool against it. If the service account’s password is guessable, it falls.
Tools such as **Rubeus** and Impacket’s **GetUserSPNs** automate the request, and **Hashcat** does the cracking, entirely off the network.
why-works
Why it is so effective
Three things make Kerberoasting a favourite:
- **No privileges required.** Any single domain account can request the tickets. One phished user is enough.
- **It is quiet.** The ticket request is normal Kerberos traffic and the cracking happens offline, so there are no failed logons or lockouts to alert on.
- **Service accounts are weak.** They often have passwords set years ago by a human, never rotated, and the account is frequently a member of a privileged group so it can do its job. A cracked service-account password can hand over high privileges directly.
targets
What attackers look for
Not every SPN is worth cracking. Attackers prioritise:
- Accounts that are **members of privileged groups** (a kerberoastable Domain Admin is the jackpot).
- Accounts with **old passwords** (the `pwdLastSet` date gives it away).
- Accounts that still accept **RC4** encryption, which cracks far faster than AES.
BloodHound flags kerberoastable accounts and shows which ones have a path to high privilege, so the attacker spends cracking time only where it pays.
defense
How to defend against it
You cannot turn Kerberos off, but you can make Kerberoasting fail:
- **Use Group Managed Service Accounts (gMSAs)**, where Windows manages a long, random, auto-rotating password no human can guess.
- For any remaining service account, set a **long passphrase (25+ characters)** so offline cracking is infeasible.
- **Do not put service accounts in Domain Admins.** Grant the minimum rights the service needs.
- **Disable RC4** for Kerberos where you can, forcing the stronger AES encryption.
- **Monitor** for a single account requesting many service tickets in a short window.
The one-line fix
Move service accounts to **gMSAs**. A machine-managed 120-character password that rotates automatically removes the entire offline-cracking step, no matter how many tickets an attacker pulls.
Microsoft: Kerberos Authentication Overview
https://learn.microsoft.com/en-us/windows-server/security/kerberos/kerberos-authentication-overview
Microsoft
MITRE ATT&CK Enterprise Matrix
https://attack.mitre.org/matrices/enterprise/windows/
MITRE
NIST SP 800-115 Technical Guide to Security Testing
https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-115.pdf
NIST
Active Directory security topics
/learn/active-directory
AS-REP Roasting
/learn/active-directory/as-rep-roasting
AD enumeration and BloodHound
/learn/active-directory/active-directory-enumeration-bloodhound
DCSync and Golden Tickets
/learn/active-directory/dcsync-golden-silver-tickets
Penetration Testing
/learn/pentest
All services
/our-services
Faq
faq
Common questions
Active Directory, asked often
left
mono-caps
neutral
q1
Does Kerberoasting need admin rights?
No. Any single authenticated domain user can request service tickets and attempt to crack them. That is exactly what makes it so dangerous: one ordinary compromised account is enough to start.
q2
Why is the password cracked offline?
The service ticket is encrypted with the service account’s password hash. Once an attacker holds the ticket, they crack it on their own hardware with no further contact with your network, so lockout policies and logon alerts never fire.
q3
What is a Service Principal Name (SPN)?
An SPN is a unique identifier that links a service (such as a database or web service) to the account running it. Only accounts with an SPN can be Kerberoasted, which is usually service accounts, not normal users.
q4
Will a long password really stop it?
Yes. Kerberoasting relies on cracking. A random 25-plus character passphrase, or a Group Managed Service Account with a 120-character auto-rotated password, makes offline cracking infeasible.
q5
How would we know if we are exposed?
An internal penetration test or a BloodHound scan lists every kerberoastable account, flags which have weak or old passwords, and shows which ones reach privileged access. That is the exposure attackers would exploit.
Need your Active Directory tested?
Talk to a security expert
security-posture-review
CtaBanner
cta-kerb
Scope an engagement
Test your Active Directory before an attacker does.
We run internal and Active Directory penetration tests that follow the real path from one low-privilege user to Domain Admin, then hand your team a report with reproducible evidence and a fix for every step. Free re-test included.
Talk to a security expert
30-min scoping call, fixed-price proposal in 48 hours.
See all services
/our-services
security-posture-review
## Q&A
Q: Does Kerberoasting need admin rights?
A: No. Any single authenticated domain user can request service tickets and crack them offline, which is what makes it so dangerous.
Q: Will a long password stop it?
A: Yes. A random 25-plus character passphrase, or a gMSA with an auto-rotated 120-character password, makes offline cracking infeasible.
---
# NTLM Relay and Pass-the-Hash
https://securelayer7.net/learn/active-directory/ntlm-relay-pass-the-hash
NTLM is the legacy Windows authentication protocol with two abuse classes. Pass-the-Hash reuses a stolen NTLM hash to log in as a user without cracking the password. NTLM relay forwards a victim’s live authentication to another server. Both drive lateral movement to Domain Admin and are defended with SMB signing, removing NTLM, Credential Guard and LAPS.
Sl7QuartzHero
hero-ntlm
Active Directory · Learn
NTLM relay
and Pass-the-Hash.
In Active Directory you often do not need to crack a password at all. The NTLM protocol lets an attacker reuse a stolen password hash directly, or relay a victim’s authentication to another server in real time. Here is the plain version of both, and why NTLM is on every defender’s deprecation list.
centered
LearnArticle
learn
Active Directory · Learn
NTLM is the legacy Windows authentication protocol, and it has two abuse classes. In **Pass-the-Hash**, an attacker who has stolen a user’s **NTLM hash** authenticates as that user without ever knowing or cracking the plaintext, because NTLM treats the hash as the secret. In **NTLM relay**, the attacker sits in the middle, captures a victim machine’s authentication, and forwards it to another server to act as that victim, often without touching a password at all. Both are why Microsoft is steadily disabling NTLM and why **SMB signing** and removing NTLM are core AD hardening steps.
2026-06-27
2026-06-27
John Dill
Red Team Lead, SecureLayer7
All services
/our-services
pth
Pass-the-Hash, in one idea
When Windows authenticates with NTLM, the actual secret on the wire is derived from the **NTLM hash** of the password, not the password text. So if an attacker steals that hash, by dumping it from the **LSASS** process in memory or from the **NTDS.dit** database on a Domain Controller, they can present it directly and log in as that user.
No cracking required. The hash **is** the credential. Tools like **Mimikatz** and Impacket’s **secretsdump** and **wmiexec** make this routine. This is why a single admin who logs in to a compromised workstation can hand an attacker the keys to everything: their hash is now sitting in that machine’s memory.
lateral
How it drives lateral movement
Pass-the-Hash is the engine of **lateral movement**. The pattern is:
1. Compromise one machine and dump the hashes of everyone logged in to it.
2. Reuse a hash to authenticate to the next machine where that account has access.
3. Dump that machine’s memory for fresh, more privileged hashes.
4. Repeat until a Domain Admin’s hash appears.
The problem is amplified by **password reuse**: a single local administrator password shared across hundreds of machines means one stolen hash unlocks all of them.
relay
NTLM relay, in one idea
NTLM relay does not even require stealing a stored hash. The attacker tricks or waits for a victim machine to authenticate to a server the attacker controls, then **forwards** that authentication, live, to a different target server.
The target sees a valid NTLM authentication and grants access as the victim. Tools like **ntlmrelayx** automate it. Relay is especially dangerous against services that do not enforce **signing**, and it has powered serious chains when combined with coercion tricks that force a Domain Controller to authenticate to the attacker.
defense
How to defend against both
These attacks share defences:
- **Enable SMB signing** and channel binding so relayed authentication is rejected.
- **Disable NTLM** where you can and move to Kerberos, then audit for remaining NTLM use.
- **Use the Protected Users group** and **Credential Guard** so privileged hashes are not left in memory to steal.
- **Use LAPS** to give every machine a unique local administrator password, killing hash reuse across the estate.
- **Limit where Domain Admins log in.** A privileged hash that never lands on an ordinary workstation cannot be dumped from one.
The reuse killer
Deploy **LAPS** (Local Administrator Password Solution). Unique, rotating local-admin passwords mean a hash stolen from one machine no longer unlocks the next, which breaks the lateral-movement chain at its most common rung.
MITRE ATT&CK Enterprise Matrix
https://attack.mitre.org/matrices/enterprise/windows/
MITRE
Microsoft: Kerberos Authentication Overview
https://learn.microsoft.com/en-us/windows-server/security/kerberos/kerberos-authentication-overview
Microsoft
NIST SP 800-115 Technical Guide to Security Testing
https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-115.pdf
NIST
Active Directory security topics
/learn/active-directory
DCSync and Golden Tickets
/learn/active-directory/dcsync-golden-silver-tickets
ACL and delegation abuse
/learn/active-directory/acl-and-delegation-abuse
AD enumeration and BloodHound
/learn/active-directory/active-directory-enumeration-bloodhound
Penetration Testing
/learn/pentest
All services
/our-services
Faq
faq
Common questions
Active Directory, asked often
left
mono-caps
neutral
q1
What is Pass-the-Hash?
It is authenticating as a user with their stolen NTLM password hash, without ever knowing or cracking the plaintext password. NTLM treats the hash itself as the secret, so the hash is enough to log in.
q2
Where do attackers get the hashes?
Most often from the LSASS process in a compromised machine’s memory, where Windows caches credentials of logged-in users, or from the NTDS.dit database once a Domain Controller is reached.
q3
What is NTLM relay?
An attacker captures a victim machine’s NTLM authentication and forwards it live to another server, acting as the victim. It often needs no stored hash and is defeated by SMB signing and removing NTLM.
q4
Does this affect Kerberos too?
Pass-the-Hash and relay are NTLM problems. Kerberos has its own analogues, such as Pass-the-Ticket, but moving from NTLM to properly configured Kerberos with signing removes a large class of these attacks.
q5
What single change helps most?
Deploying LAPS so every machine has a unique local administrator password. It breaks the password reuse that lets one stolen hash unlock many machines, which is the core of lateral movement.
Need your Active Directory tested?
Talk to a security expert
security-posture-review
CtaBanner
cta-ntlm
Scope an engagement
Test your Active Directory before an attacker does.
We run internal and Active Directory penetration tests that follow the real path from one low-privilege user to Domain Admin, then hand your team a report with reproducible evidence and a fix for every step. Free re-test included.
Talk to a security expert
30-min scoping call, fixed-price proposal in 48 hours.
See all services
/our-services
security-posture-review
## Q&A
Q: What is Pass-the-Hash?
A: Authenticating with a stolen NTLM hash without knowing the plaintext password. NTLM treats the hash as the secret, so it is enough to log in.
Q: What single change helps most?
A: Deploying LAPS so every machine has a unique local-admin password, breaking the password reuse that powers lateral movement.
---
# What is a Domain Controller?
https://securelayer7.net/learn/active-directory/what-is-a-domain-controller
A Domain Controller is a Windows server running Active Directory Domain Services. It authenticates every logon via Kerberos and NTLM, stores the directory database (NTDS.dit) with every account password hash, and enforces policy. Because it holds the hashes of Domain Admins and KRBTGT, compromising a DC compromises the domain, making it the top Tier 0 asset to protect.
Sl7QuartzHero
hero-what-is-a-domain-controller
Active Directory · Term
What is a
Domain Controller?
A Domain Controller is the server that runs Active Directory, authenticates every logon, and holds every account’s password hash. Compromise one and you compromise the domain. Here is what a Domain Controller is and why it is the prize.
centered
LearnArticle
learn
Active Directory · Term
A Domain Controller (DC) is a Windows server running **Active Directory Domain Services**. It stores the directory database (**NTDS.dit**), authenticates every logon using **Kerberos and NTLM**, and enforces security policy across the domain. Because it holds the password hash of every account, including Domain Admins and **KRBTGT**, compromising a Domain Controller is equivalent to compromising the entire domain, which is why DCs are the top-priority **Tier 0** asset to protect.
2026-06-27
2026-06-27
John Dill
Red Team Lead, SecureLayer7
All services
/our-services
what
What a Domain Controller is
A **Domain Controller** is the server that *is* Active Directory for a domain. Its jobs:
- **Authenticate logons** as the Kerberos **Key Distribution Center** and via NTLM.
- **Hold the directory database**, `NTDS.dit`, which contains every user, computer, group, and their password hashes.
- **Replicate** with other DCs to keep them in sync.
- **Enforce policy** through Group Policy and the SYSVOL share.
Most domains run several DCs for resilience. Each one is a full copy of the kingdom’s keys.
attack
Why it is the prize
Reaching a Domain Controller, or Domain Admin rights over it, is the goal of nearly every Active Directory attack:
- It enables **DCSync** to pull every hash including KRBTGT (`secretsdump.py -just-dc ...`).
- It exposes **NTDS.dit** for a full credential dump.
- It allows pushing code, including ransomware, to every domain-joined machine.
The whole attack chain in this section, enumeration, Kerberoasting, relay, ACL and AD CS abuse, exists to reach this single class of server.
Tier 0
Domain Controllers, plus the accounts and systems that can control them, are **Tier 0**. They should be administered only from equally trusted systems, never from an ordinary workstation.
defend
How to protect Domain Controllers
- **Apply tiered administration.** Only Tier 0 admins touch DCs, and only from clean, trusted systems.
- **Keep Domain Admin credentials off lower-tier machines** so attackers cannot pivot up.
- **Patch DCs promptly** and minimise installed roles and software on them.
- **Monitor for DCSync replication** from non-DC sources and for shadow-copy or backup access.
- **Protect DC backups**, which contain NTDS.dit.
MITRE ATT&CK Enterprise Matrix
https://attack.mitre.org/matrices/enterprise/windows/
MITRE
Microsoft: Kerberos Authentication Overview
https://learn.microsoft.com/en-us/windows-server/security/kerberos/kerberos-authentication-overview
Microsoft
NIST SP 800-115 Technical Guide to Security Testing
https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-115.pdf
NIST
Active Directory security topics
/learn/active-directory
What is Active Directory
/learn/active-directory/what-is-active-directory
What is NTDS.dit
/learn/active-directory/what-is-ntds-dit
DCSync, Golden and Silver Tickets
/learn/active-directory/dcsync-golden-silver-tickets
All services
/our-services
Faq
faq
Common questions
Active Directory, asked often
left
mono-caps
neutral
q1
What does a Domain Controller do?
It runs Active Directory Domain Services: authenticating logons via Kerberos and NTLM, holding the directory database and password hashes, replicating with other DCs, and enforcing policy.
q2
Why is compromising a Domain Controller so serious?
It holds the password hash of every account in the domain, including Domain Admins and KRBTGT, so controlling it is equivalent to controlling the whole domain.
q3
What is Tier 0?
Tier 0 is the set of assets that can control identity, including Domain Controllers and the accounts and systems that manage them. They must be administered only from equally trusted systems.
q4
How many Domain Controllers does a domain have?
Usually several, for resilience and load. Each is a full replica of the directory, so every one must be protected to the same Tier 0 standard.
Need your Active Directory tested?
Talk to a security expert
security-posture-review
CtaBanner
cta-what-is-a-domain-controller
Scope an engagement
Test your Active Directory before an attacker does.
We run internal and Active Directory penetration tests that follow the real path from one low-privilege user to Domain Admin, then hand your team a report with reproducible evidence and a fix for every step. Free re-test included.
Talk to a security expert
30-min scoping call, fixed-price proposal in 48 hours.
See all services
/our-services
security-posture-review
## Q&A
Q: Why is compromising a Domain Controller so serious?
A: It holds the password hash of every account, including Domain Admins and KRBTGT, so controlling it is equivalent to controlling the whole domain.
Q: What is Tier 0?
A: The set of assets that can control identity, including Domain Controllers and the accounts and systems that manage them.
---
# What is a gMSA?
https://securelayer7.net/learn/active-directory/what-is-a-gmsa
A gMSA (Group Managed Service Account) is a service account whose password Active Directory generates and rotates automatically, typically 240 characters that no human sees. Because the password cannot be cracked, gMSAs defeat Kerberoasting and Silver Tickets. The remaining risk is who can read the gMSA password (ReadGMSAPassword), so that membership must be restricted and audited.
Sl7QuartzHero
hero-what-is-a-gmsa
Active Directory · Term
What is a
gMSA?
A Group Managed Service Account is a service account whose password Windows generates, rotates, and manages automatically, removing the weak human-chosen passwords that make Kerberoasting work. Here is what a gMSA is and where it still needs care.
centered
LearnArticle
learn
Active Directory · Term
A gMSA (Group Managed Service Account) is a service account whose password is **generated and rotated automatically by Active Directory**, typically a 240-character value that changes on a schedule and that no human ever sees. Because the password is long and random, gMSAs **defeat Kerberoasting and Silver Tickets**, which rely on cracking a weak service-account password. They are the recommended fix for service accounts, with one caveat: control over **who can read the gMSA password** must still be tight.
2026-06-27
2026-06-27
John Dill
Red Team Lead, SecureLayer7
All services
/our-services
what
What a gMSA is
Ordinary service accounts often carry weak, static, human-chosen passwords that never change, the perfect target for Kerberoasting. A **gMSA** removes that problem: Active Directory **manages the password** for you.
The domain generates a long, random password (around 240 characters), rotates it automatically (commonly every 30 days), and lets only **authorised host computers** retrieve the current password when their service starts. No administrator types or knows it.
attack
Why it defeats attacks (and the one caveat)
gMSAs neutralise the cracking-based attacks:
- **Kerberoasting** fails because the 240-character password cannot be cracked offline in any realistic time.
- **Silver Tickets** fail for the same reason, since they need the service-account hash.
The caveat is the **ReadGMSAPassword** right: whichever principals are allowed to read the gMSA password (the `msDS-GroupMSAMembership` setting) effectively hold the account. If an attacker compromises one of those principals, they can retrieve the password:
- `gMSADumper.py -u user -p pass -d corp.local` or BloodHound’s **ReadGMSAPassword** edge
So gMSAs move the risk from "crackable password" to "who can read it," which is a far smaller, auditable surface.
Audit who can read it
A gMSA is only as safe as the list of principals allowed to read its password. Keep that list minimal and watch BloodHound for **ReadGMSAPassword** edges to it.
defend
How to use gMSAs well
- **Migrate service accounts to gMSAs** so passwords are long, random, and auto-rotated.
- **Restrict msDS-GroupMSAMembership** to only the hosts that genuinely run the service.
- **Audit ReadGMSAPassword rights** with BloodHound and remove needless ones.
- **Keep gMSAs out of privileged groups** so a compromised one is not also an admin.
- **Ensure the KDS root key** is deployed and protected, as it underpins gMSA password generation.
MITRE ATT&CK Enterprise Matrix
https://attack.mitre.org/matrices/enterprise/windows/
MITRE
Microsoft: Best Practices for Securing Active Directory
https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/best-practices-for-securing-active-directory
Microsoft
Microsoft: Kerberos Authentication Overview
https://learn.microsoft.com/en-us/windows-server/security/kerberos/kerberos-authentication-overview
Microsoft
Active Directory security topics
/learn/active-directory
Kerberoasting
/learn/active-directory/kerberoasting
What is a Service Principal Name (SPN)
/learn/active-directory/what-is-an-spn
What is a Silver Ticket
/learn/active-directory/what-is-a-silver-ticket
All services
/our-services
Faq
faq
Common questions
Active Directory, asked often
left
mono-caps
neutral
q1
What is a gMSA?
A Group Managed Service Account whose password Active Directory generates and rotates automatically, typically a 240-character value that no human sees. It is the recommended way to run service accounts safely.
q2
How does a gMSA stop Kerberoasting?
Kerberoasting relies on cracking a service account’s password offline. A gMSA’s password is long and random, so it cannot be cracked in any realistic time, and the attack fails.
q3
Are gMSAs completely safe?
They remove the cracking risk, but whoever is allowed to read the gMSA password effectively controls the account. That read access must be restricted and audited.
q4
What is the ReadGMSAPassword risk?
Principals listed in the gMSA’s membership can retrieve its password. If an attacker compromises one of them, they obtain the account, so the read list must be kept minimal.
Need your Active Directory tested?
Talk to a security expert
security-posture-review
CtaBanner
cta-what-is-a-gmsa
Scope an engagement
Test your Active Directory before an attacker does.
We run internal and Active Directory penetration tests that follow the real path from one low-privilege user to Domain Admin, then hand your team a report with reproducible evidence and a fix for every step. Free re-test included.
Talk to a security expert
30-min scoping call, fixed-price proposal in 48 hours.
See all services
/our-services
security-posture-review
## Q&A
Q: How does a gMSA stop Kerberoasting?
A: Its password is long and random, so the offline cracking that Kerberoasting relies on cannot succeed.
Q: Are gMSAs completely safe?
A: They remove the cracking risk, but whoever can read the gMSA password controls the account, so that access must be restricted.
---
# What is a Golden Ticket Attack?
https://securelayer7.net/learn/active-directory/what-is-a-golden-ticket
A Golden Ticket is a forged Kerberos Ticket Granting Ticket created with the domain KRBTGT password hash. Every Domain Controller trusts the KRBTGT signature, so the attacker can impersonate any user in any group for years, independent of password changes. It requires stealing the KRBTGT hash first, usually via DCSync, and recovery needs a KRBTGT double-reset.
Sl7QuartzHero
hero-what-is-a-golden-ticket
Active Directory · Term
What is a
Golden Ticket?
A Golden Ticket is a forged Kerberos ticket signed with the stolen KRBTGT key, letting an attacker impersonate anyone in the domain for as long as they like. Here is what a Golden Ticket is, how it is made, and why it means a domain rebuild.
centered
LearnArticle
learn
Active Directory · Term
A Golden Ticket is a **forged Kerberos Ticket Granting Ticket (TGT)** created with the domain’s **KRBTGT password hash**. Because every Domain Controller trusts anything signed with that key, the attacker can mint a ticket claiming to be **any user in any group**, including Domain Admins, valid for years and independent of password changes. It is the ultimate Active Directory persistence, and it requires first stealing the KRBTGT hash, usually via **DCSync** after reaching Domain Admin.
2026-06-27
2026-06-27
John Dill
Red Team Lead, SecureLayer7
All services
/our-services
what
What a Golden Ticket is
Kerberos issues every user a **TGT** signed with the **KRBTGT** account’s password hash, and the whole domain trusts that signature. A **Golden Ticket** is an attacker forging their own TGT using a stolen KRBTGT hash.
The forged ticket can claim any identity and any group membership the attacker wants, and the Domain Controllers accept it because the signature checks out. It does not depend on the impersonated user’s password, so changing that password does nothing.
attack
How it is forged and payload
A Golden Ticket needs the KRBTGT hash first, then the forgery:
- Steal the KRBTGT hash via DCSync: `lsadump::dcsync /user:krbtgt` (Mimikatz) or `secretsdump.py -just-dc-user krbtgt ...`
- Forge and inject the ticket: `kerberos::golden /user:Administrator /domain:corp.local /sid:
What we test —
Six Microsoft surfaces. One engagement.
Every layer of the Microsoft estate gets a manual, threat-modelled review against its real attack surface — identity, infrastructure, productivity, devices, business apps, and pipelines. Intensity tunes per scope.
Microsoft Entra ID (Azure AD)
Illicit OAuth consent-grant phishing, nOAuth cross-tenant token replay, Primary Refresh Token theft via TPM/SSO key extraction, Conditional Access bypass through legacy auth (IMAP/SMTP/POP3), MFA-fatigue chained with device-code phishing, application-permission over-scope on Graph, Service Principal credential rotation gaps, and B2B guest-user privilege escalation via dynamic-group injection.
Azure infrastructure & Resource Manager
Managed-identity over-scope at subscription root, Storage Account SAS leakage and over-permissive lifetimes, Function App environment-variable exposure, Key Vault access-policy bypass, AKS pod-identity abuse and node-to-control-plane pivot, NSG misconfiguration with JIT-VM bypass, ARM/Bicep template parameter injection, and role-definition assignment-scope drift across management groups.
Microsoft 365 (Exchange · SharePoint · Teams)
Exchange Online OAuth-app phishing, SharePoint app-only Sites.Selected over-scope, OneDrive token reuse across guest tenants, Teams external-federation chat and tab injection, Power Automate Office-365 connector abuse, transport-rule and mail-flow-rule tampering for silent exfiltration, BEC pivot from compromised mailbox to vendor invoice fraud, and eDiscovery / Compliance role abuse.
Microsoft Intune (MDM / endpoint)
Device-compliance bypass via local-admin escalation, Conditional Access compliant-device spoofing, MDM certificate reuse and silent re-enrolment, App Protection Policy bypass on rooted/jailbroken devices, Autopilot enrolment abuse for tenant join, configuration-profile drift between OU rings, and Win32-app deployment weaponised as a SYSTEM payload.
Dynamics 365 & Power Platform
Record-level security bypass via teams and business-unit hierarchies, Power Platform connector abuse where HTTP-with-Azure-AD is reused across environments, Power Automate flow ownership take-over, custom-connector secret reuse, Dataverse plug-in code injection, Power Pages web-role spoofing with anonymous portal SQL access, and Copilot Studio (formerly Power Virtual Agents) prompt injection into downstream connectors.
Azure DevOps & GitHub Enterprise
Service-connection abuse pivoting cross-pipeline, secret leakage in YAML pipelines and variable groups, OIDC federated workload-identity over-scope, branch-protection bypass via push-options and required-reviewer gaps, self-hosted build-agent escape to host, package-feed dependency confusion, GitHub App token-permission over-scope, and Personal Access Token reuse across orgs.
What we review —
Six surfaces. One review.
Each surface is read off the diagram, then walked with the operators who run it. Findings score on attacker reachability, not on policy compliance alone.
Segmentation & ACLs
VLAN boundaries, firewall rule density, east-west controls, and the segments that have quietly grown flat through years of exception rules.
Third-party & partner integration
VPN tunnels, MPLS hand-offs, SaaS connectors, and the partner-tenant paths that bypass your perimeter via a vendor’s allowlist.
Identity & access boundaries
Active Directory trust direction, RADIUS/TACACS scope, jump-host policy, service-account reachability across segments.
Topology, DMZ & exposure
Internet-facing posture, DMZ tenancy, NAT/PAT semantics, IPv6 dual-stack assumptions, management-plane exposure.
Security technology inventory
Firewalls, IDS/IPS, NDR, segmentation tooling, secrets vaults, EDR coverage map. Each control read for what it sees and what it does not.
Policy, BCP & recovery routes
Failover paths and DR sites tested as live network surface. A clean primary network with a flat DR path is one disaster from being flat-attacked.
ExpertSpotlight
Meet your engagement lead
An engagement lead reads
every brief.
Pruthvi Mahesh
Engagement Lead, Network & Architecture Reviews
Pruthvi scopes architecture-review engagements end to end, translating your topology, segmentation policy, and identity model into the interview agenda, the documents to pull, and the surfaces to test reachability against. He runs the engagement with the SecureLayer7 pod from kick-off through the in-person walkthrough.
Scopes segmentation, third-party access, and DMZ tenancy against your real risk model.
Owns kick-off, mid-engagement check-ins, and live presentation of every finding.
Drives recommendation review and re-walk until each gap closes.
14+
Years in offensive security
200+
Engagements scoped
99%
On-time delivery rate
/media/pruthvi-mahesh-41f4a31e.webp
Pruthvi Mahesh, Engagement Lead at SecureLayer7
Ready to scope a Network Architecture Review? Book a 30-minute call with Pruthvi to walk through your topology, segmentation, and timeline.
Talk to a security expert
/contact-us
security-posture-review
SL7 Lab, Published CVE research
/security-advisories
dark
LEAD.
ExpertSpotlight-5-qnuudu
ResourceShowcase
Adjacent
Beyond the architecture
review.
light
rss
https://blog.securelayer7.net/feed/
Network
Read more
Adjacent disciplines
Cloud Penetration Testing
/services/cloud-penetration-testing
Red Team Assessment
/services/red-team-assessment
Telecom Network Security
/services/telecom-network-security
Application Security Testing
/services/application-security-testing
Proof of work
Published CVE research
/security-advisories
Talk to a security expert
/contact-us
LAB.
ResourceShowcase-6-ne2brv
CtaBanner
Sample engagement report
See what the architecture review puts in your inbox.
Sample report shows the gap narrative, segmentation evidence, control changes recommended, and the order to apply them. Sent on request after a 5-minute scoping call.
Request the sample report
/contact-us
/media/sample-report-bcd3d195.svg
Sample network architecture review report, gap narrative, segmentation evidence, control changes.
light
left
sample-download
REPORT.
CtaBanner-7-6iqqkl
## Q&A
Q: What does a network architecture review include?
A: Topology mapping, segmentation gaps (VLAN, micro-seg, hybrid-cloud), trust boundaries, identity and admin paths, third-party connections, north-south and east-west flows, and DR/BCP architecture against your stated control objectives. Output is a diagram, a findings register with severity, and a remediation roadmap.
Q: How is this different from a network penetration test?
A: A network architecture review is a design-time control evaluation: we read the network like an auditor and adversary would, without actively exploiting hosts. A penetration test is the adversarial validation that follows: we attempt entry and lateral movement on live infrastructure. Most enterprises do both, in sequence.
Q: Which frameworks does the review map to?
A: NIST SP 800-53 (AC, SC, SI families), ISO/IEC 27001 Annex A, PCI DSS Req 1, 2, and 11, SOC 2 CC6 and CC7, HIPAA Technical Safeguards, NIST CSF Identify and Protect functions. Each finding cites the control it maps to.
Q: What is the engagement length?
A: Typically one to two weeks for a single business unit; three to four for a multi-region enterprise network. The deliverable is a CREST-mapped report, a current-state architecture diagram, and a phased remediation plan.
Q: Who reads the report?
A: Designed for both network architects (who need the design-level findings and diagrams) and risk teams (who need the framework mapping and severity register). The same artifact lands with regulators and prospects asking for design assurance.
---
# Newsroom and Press Coverage
https://securelayer7.net/newsroom
SecureLayer7 news, press coverage, analyst recognition, and CVE disclosure announcements. Latest updates from the offensive security research team.
HeroHeadline
newsroom-hero
In the press
Newsroom.
Where our research lands.
Coverage of SecureLayer7 research, disclosures, and feature stories across security press since 2019. CVE write-ups credited in NVD records are catalogued separately at /security-advisories.
/media/newsroom-hero.svg
Newspaper front page — SecureLayer7 research featured across security press
Sl7TrustWriteups
newsroom-press
Featured coverage
Where the research showed up.
Named SecureLayer7 mentions in security press since 2015. Click through for the original article.
READ
CISA KEV · GOV LISTING
CISA adds n8n RCE to Known Exploited Vulnerabilities catalog after real-world attacks
Mar 12 2026
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
/media/press-logo-cisa-731c3bd5.png
cisa.gov
THE REGISTER · CVE-2026-25049
n8n security woes roll on as new critical flaws bypass December fix
Feb 5 2026
https://www.theregister.com/2026/02/05/n8n_security_woes_roll_on
/media/press-logo-theregister-1131e6e0.png
theregister.com
THE REGISTER · CVE-2024-27348
POC exploit code published for critical Apache HugeGraph bug
Jun 7 2024
https://www.theregister.com/2024/06/07/poc_apache_hugegraph/
/media/press-logo-theregister-1131e6e0.png
theregister.com
FORBES · COUNCIL POST
A Bird's Eye View Of Large Language Model Security
Feb 7 2024
https://www.forbes.com/councils/forbesbusinesscouncil/2024/02/07/a-birds-eye-view-of-large-language-model-security/
/media/press-logo-forbes-e42da867.png
forbes.com
HELP NET SECURITY · ROUNDUP
Hottest cybersecurity open-source tools of the month: May 2026
May 28 2026
https://www.helpnetsecurity.com/2026/05/28/hottest-cybersecurity-open-source-tools-of-the-month-may-2026/
/media/press-logo-helpnetsecurity-8af5b1a9.png
helpnetsecurity.com
HELP NET SECURITY · FEATURE
Sandyaa: Open-source autonomous security bug hunter
May 13 2026
https://www.helpnetsecurity.com/2026/05/13/sandyaa-open-source-autonomous-security-bug-hunter/
/media/press-logo-helpnetsecurity-8af5b1a9.png
helpnetsecurity.com
RISKY BULLETIN · CVE-2026-24891
SecureLayer7 found a privilege escalation bug in IPVanish VPN macOS client
Mar 6 2026
https://news.risky.biz/risky-bulletin-iranian-hackers-are-scanning-for-security-cameras-to-aid-missile-strikes/
/media/press-logo-risky-business-eb852415.png
risky.biz
THE HACKER NEWS · CVE-2026-25049
Critical n8n Flaw Enables System Command Execution via Malicious Workflows
Feb 2026
https://thehackernews.com/2026/02/critical-n8n-flaw-cve-2026-25049.html
/media/press-logo-the-hacker-news-v2-d67d6b93.png
thehackernews.com
SC MEDIA · CVE-2026-25049
CISA adds n8n RCE flaw to list of known exploited vulnerabilities
2026
https://www.scworld.com/news/cisa-adds-n8n-rce-flaw-to-list-of-known-exploited-vulnerabilities
/media/press-logo-sc-media-b2d96c7d.png
scworld.com
RISKY BULLETIN · CVE-2025-4318
SecureLayer7 publishes write-up and PoC for an RCE in AWS Amplify Codegen UI
Jun 9 2025
https://news.risky.biz/risky-bulletin-eu-launches-private-dns-service/
/media/press-logo-risky-business-eb852415.png
risky.biz
GBHACKERS · CVE-2025-4318
Critical AWS Amplify Studio Flaw Allowed Attackers to Execute Arbitrary Code
May 2025
https://gbhackers.com/critical-aws-amplify-studio-flaw/
/media/press-logo-gbhackers-2a0ed7dc.png
gbhackers.com
CYBERSECURITY NEWS · CVE-2025-25364
Speedify VPN macOS Vulnerability Lets Attackers Escalate Privilege
Feb 2025
https://cybersecuritynews.com/speedify-vpn-macos-vulnerability/
/media/press-logo-cybersecurity-news-593c12a2.webp
cybersecuritynews.com
GBHACKERS · CVE-2025-25364
Speedify VPN Vulnerability on macOS Exposes Users to System Takeover
Feb 2025
https://gbhackers.com/speedify-vpn-vulnerability-on-macos/
/media/press-logo-gbhackers-2a0ed7dc.png
gbhackers.com
THE HACKER NEWS · CVE-2024-27348
Critical Apache HugeGraph Vulnerability Under Attack, Patch ASAP
Jul 2024
https://thehackernews.com/2024/07/critical-apache-hugegraph-vulnerability.html
/media/press-logo-the-hacker-news-v2-d67d6b93.png
thehackernews.com
SECURITYWEEK · CVE-2024-27348
Apache HugeGraph Vulnerability Exploited in Wild
Jun 2024
https://www.securityweek.com/apache-hugegraph-vulnerability-exploited-in-wild/
/media/press-logo-securityweek-cc53043f.jpeg
securityweek.com
SC MEDIA · CVE-2024-27348
Attacks leveraging critical Apache HugeGraph bug underway
Jun 2024
https://www.scworld.com/brief/attacks-leveraging-critical-apache-hugegraph-bug-underway
/media/press-logo-sc-media-b2d96c7d.png
scworld.com
THE CYBER EXPRESS · CVE-2024-27348
Decoding the HugeGraph Vulnerability
Jun 2024
https://thecyberexpress.com/hugegraph-vulnerability-cve-2024-27348/
/media/press-logo-the-cyber-express-ae7c16cf.jpg
thecyberexpress.com
THEPRINT · ANI WIRE
SecureLayer7 Launches BugDazz-on-premises API Security Scanner
Oct 2024
https://theprint.in/ani-press-releases/securelayer7-launches-bugdazz-on-premises-api-security-scanner/2304573/
/media/press-logo-theprint-47de58e7.png
theprint.in
CIO INFLUENCE
SecureLayer7 Launches On-Prem BugDazz API Security Scanner
Oct 2024
https://cioinfluence.com/analytics/securelayer7-launches-on-prem-bugdazz-api-security-scanner/
/media/press-logo-cioinfluence-ed1fd454.png
cioinfluence.com
WASHINGTON POST · AP WIRE
Security firm finds flaws in Indian online insurance broker
Aug 2022
https://www.washingtonpost.com/business/security-firm-finds-flaws-in-indian-online-insurance-broker/2022/08/10/8a9456a4-1898-11ed-b998-b2ab68f58468_story.html
/media/press-logo-washingtonpost-5418360c.jpg
washingtonpost.com
SECURITYWEEK · POLICYBAZAAR
Security Firm Finds Flaws in Indian Online Insurance Broker
Aug 2022
https://www.securityweek.com/security-firm-finds-flaws-indian-online-insurance-broker/
/media/press-logo-securityweek-cc53043f.jpeg
securityweek.com
ITWIRE · VIDEO INTERVIEW
SecureLayer7 CTO Sandeep Kamble explains pen testing, cybercrime in the age of COVID and more
2022
https://itwire.com/business-it-news/security/video-interview-securelayer7-cto,-sandeep-kamble,-explains-pen-testing,-cybercrime-in-the-age-of-covid-and-more.html
/media/press-logo-itwire-2fc4066c.png
itwire.com
INSIGHTS SUCCESS · FEATURE
SecureLayer7: Time and Again Securing You
2021
https://www.insightssuccess.in/securelayer7-time-and-again-securing-you/
/media/press-logo-insights-success-d00f81a2.png
insightssuccess.in
GEOSPATIAL WORLD · BYLINE
4 reasons enterprises need to focus on robust Cloud security infrastructure
2021
https://www.geospatialworld.net/blogs/4-reasons-why-enterprises-need-to-focus-on-building-a-robust-cloud-security-infrastructure/
/media/press-logo-geospatial-world-93d1b5f1.png
geospatialworld.net
CYBERSECURITY VENTURES
AuthSafe Launches To Prevent Account Takeovers
Apr 2020
https://cybersecurityventures.com/authsafe-launches-to-prevent-account-takeovers/
/media/press-logo-cybersecurity-ventures-3a7df50e.png
cybersecurityventures.com
CYBERCRIME MAGAZINE · PODCAST
Preventing Account Takeovers. Introducing AuthSafe
2019
https://soundcloud.com/cybercrimemagazine/introducing-authsafe-with-securelayer7-founder-cto-sandeep-kamble
/media/press-logo-cybersecurity-ventures-3a7df50e.png
cybersecurityventures.com
SOFTPEDIA · DRUPAL XSS
Security Researcher Disappointed with How an XSS Bug Was Fixed in Drupal 8
Oct 9 2015
https://news.softpedia.com/news/security-researcher-disappointed-how-an-xss-bug-was-fixed-in-drupal-8-494197.shtml
/media/press-logo-softpedia-bb7ef022.png
softpedia.com
TextSection
newsroom-cve-callout
CVE research
Twenty disclosures
catalogued in NVD.
Every CVE SecureLayer7 has disclosed, with the year, vendor, and write-up link. Maintained at [Security advisories](/security-advisories).
See the disclosure index
/security-advisories
light
right
CtaBanner
newsroom-press-contact
Press inquiries
Writing about SecureLayer7 or one of our CVEs?
Reach our research lead for technical detail, exploit walk-throughs, or expert quotes. We typically reply within one business day.
Email info@securelayer7.net
mailto:info@securelayer7.net
Talk to a security expert
dark
left
security-posture-review
---
# Open Source Offensive Security Tools
https://securelayer7.net/open-source-tools
Open source tools built and released by SecureLayer7 researchers. Frida hooks, fuzzers, exploit primitives. Audited, maintained, MIT-licensed.
HeroHeadline
oss-hero
Open-source
What we ship,
for free.
Public repos from the SL7 lab. Auditors, exploit chains, scanners, and primitives we wanted ourselves. MIT-licensed where applicable. Fork, file issues, send PRs.
Browse on GitHub
https://github.com/securelayer7
Sl7TrustWriteups
oss-repos
Repositories
Eight tools, still in the open.
Star counts and forks from github.com/securelayer7. Click through for source, README, and issues.
OPEN ON GITHUB
OSS · TYPESCRIPT · MIT
sandyaa, autonomous code auditor that keeps digging until it finds and proves real bugs
207★ · 52 forks
https://github.com/securelayer7/sandyaa
/media/press-logo-github-1d327198.svg
github.com
OSS · CVE SCANNER
CVE-2024-38856_Scanner, Apache OFBiz pre-auth RCE scanner
49★ · 13 forks
https://github.com/securelayer7/CVE-2024-38856_Scanner
/media/press-logo-github-1d327198.svg
github.com
OSS · HARDWARE · UART
PinNinja, identify UART RX/TX/GND pins on unknown hardware
17★
https://github.com/securelayer7/PinNinja
/media/press-logo-github-1d327198.svg
github.com
OSS · IOT EXPLOIT
pwnfb50, FB50 smart-lock takeover (CVE-2019-13143) exploit + write-up
17★
https://github.com/securelayer7/pwnfb50
/media/press-logo-github-1d327198.svg
github.com
OSS · LLM SAFETY
PROMPTPurify, prompt-injection guardrail for LLM-backed apps
17★
https://github.com/securelayer7/PROMPTPurify
/media/press-logo-github-1d327198.svg
github.com
TextSection
oss-research-callout
CVE research
Twenty disclosures
catalogued in NVD.
Every CVE SecureLayer7 has disclosed, with the year, vendor, and write-up link. Maintained at [Security advisories](/security-advisories).
See the disclosure index
/security-advisories
light
right
CtaBanner
oss-cta
Contribute
Found a bug, or want to extend one of these?
File an issue on GitHub. We triage weekly. For security-sensitive reports, mail info@securelayer7.net first, not the public tracker.
Open issues on GitHub
https://github.com/securelayer7
Talk to a security expert
dark
left
security-posture-review
---
# Penetration Testing Services Catalog
https://securelayer7.net/our-services
SecureLayer7 penetration testing services catalog, web, mobile, network, cloud, API, source code, IoT, red team, smart contract, SAP, OT.
Sl7ServicesHero
Sl7ServicesHero-0-o0ul1z
TrustStrip
TrustStrip-our-services
Sl7ServicesGrid
What we test
The catalog,
not a checklist.
Seven practices, one evidence standard. Each engagement is run by a CREST-certified researcher with offensive depth in the surface, not a generalist working through a vendor template.
Red Team
Objective-led adversary emulation across web, identity, endpoint, and physical seams. Initial access, privilege escalation, persistence, and proven domain takeover.
Red Team Assessment
/services/red-team-assessment
AI and LLM Security
Prompt injection chains, tool-use abuse, training-data exfiltration, output-handling flaws, and agent boundary failures on production LLM deployments.
AI Security Assessment
/services/ai-security-assessment
Network and Infrastructure
Internal and external network attack paths, Active Directory abuse, segmentation failure, hardening gaps, and architecture review against real adversary playbooks.
AD Security Audit
/services/active-directory-security-assessment
Firewall Config Review
/services/firewall-configuration-review
Network Pentest
/services/network-penetration-testing
Wireless Assessment
/services/wireless-network-security-assessment
Network Architecture Review
/network-architecture-review
Server Hardening
/services/server-security-hardening
Telecom Network Security
/services/telecom-network-security
VoIP Pentest
/services/voip-pentesting
Application Security
Authenticated business-logic abuse, IDOR chains, SSRF to cloud metadata, deserialization, and the full OWASP class on web, mobile, and thick-client targets.
Web Application Penetration Testing
/services/web-application-penetration-testing
API Pentest
/services/api-penetration-testing
Mobile Application Penetration Testing
/services/mobile-app-pentest
Thick Client Pentest
/services/thick-client-pentest
Source Code Audit
/services/source-code-audit-review
On-Demand Pentest
/products/autonomous-pentest
Cloud Security
IAM privilege escalation paths, exposed metadata services, misconfigured S3 and RBAC, lateral movement across accounts, and Kubernetes break-out scenarios.
Cloud Pentest
/services/cloud-penetration-testing
AWS Penetration Testing
/services/aws-penetration-testing
Azure Pentest
/services/azure-penetration-testing
Kubernetes Pentest
/services/kubernetes-pentesting
IoT Security
Firmware extraction, hardware fault injection, radio and protocol abuse, and full device-to-cloud chain testing on connected products before they ship.
IoT Pentest
/services/iot-security-penetration-test
OT / ICS Security
/services/ot-security-assessment
ERP and Specialized
SAP business-logic abuse, transaction tampering, RFC and ICM exposure, and authorization bypass across S/4HANA, NetWeaver, and adjacent ERP modules.
SAP Security Assessment
/services/sap-security-assessment
Industries
Vertical-specific engagements with bug classes that don't show on a generic OWASP scan. Same operators, same OPSEC, scoped to your sector.
FinTech
/industries/fintech
HealthTech
/industries/healthtech
EdTech
/industries/edtech
Retail
/industries/retail
Tech SaaS
/industries/tech
Sl7ServicesGrid-1-1zq5hq
control
Sl7ServicesDeliverables
Sl7ServicesDeliverables-2-wjnxpi
Sl7ServicesIndustries
Sl7ServicesIndustries-3-3lvw1n
Sl7ServicesResearch
Sl7ServicesResearch-4-cwtlz1
Sl7ServicesProof
Sl7ServicesProof-5-9bc1kg
ResourceShowcase
ResourceShowcase-buyer-guide
Buyer guide
How to pick
a pentest partner.
A scoping checklist for security leaders evaluating offensive-security firms. Methodology questions, deliverable expectations, retest scope, and red flags.
manual
BUYER GUIDE
Guideline to choose a pentest service partner
Scoping checklist, methodology questions, deliverable expectations. Used by CISOs at fintechs, healthcare, and SaaS to evaluate offensive-security firms.
/download/Guideline-to-choose-a-Pen-Test-Service-Partner.pdf
Download PDF (31 MB)
light
Sl7ServicesCloser
Sl7ServicesCloser-6-jw8x9x
## Q&A
Q: Which penetration testing service do I need?
A: Pick by the asset under review. Web app (login flows, business logic, API): web application penetration testing. Mobile app (iOS/Android): mobile app penetration testing. Cloud account (AWS/Azure/GCP/Kubernetes): cloud penetration testing. Network perimeter / internal segments: network penetration testing. API surface (REST/GraphQL/gRPC): API penetration testing. Source code review pre-release: source code audit. Full adversary simulation across people, network, apps: red team assessment. Each ships the same evidence pack format, so a multi-service program reads as one engagement to your auditor.
Q: How long does a typical penetration test take?
A: Two to four weeks of active testing per scope, plus a one-week scoping phase up front and a free re-test after fixes land. A multi-service program (e.g. web + mobile + cloud) runs in parallel tracks and finishes in roughly the same window as the longest single scope.
Q: Are the reports regulator-ready?
A: Yes. Every report carries CREST-mapped severity, a working proof-of-exploit per finding, code-level fix guidance, and a regulator-ready PDF accepted across SOC 2, HIPAA, PCI DSS, ISO 27001, NIST CSF, FedRAMP, and CERT-In review cycles. SecureLayer7 is CREST-accredited and CERT-In empanelled.
Q: Do you include a re-test?
A: Yes. Every engagement includes a free re-test of the same scope after fixes land. Each finding gets written closure once the path no longer reproduces. No extra invoice, no separate engagement.
---
# Autonomous Pentest Partner Program
https://securelayer7.net/partners
SecureLayer7 partner program. Channel resellers, MSP / MSSP partnerships, AWS Marketplace, and India channel program.
HeroHeadline
HeroHeadline-7038e1
For partners
Sell the pentest
your customers actually want.
We do the testing. You keep the customer, your brand on the report, and the renewal.
/media/partners-hero-team-baac58bc.webp
Four SecureLayer7 pentesters and an engagement lead reviewing a printed pentest report at a wooden table in a warm-lit library
overlay
Apply to partner
/partners/apply-partner
See what you'll sell
#products
CredentialStrip
CredentialStrip-partners
Backed by accreditation
Why partners route work to us.
Every engagement runs against credentials your customers' auditors already accept.
left
grid
CREST
Accredited company and testers
CERT-In
Empanelled auditor
SOC 2 Type II
Independently audited
ISO 27001
Information Security Management
Reports map to
SOC 2 Type II · PCI DSS · HIPAA · ISO 27001 · GDPR · NIST CSF · FedRAMP
Sl7Overview
products
What you'll sell
Two products.
A services line.
Three things in the partner bag. One research bench behind them all.
SUBSCRIPTION
BugDazz Autonomous
Customers run pentests on their own stack, against the exploit chains our pod builds by hand. Recurring revenue. Multi-tenant access for MSSPs.
/products/autonomous-pentest
See the product
SUBSCRIPTION
API Security Scanner
Per-environment scanner for teams shipping APIs every sprint. REST, GraphQL, gRPC. CI-friendly. Self-serve to enterprise.
/products/api-security-scanner
See the product
SERVICES
Pentest engagements
CREST-accredited manual engagements: web, API, mobile, cloud, AI, network, red team, smart contract, OT. Co-branded report.
/our-services
See the lineup
Sl7Overview
engage
How partners engage
Refer, resell,
or run it managed.
Three program models. Pick the one that matches how you already sell.
REFERRAL
Refer.
You position, we close and deliver. Fit: audit firms, vCISOs, advisors who don't hold contracts.
refer
RESELLER
Resell.
You hold the contract, we deliver under your brand. Fit: IT consultancies and regional channel firms.
resell
MANAGED
Run managed.
Multi-tenant, your logo on every artifact. Fit: MSSPs selling mid-market security-as-a-service.
managed
Pullquote
Pullquote-cto
A note from our CTO
Channel is how trust scales.
Sandeep Kamble, CTO and Founder
dark
/media/sandeep-kamble-30a3ab60.webp
Sandeep Kamble
TextSection
TextSection-india
IN
For Indian partners
CERT-In auditor referrals.
Higher payout on signed audits.
CERT-In empanelled auditors who sign the audit report on a partner-sourced engagement earn a higher payout on that SKU, with trailing payout on Annual Pack renewals. Indian CA firms referring CERT-In work earn standard referral payout with trailing pay on renewal. Specifics on the application call. Reach a partner manager at info@securelayer7.net.
light
right
CtaBanner
CtaBanner-apply
Apply to the program
Apply to the SL7 Allies Program.
Tell us what you sell and who you sell to. A partner manager replies inside one business day with the program economics.
Apply to partner
/partners/apply-partner
/media/partners-signing-moment-5d6b9af5.webp
Two partners signing a co-branded services agreement at a walnut conference table
dark
left
## Q&A
Q: What is the SL7 Allies Program?
A: SecureLayer7's channel partner program. Three tracks: refer, resell, or run managed. For MSSPs, MSPs, audit firms, vCISOs, IT consultancies, and technology alliance partners.
Q: Are commissions and discounts disclosed publicly?
A: No. Program economics are shared on the application call so the conversation matches your firm. Apply at /apply-partner.
Q: Can partners co-brand the report?
A: Yes. Your logo on the cover, your engineer named alongside ours on the title page.
Q: Is there deal protection?
A: Yes. Registered opps are locked at your tier economics. Our direct team cannot undercut, and MSSP-managed customers are off-limits to direct sales.
---
# Penetration Testing as a Service (PTaaS)
https://securelayer7.net/penetration-testing-as-a-service
SecureLayer7 PTaaS: continuous penetration testing as a service. CREST-approved. Self-serve scoping. Transparent per-engagement pricing. Dashboard tracking with proof-of-exploit on every finding.
Sl7QuartzHero
Sl7QuartzHero-ptaas-hero
Penetration testing as a service
Your last pentest expired
the day you shipped.
A pentest is accurate the day it ships and stale the next time you deploy. SecureLayer7's penetration testing platform, BugDazz, puts CREST-accredited testers, live findings, and on-demand re-test behind one login. The report tracks your code, not last quarter's.
Book a scoping call
/contact-us
security-posture-review
/media/ptaas-wheel-r255-dbd634db.svg
BugDazz engagement lifecycle wheel: plan of action, launch project, pentest, report, remediate, repeat.
See findings as testers confirm them
Vulnerabilities surface the moment a researcher confirms them, ranked by severity. No 400-page export weeks after the code changed.
Activity
Verify fixes without a new SOW
Submit a fix, schedule verification, and the report updates. No re-scoping, no second procurement cycle.
RotateCcw
Real researchers, not tool operators
CREST-accredited testers who publish CVEs run the engagement. The platform holds the evidence.
ShieldCheck
split
TrustStrip
TrustStrip-ptaas-customers
Trusted by security and product teams in
Outcomes
Outcomes-ptaas-proof
Proof, not promises
Findings that hold up
in front of an auditor.
left
italic-serif
primary
Run by the team behind SecureLayer7's CVE disclosures. You see the testing work and the evidence, not just a finding count.
PROOF.
top-right
outline
foreground
none
brand
subtle
cards
light
40,000+ critical vulnerabilities
Confirmed and reported across 1,000+ customers in 30+ countries.
proof
Caught before the attacker
Critical issues found, fixed, and re-tested before they were exploitable, with reporting your board and auditors can defend.
directory
CVSS 9.9 zero-day
Full system compromise found and disclosed in production software by the team that runs your engagement.
map
Re-test on demand
Submit a fix, the testers verify it, and the report updates. No new statement of work.
server
Sl7WhyDiptych
Sl7WhyDiptych-ptaas-fit
Who this is for
Built for teams that ship
between pentests.
A one-off project pentest gives you
One app, tested once, ahead of a single audit.
A snapshot that is true the day it is delivered.
A static PDF that ages the next time you deploy.
Choose the platform if
You ship to production every sprint, so a Q1 test never covers what went live in Q3.
Auditors keep asking for a current report, not last year's.
Findings die in a PDF instead of reaching the developer who owns the code.
You re-buy and re-scope a pentest every time a fix needs verifying.
Not sure this fits how you ship? Book a scoping call.
security-posture-review
Sl7WaptMethodology
Sl7WaptMethodology-ptaas-flow
From scope to verified fix
One platform,
the whole engagement.
Scope, test, triage, and re-test in one place. No email threads, no PDF handoff, no waiting weeks for the report.
01
Scope in days
Define targets and rules of engagement in the platform. A SecureLayer7 lead confirms scope and start date. Days, not a procurement cycle, and no new loop for every re-test.
02
Human-led pentest
CREST-accredited researchers run the engagement: business-logic abuse, chained exploits, and authenticated attack paths. Tooling maps the surface so testers spend their time where judgment is the only thing that finds the flaw.
03
Findings land live
Each confirmed vulnerability arrives as a step-by-step attack narrative: the request, the response, a recorded proof-of-exploit, and developer-ready remediation. Push to Jira, ServiceNow, or Slack.
04
Re-test closes the loop
Submit the fix, schedule verification, and the report and attestation letter update. No new SOW.
cards
RawHtml
control
RawHtml-ptaas-coverage
What gets tested —
The surfaces an attacker actually chains.
Engagements follow the attack the way an intruder would: web to API to identity to internal, not one isolated checklist at a time.
Web applications
Authn/z bypass, business-logic abuse, injection, and SSRF chained to internal access.
APIs
BOLA, BFLA, mass assignment, and broken auth across REST, GraphQL, and gRPC.
Internal & network
Post-foothold lateral movement, privilege escalation, and domain compromise.
Cloud & identity
Over-privileged roles, token replay, federation tampering, and metadata-service pivots.
Mobile
Insecure storage, certificate-pinning bypass, hardcoded secrets, and client-side API abuse.
Source-assisted
Code-informed testing where you grant access. A faster path to the flaw that matters.
What we test —
Six SAP surfaces. One engagement.
Every layer of the SAP landscape gets a manual, threat-modelled review against its real attack surface — kernel, database, presentation, transport, custom code, and authorization. Intensity tunes per scope.
NetWeaver / ABAP kernel
RECON-class unauth user creation (CVE-2020-6287 family), ICMAD memory corruption (CVE-2022-22536 family), authority-object bypass against S_TCODE / S_DEVELOP / S_RFC, ABAP code injection in dynamic CALL TRANSACTION and EXECUTE IMMEDIATELY, transport-request abuse, message server unauthenticated registration.
SAP HANA
SQL injection in custom procedures, SYSTEM privilege escalation, cross-schema access via shared CDS views, _SYS_REPO mis-grants, encryption-at-rest verification, audit-policy gaps, XSA tenant boundary bypass, replication-route abuse on system replication.
S/4HANA & ECC business logic
Segregation-of-duties chains that move money — vendor master maintenance + invoice posting + payment release in one user; F110 payment program abuse via spoofed bank master; MIRO three-way-match bypass; goods-receipt reversal-and-repost flows that paper over inventory shrink.
Fiori / UI5 frontend
OData service authorisation gaps, CSRF token reuse across sessions, UI5 mock-data leakage, Launchpad role-hiding bypass, Gateway service /sap/opu/odata/ exposure, web-dispatcher header-rewrite abuse, BSP application chained-XSS to ABAP RFC.
SAProuter & RFC Gateway
Gateway ACL bypass (reginfo / secinfo gaps), unauthenticated RFC server registration, message-server SXM access, SAProuter route-permission leakage, DIAG / RFC protocol replay where TLS isn't terminated, exposure of internal load-balancer behind public listener.
Custom Z* code & roles
Z-program authority-check omissions, hardcoded SAP* / DDIC credentials in customer transports, ABAP open-SQL injection in customer namespaces, role/profile drift between DEV and PROD landscapes, derived-role inheritance abuse, GRC mitigations that whitelist the chain rather than break it.
What we test
Eight application surfaces. One engagement.
These are the surfaces SecureLayer7's app-sec practice operates across. Every surface in scope by default; intensity tunes per engagement.
Authentication & Session
Login bypass, session fixation, token prediction, password reset flaws, MFA weaknesses, federation bypass, OAuth/OIDC misconfig.
Authorization & Access Control
IDOR, broken object-level auth, privilege escalation, multi-tenant bleed, role/scope-checking gaps in API + UI.
Business Logic
Price manipulation, workflow abuse, state-machine bypass, race conditions, the chained exploits unique to your application.
API surfaces (REST · GraphQL · gRPC · MQTT)
REST + GraphQL, BOLA, mass assignment, query-cost, schema introspection. gRPC, protobuf field abuse, reflection leaks, streaming-method DoS, mTLS misconfig. MQTT, broker auth, ACL bypass, retained-message exposure, topic-injection across IoT/real-time brokers.
Data Storage & Encryption
Local storage exposure, key management, encryption-at-rest verification, transit ciphers, certificate pinning.
Injection & Execution
SQLi, XXE, SSTI, command injection, deserialization, prototype pollution, tested manually with chained exploits, not just signatures.
Configuration & Secrets
Exposed admin panels, misconfigured headers, leaked secrets in JS bundles, third-party SDK exposure, server-side config drift.
Web3 / Smart Contracts
Solidity audit (reentrancy, integer over/underflow, access-control gaps, unchecked external calls, gas-griefing, oracle manipulation), EIP-712 signature reuse, wallet-connect phishing flows, multicall + delegatecall abuse, ERC-20/ERC-721 approve-and-drain, bridge replay, MEV / front-running on dApp UX.
What we test
Four AWS surfaces. One Org-wide engagement.
Every AWS pentest is threat-modelled to your Org structure, IAM graph, and account topology, then exercised by hand against named bug classes across identity, compute, data, and posture controls.
Identity & access
IAM role chaining, sts:AssumeRole over-scope, IAM Identity Center / SSO permission-set drift, Cognito user-pool ID-token confusion, instance-profile credential reuse, federated-role trust-policy bypass, IAM Access Analyzer blind spots, root-account fallback paths.
Compute & runtime
EC2 IMDSv2-bypass via SSRF, Lambda execution-role over-scope, EKS service-account abuse, ECS task-role chaining, Fargate trust-policy reuse, EBS snapshot exfil, AMI-based persistence, Systems Manager Session Manager impersonation.
Data & storage
S3 bucket-policy bypass, Object Ownership confusion, KMS key-policy misuse, Secrets Manager rotation drift, RDS IAM-auth gap, DynamoDB stream replay, EBS snapshot public exposure, Glue catalog data leakage.
Posture & detection
CloudTrail trail-tampering, GuardDuty finding suppression, AWS Config rule drift, AWS Organizations SCP gaps, CloudWatch log-group ACL bypass, EventBridge rule reuse, Audit Manager evidence drift, IAM Access Analyzer false-clean.
What we test
Four cloud surfaces. One engagement.
Each provider gets a manual, threat-modelled review against its real attack surface, control plane, identity, network, and workload. Intensity tunes per scope.
Amazon AWS
IMDSv1 SSRF, IAM role chaining, public S3 enumeration, Lambda over-privilege, EKS cluster-role abuse, KMS key-policy misuse, Cognito user-pool misconfig, Secrets Manager exposure.
Microsoft Azure
Managed identity over-scope, Storage Account SAS leak, Function App env exposure, AKS pod-identity abuse, Key Vault access policy bypass, Azure AD application consent, Logic App secret reuse.
Google Cloud Platform
Workload-identity confusion, service-account impersonation, Cloud Run scope abuse, GKE node pool escape, Secret Manager IAM gaps, Cloud Storage bucket policy bypass, Cloud Functions trigger replay.
Kubernetes
Pod escape via privileged container, RBAC bypass, etcd exposure, kubelet API abuse, sidecar/init container attack paths, NetworkPolicy gaps, admission-controller bypass, ServiceAccount token theft.
What we cover
Six surfaces in one enterprise penetration testing engagement.
Each surface scoped against named bug classes, not generic checklists. One pod chains findings across surfaces, so a phishing foothold can follow into AD and then into the cloud on the same SOW.
External perimeter
Subdomain takeover, exposed admin panels on edge devices, default credentials on appliances, leaked credentials in paste sites and code repos. Inventory feeds the internal phase.
Internal network
SMB relay, Kerberoasting, NTLM hash capture, lateral movement via WMI and PsExec, unconstrained delegation paths. Assumed-breach foothold, then chain to identity.
Active Directory / identity
ADCS ESC1–ESC8 abuse, constrained delegation, DCSync, BloodHound paths to Domain Admin, Entra ID conditional-access bypass. Identity is treated as its own surface, not a footnote.
Cloud: AWS · Azure · GCP
IMDSv1 SSRF, IAM role-chain abuse, S3 enumeration and policy gaps, Lambda over-privilege, AKS pod-identity abuse, GCP service-account impersonation across projects.
Web applications + APIs
Authentication bypass, IDOR, business-logic flaws, SSRF into cloud metadata, deserialization, GraphQL introspection abuse, broken object-property authorization on REST.
Email · phishing · OAuth abuse
Sender spoofing on misconfigured SPF/DMARC, MFA fatigue, browser-in-browser pretexts, OAuth consent grant abuse against M365 and Workspace tenants.
How an enterprise engagement runs ,
Five phases. One closed loop.
A written plan before traffic flows, four execution phases that chain findings across surfaces, and a consolidated report with a free re-test on the same scope. No phase ends until its evidence is in the report.
01
Threat-model & scoping
Enumerate the surfaces in scope, the business-critical assets behind each, the attacker objectives that matter to the board, and the rules of engagement. Output: a written engagement plan with named bug classes per pillar, signed off by your security lead before a single packet flows.
02
External + reconnaissance
Subdomain enumeration, certificate-transparency mining, leaked-credential checks across paste sites and breach corpora, exposed-admin discovery on edge devices and SaaS tenants. The inventory and any initial footholds are handed cleanly to the internal phase.
03
Internal + identity
Assumed-breach foothold on a workstation segment, then Active Directory path discovery, Kerberoasting, ADCS ESC8, unconstrained delegation, BloodHound graphs to Domain Admin. Lateral movement is chained against business assets, not isolated as a finding count.
04
Cloud + applications
The same pod pivots from on-prem identity into AWS, Azure, and GCP control planes, then into the web and API attack surface above them. Findings chain across, phish to AD to cloud to app, and are written as one kill chain, not four bullet lists.
05
Report & re-test
One consolidated report with chained-finding narratives, code-level remediation, CREST-mapped severity, and PoC artifacts your dev team can replay. A free re-test on the same scope once fixes land, with a delta report for the auditor.
What we review —
Four review surfaces. One engagement.
Each surface is read for intent against the live config, then probed by hand for the chain that survived the policy. Vendor-specific guidance for ASA, Cisco IOS, Palo Alto Networks, FortiGate, Check Point, pfSense, and Juniper SRX.
Ruleset
Any/any ranges, shadowed and preempted rules, dead policy, stale comments, source/destination group drift, NAT translation chains, log-scope coverage, asymmetric-routing exposure.
Deployment & segmentation
Zone map and blast-radius from each zone, redundant placement, fail-open vs fail-close behaviour, management-plane isolation, jump-host enforcement, out-of-band path scope.
Services & management plane
SSH cipher and KEX policy, HTTPS-mgmt scope, SNMPv2 community strings, TFTP and HTTP exposure, AAA · RADIUS · TACACS+ scope, two-factor on admin paths, session-timeout policy.
Software & signatures
OS train versus vendor advisories, IPS signature freshness, AV pattern coverage, EOL-hardware risk, planned-upgrade gaps, vulnerability-feed staleness.
What we test
Four GCP surfaces. One method.
Each surface scoped against named bug classes. We chain across them. A Workload Identity token misuse can land in BigQuery, exfiltrating data tagged for VPC Service Controls.
VPC + perimeter
VPC Service Controls bypass, firewall egress oversight, Identity-Aware Proxy misconfig, Cloud NAT exposure. Lateral movement chained inside the perimeter.
IAM + identity
Service account impersonation via iam.serviceAccounts.actAs, allow-policy plus deny-policy interaction gaps, Organization policy drift, custom-role privilege creep.
GKE + workloads
Node pool escape via privileged pod, GKE Autopilot constraint bypass, Workload Identity binding abuse, metadata API exposure inside the pod.
Storage + secrets
Cloud Storage bucket IAM, signed-URL leakage, Secret Manager accessor scope, Cloud KMS key policy bypass, Firestore unauth read.
What we test
Six surfaces. Every one read on the bench.
IoT is a stack, a board, a firmware, a radio, a mobile companion, a backend the device dials home to. Each layer is reviewed by hand against the real attack surface, in the protocols and tools your team ships in.
Hardware bench, UART · JTAG · SWD · SPI flash · I²C
Enclosure opened. Test points probed with a logic analyzer. Debug interfaces brought up under OpenOCD / J-Link. SPI flash desoldered or read in-circuit, then dumped. Boot ROM and bootloader behaviour exercised against fault-injection where in scope.
Firmware, binwalk · squashfs · u-boot · secure-boot · hardcoded creds
Image carved with binwalk, root filesystem mounted, init scripts and busybox binaries reviewed by hand. Hardcoded API tokens, TLS keys, and PEM blobs extracted. Weak secure-boot anchors and unsigned bootloader-stage upgrades reported with the patch path.
Radio, BLE · Zigbee · Z-Wave · LoRa · Sub-GHz · 802.11
Packet captures with HackRF, Ubertooth, RFCat. BLE GATT walked for unauth read / write. Pairing bypass under Just Works mishandling. Zigbee key-establishment replay. LoRa join-accept tampering. Wi-Fi WPS and EAP downgrade where the device exposes them.
Mobile companion, paired iOS / Android binary
Companion app pulled from the store, instrumented under Frida, the pairing flow and deeplink handlers walked end to end. Hardcoded device secrets, weak certificate pinning to the cloud, and OAuth-state mishandling in account-linking flows.
Cloud, MQTT & OTA channel
Broker authentication walked for client-id reuse and topic over-subscription. Topic tree walked from a low-priv account for tenant isolation gaps. OTA update channel tested for unsigned image acceptance, downgrade attacks, and roll-back to a vulnerable build.
Web / device admin UI
Local admin UI, mDNS / SSDP service, and any cloud portal tested for default credentials, CSRF on state-changing endpoints, exposed /debug or /diag routes, command injection in network-config forms, and authentication-bypass via unauth API parity.
on record ,
Accredited testers, audited handling.
CREST is the standard for offensive security execution. CERT-In, SOC 2 Type II, and ISO/IEC 27001 cover how SecureLayer7 handles your cluster evidence, Kubernetes artefacts, and your engagement record.
CERT-In
Empanelled auditor
SOC 2 Type II
Independently audited
ISO/IEC 27001
Information Security Management
Mapped to audit requirements across
SOC 2 TYPE IIPCI DSSHIPAAISO/IEC 27001GDPRNIST CSFFEDRAMPAND OTHERS
Scope ,
Four cluster planes. One engagement.
Most cluster reviews stop at isolated findings. We chain control plane exposure, workload breakout, identity and secrets, and supply-chain trust in one engagement, mapped to your topology and exercised manually against the bug classes that appear once an attacker already has a foothold.
Control plane
kube-apiserver anonymous-auth, etcd 2379 exposure, kubelet 10250 unauth, scheduler / controller-manager metrics leak, admission-webhook race, audit-policy gap, /healthz info disclosure, in-cluster API server SSRF.
Workload & data plane
Privileged-container escape, hostPath / hostNetwork / hostPID abuse, SYS_ADMIN & NET_RAW capability misuse, missing seccomp / AppArmor, PodSecurityStandards bypass, NetworkPolicy default-allow, sidecar trust-boundary leak, ConfigMap secrets leak.
Identity, RBAC & secrets
ServiceAccount token theft and replay, escalate / impersonate / bind verb chaining, over-scoped ClusterRoleBinding, projected-token reuse across namespaces, IRSA / Workload-Identity confusion, External-Secrets misconfig, kubectl auth can-i blind spots.
Supply chain
Mutating-webhook abuse, unsigned-image admission, ImagePullSecret leak, base-image typosquat, SBOM tampering, GitOps repo and pipeline takeover, Helm-chart values injection, registry-credential reuse across clusters.
What we cover
Eight layers. Every one read by hand and hooked at runtime.
Mobile is a stack: the binary, the runtime, the IPC, the network, the backend it actually calls. We test each layer in the language and toolchain your team ships in.
iOS native, Swift · Objective-C · SwiftUI
Keychain access-control mishandling, ATS bypass via NSAllowsArbitraryLoads, URL-scheme hijack, Universal Links validation gaps, App Group leakage, jailbreak-detection bypass under Frida.
Android native, Kotlin · Java · Compose
Exported-activity hijack, intent injection, ContentProvider authority abuse, insecure SharedPreferences, Keystore mishandling, root-detection bypass, Smali patch under MOBSF / objection.
Hybrid, React Native · Flutter · Cordova · Ionic
JS-bridge exposure, deserialised props from native to JS, asset bundle tampering, hot-reload server abuse on dev builds shipped to prod, Flutter snapshot reverse-engineering.
WebView surface
addJavascriptInterface RCE, file:// URI access from a remote origin, mixed content, intent:// scheme abuse, JS-to-native bridge auth gaps, cookie scope leakage between WebView and host app.
Inter-process communication (IPC)
Android intents, iOS URL schemes, Universal Links, App Links, broadcast receivers, deep-link OAuth-state mishandling, activity-stack tampering, share-sheet payload injection.
Mobile API & backend
REST and GraphQL endpoints called only by the mobile client, broken object-level authZ, mass assignment, mobile-only auth flows, refresh-token rotation gaps, abuse of mobile-specific headers as trust signals.
Embedded SDKs & native libs
Third-party SDKs (analytics, payments, in-app messaging) audited for over-permission and data exfiltration. JNI / NDK native libs reviewed for buffer overflow, format-string, use-after-free, and unsafe FFI boundaries.
Reverse engineering & resilience
Mach-O / DEX / Smali disassembly under IDA, Ghidra, jadx. Hardcoded API keys, signing material, and crypto secrets extracted from the binary. Control-flow obfuscation and tamper-detection tested against real bypasses, not vendor claims.
What we test
Four network surfaces. One engagement.
Each boundary gets a manual, threat-modelled review against its real attack surface, perimeter, AD-joined estate, wireless edge, and the devices that route between them. Intensity tunes per scope.
External, internet-facing
Subdomain takeover, exposed RDP/SSH/SMB, vendor-portal SSRF, VPN-appliance CVE chains, perimeter mail-relay abuse, exposed git/CI endpoints, ASN-wide cert-transparency mining, and credential-leak correlation against the perimeter login surface.
Internal, east-west + AD
SMB-signing NTLM relay, kerberoasting and AS-REProasting, mitm6 + WPAD coercion, ADCS ESC1–ESC8 abuse, LAPS-password reuse, Group Policy preference passwords, BloodHound-mapped attack paths to Domain Admin and Tier-0 hosts.
Wireless, Wi-Fi + 802.1X
WPA2/WPA3 handshake capture and crack, EAP-TLS cert-pinning bypass, PEAP/MSCHAPv2 relay, rogue-AP and KARMA, 802.1X NAC bypass via MAC spoof, guest-network pivot, captive-portal credential harvest.
Devices, firewalls, switches, routers
Exposed management interfaces (SSH/HTTPS/SNMP), default and stale credentials, ACL bypass via spoofed source, SNMPv2 community brute-force, IPv6-routing override, firmware-CVE pivot to lateral access.
What we test on-demand
One engagement model. Every target you ship.
Web, mobile, API, network, internal, brought under one delivery model. You don’t have to pick a discipline before you scope; we right-size the team and the depth to your target.
Web applications
Single SPA, multi-tenant, e-commerce, internal portal. Auth flows, RBAC, business logic, payment-stage integrity, manually walked, not scanner-rubber-stamped.
REST + GraphQL APIs
OWASP API Top 10 mapped. BOLA, mass assignment, broken object-level authZ, rate-limit bypass, schema introspection abuse, refresh-token rotation gaps.
Mobile apps (iOS · Android)
Native, hybrid, and cross-platform builds. Static + runtime instrumentation under Frida, deeplink hijack, Keychain / Keystore mishandling, addJavascriptInterface RCE.
Network IPs (internal + external)
Service enumeration, exposed admin panels, weak auth chains, default-credential pivots, RCE chains into the application stack, walked by hand, not just nmap output.
Internal apps + admin portals
VPN-gated, SSO-fronted, role-segmented apps. Same auth depth as external surfaces, mapped to your insider threat model and least-privilege contract.
Cloud + container surfaces
AWS, Azure, GCP, Kubernetes, IAM mishandling, managed-identity over-scope, IMDSv1 SSRF, pod-to-host RBAC bypass under your real workload identity model.
What the crew brings
Seven attack surfaces. One adversary.
These are the surfaces SecureLayer7's red team operates across. Black Box engagements run all seven. Assumed Breach and Threat-Led include the digital surfaces by default; physical, social, and wireless are scoped in when the engagement narrative requires them, not bolted on as upsells.
Network
External reconnaissance, internet-facing service exploitation, then internal east-west pivoting once foothold is established. Mapped to ATT&CK Initial Access + Lateral Movement.
Identity
Active Directory trust abuse, Kerberoasting, delegation paths, cloud-IAM lateral movement, credential theft chains, and the misconfigurations checklists never reach.
Application
Chained business-logic exploits, authentication confusion, multi-step flow abuse, and the auth boundaries scanners cannot model. Web, API, and SaaS-tenant boundaries.
Cloud
AWS / Azure / GCP IAM misuse, metadata-service abuse, secrets-manager pivoting, cross-account trust paths, and SaaS-tenant trust escalation. Scoped to the cloud surface area you actually run.
Physical
On-site reconnaissance, tailgating, badge cloning, lock bypass, and covert-access device placement on a wired network drop. Once inside, the digital crew picks up from the physical foothold. Engagement is consent-bounded, recorded, and de-escalated on first detection by your team.
Social engineering
Spear phishing, vishing, pretexting against helpdesk / IT support, MFA-fatigue prompts, and supply-chain personas (vendors, contractors, recruiters). Targets the humans your security awareness training assumes are trained.
Wireless
Rogue access points, evil-twin captive portals, EAP-credential capture, and segmentation-bypass paths from guest VLAN to corporate. Tested at your physical perimeter and inside acquired tenants.
What we test
Six SAP surfaces. One engagement.
Every layer of the SAP landscape gets a manual, threat-modelled review against its real attack surface, kernel, database, presentation, transport, custom code, and authorization. Intensity tunes per scope.
NetWeaver / ABAP kernel
RECON-class unauth user creation (CVE-2020-6287 family), ICMAD memory corruption (CVE-2022-22536 family), authority-object bypass against S_TCODE / S_DEVELOP / S_RFC, ABAP code injection in dynamic CALL TRANSACTION and EXECUTE IMMEDIATELY, transport-request abuse, message server unauthenticated registration.
SAP HANA
SQL injection in custom procedures, SYSTEM privilege escalation, cross-schema access via shared CDS views, _SYS_REPO mis-grants, encryption-at-rest verification, audit-policy gaps, XSA tenant boundary bypass, replication-route abuse on system replication.
S/4HANA & ECC business logic
Segregation-of-duties chains that move money, vendor master maintenance + invoice posting + payment release in one user; F110 payment program abuse via spoofed bank master; MIRO three-way-match bypass; goods-receipt reversal-and-repost flows that paper over inventory shrink.
Fiori / UI5 frontend
OData service authorisation gaps, CSRF token reuse across sessions, UI5 mock-data leakage, Launchpad role-hiding bypass, Gateway service /sap/opu/odata/ exposure, web-dispatcher header-rewrite abuse, BSP application chained-XSS to ABAP RFC.
SAProuter & RFC Gateway
Gateway ACL bypass (reginfo / secinfo gaps), unauthenticated RFC server registration, message-server SXM access, SAProuter route-permission leakage, DIAG / RFC protocol replay where TLS isn't terminated, exposure of internal load-balancer behind public listener.
Custom Z* code & roles
Z-program authority-check omissions, hardcoded SAP* / DDIC credentials in customer transports, ABAP open-SQL injection in customer namespaces, role/profile drift between DEV and PROD landscapes, derived-role inheritance abuse, GRC mitigations that whitelist the chain rather than break it.
What we harden
Four server surfaces. One engagement.
Each tier is brought to a defensible baseline against its real attack surface, then probed by hand for the path that survived. Intensity tunes per scope.
Linux servers
Ubuntu · Debian · RHEL · CentOS · Alma · Rocky. Kernel sysctl, ssh key & cipher policy, sudo & PAM, /tmp & /var noexec, fail2ban, auditd, AppArmor / SELinux, package-manager hygiene.
Windows Server
Server 2016 / 2019 / 2022. SMB signing, LSA & credential guard, RDP NLA, GPO baseline (CIS / STIG), AppLocker / WDAC, Defender ASR, audit policy, scheduled-task review.
Web servers
Apache · Nginx · IIS · LiteSpeed. server-tokens, mod_status, request limits, TLS / HSTS / OCSP, ModSecurity rule set, .htaccess audit, PHP-FPM pool isolation, fastcgi cache scope.
Databases
MySQL · MariaDB · Postgres · MSSQL · Mongo · Redis. Default-creds review, least-privilege grants, network ACLs, audit logging, backup encryption at rest, secrets-manager binding, replication-account scope.
on record ,
Accredited testers, audited handling.
CREST accredits our organisation and every tester on your engagement. CERT-In empanelment plus SOC 2 Type II and ISO/IEC 27001 controls govern how source artefacts, secrets, and engagement records are stored, accessed, and handed back.
CREST
Accredited company & testers
CERT-In
Empanelled auditor
SOC 2 Type II
Independently audited
ISO/IEC 27001
Information Security Management
Mapped to audit requirements across
- SOC 2 Type II
- ISO/IEC 27001
- PCI DSS
- HIPAA
- GDPR
- NIST CSF
- FedRAMP
- and others
Scope ,
Seven stacks. Same depth on each.
Auditors who still ship production code in these stacks review yours by hand. We throttle depth based on trust boundaries and data sensitivity, with authentication surfaces, deserialisation paths, parsers, query builders, and IPC earning mandatory deep dives every time.
JVM, Java · Kotlin · Scala
Jackson polymorphic-typing gadgets (CVE-2017-7525 lineage), Spring SpEL / EL injection, JNDI / Log4Shell-style lookups, JDBC string concatenation, lock-order races on shared state, Servlet filter-bypass chains.
Go
Data races on shared maps and channels, `unsafe.Pointer` arithmetic across cgo bridges, raw-string SQL in `database/sql`, JWT `alg=none` acceptance, `text/template` over `html/template`, dependency-confusion in `go.mod` proxies.
Python
`pickle.loads` on user input, SSTI in Jinja / Mako templates, `eval` / `exec` reachable from request handlers, f-string SQL interpolation, `yaml.load` without `SafeLoader`, `subprocess(shell=True)` argument injection, path traversal via `os.path.join`.
Node · TypeScript
Prototype pollution through `lodash.merge` / `Object.assign`, ReDoS via catastrophic backtracking on user-controlled patterns, `child_process.exec` argument injection, JWT `alg` confusion, sandbox escape in `vm` / `node-serialize` patterns.
C · C++ · Rust unsafe
Buffer overflows, format-string bugs, use-after-free, double-free, OOB reads, integer / sign-conversion overflow in parsers and codecs · Rust `unsafe` audited for aliasing and invariant breaks across FFI boundaries.
PHP
LFI / RFI through `include` paths, object injection via `unserialize`, PHAR deserialisation gadgets, type-juggling (`==`) auth bypass, raw-SQL in legacy modules, `extract()` variable overwrites in framework caches.
Ruby · Rails
Mass assignment through `permit` gaps, `YAML.load` on user input, dynamic dispatch via `send` / `public_send`, raw-SQL in scope chains and `find_by_sql`, `Marshal.load` in cache stores, `constantize` on user input.
Telecom security ,
Assessments tied to how telecom fails in production. Not generic checklist work.
Attacks on telecom rarely stay in one layer, they cross signaling, core elements, and access edges. We scope around those boundaries so findings map to engineering work with clear risk, not scattered vulnerabilities on a spreadsheet.
Since 2012 we’ve tested operator-adjacent systems alongside enterprise apps and infrastructure, experience we use to model realistic paths, rank impact, and write remediation network teams can ship.
Reference scope: core, SS7/SIGTRAN interconnect, signaling trunk, RAN/LTE access
Coverage ,
Four planes we pressure-test. One engagement story.
We group telecom work into four themes, signaling, core stack, access edge, and enterprise voice, so planning stays readable. Pick what matches your risk focus; we tailor tasks inside each theme.
Signaling & interconnect
SS7 and SIGTRAN exposure, interconnect abuse paths, and protocol-level risks across peering, modeled for real operator handoffs, not generic scanning.
Core & mobile stack
GSM/3G core and LTE architecture reviews, segmentation and NE configuration, including MBSS-style baselines, so paths into HLR, SMSC-class systems and peers are explicit.
Access & subscriber edge
Air-interface penetration testing and SIM / USIM application security, where bypass, cloning, and misuse scenarios often show up before they touch core nodes.
Voice & enterprise telecom
IP-PBX, PSTN, and switching-adjacent environments reviewed for configuration drift, trunk abuse, and paths into the wider org.
Adjacent services ,
Often booked with telecom assessments. Same SL7 standards.
Pick the surface that matches your wider risk story.
Network penetration testing
Explore
In-and-out paths attackers actually take.
Subnets, firewalls, exposed services.
Ranked so you patch what hurts most.
Application security testing
Explore
Review + dynamic tests for APIs & apps.
Auth, sessions, data across tiers.
Shippable fixes for engineering.
Web application penetration testing
Explore
Browser flows attackers actually exploit.
OWASP-style depth, no filler checks.
XSS, injection, logic flaws.
Cloud & wireless-adjacent security
Explore
AWS · Azure · GCP drift & misconfigs.
Wireless + perimeter, same picture.
Cloud edge to LAN in one story.
Red team assessment
Explore
Real tradecraft & persistence.
Detection, IR, escalation, tested.
Leadership-ready, not vuln lists.
Scope & quote, contact us
Get in touch
Send scope, regions, timelines.
Proposal & deliverables, fast.
Same SL7 standards end to end.
ExpertSpotlight
ExpertSpotlight-services-telecom-network-security
## Q&A
Q: How long does a telecom network security engagement take?
A: Three to six weeks of active testing, plus a one-week scoping phase up front and a free re-test after fixes land. Window depends on core element count, signalling stack (SS7, SIGTRAN, Diameter), and roaming-partner scope.
Q: What is tested in a telecom security engagement?
A: Core elements, signalling, and control plane. Named bug classes: SS7 / SIGTRAN MAP message abuse (SRI-SM, AnyTimeInterrogation, InsertSubscriberData), Diameter S6a peer-spoofing, GTP tunnel injection, SIP trunk toll fraud at the IMS edge, core segmentation gaps between HLR / HSS and IT, and roaming-partner trust over-scope.
Q: Do you include a re-test?
A: Yes. Every telecom engagement includes a free re-test of the same scope after fixes land. The proof-of-exploit reverts on patch and we sign written closure for each finding.
Q: Which compliance frameworks does the report map to?
A: ISO/IEC 27001, SOC 2 Type II, NIST CSF, GSMA FS.11 / FS.19 / FS.20, and 3GPP TS 33-series alignment. Severity is CREST-mapped. SecureLayer7 is CERT-In empanelled, so the PDF is regulator-ready for Indian filings, including DoT and TRAI submissions.
Q: How does this differ from a generic network scan?
A: Generic network scans do not speak SS7, SIGTRAN, or Diameter. Telecom security testing exercises the signalling stack by hand, MAP message injection, peer-spoofed GTP, SIP-trunk toll fraud, risk-ranked against your core segmentation.
Q: Is the report regulator-ready?
A: Yes. CREST-mapped severity, a working proof-of-exploit per finding, segmentation diff guidance, and a regulator-ready PDF accepted across ISO/IEC 27001, SOC 2, GSMA FS-series, and CERT-In / DoT review cycles.
---
# Thick Client Penetration Testing Services
https://securelayer7.net/services/thick-client-pentest
Thick client application penetration testing from SecureLayer7. Manual reverse-engineering of Windows, macOS, Linux native apps plus .NET, Java, Electron desktop. DLL search-order hijack, named-pipe and XPC ACL abuse, IPC injection, memory analysis, anti-debug bypass, Frida runtime hooking. CREST-mapped report with free re-test.
Sl7WaptHero
Thick client application pentesting.
Past the network. Into the binary.
Manual thick client application penetration testing across Windows, macOS, Linux native apps plus .NET, Java, and Electron desktop. Tested by hand for DLL-search-order hijacking, named-pipe and XPC ACL abuse, hardcoded keys lifted out of process memory, custom-protocol replay over cleartext, and writable installer paths that escalate to NT AUTHORITY\SYSTEM. Every finding ships with a working proof-of-exploit, code-level fix guidance, and a free re-test.
Talk to a security expert
/contact-us
security-posture-review
See the methodology
#methodology
/media/thick-hero-v3-5a064ced.svg
Four desktop binary tiles, Windows PE,.NET, Mach-O, ELF, each annotated with one named bug class, traces converging on a reverse-engineering proof-of-exploit card lifting a DLL-hijack chain to NT AUTHORITY\SYSTEM.
Decompile
Instrument
Exploit
Report
ShieldCheck
Native binaries
Windows PE ·.NET · Java desktop · macOS Mach-O · Linux ELF · Electron / Tauri / CEF, every desktop runtime your team ships.
FileSearch
Evidence
Reverse-engineered proof-of-exploit and code-level fix guidance on every finding, Ghidra, Frida, x64dbg artefacts attached.
RotateCcw
Re-test included
We verify your fixes at no extra cost. One engagement, closed loop.
THICK.
top-right
outline
Sl7WaptHero-0-keg24a
TrustStrip
TrustStrip-services-thick-client-pentest
CredentialStrip
On record
Same accreditations on every engagement.
CREST is the standard for offensive security execution. CERT-In, SOC 2 Type II, and ISO/IEC 27001 cover how SecureLayer7 handles your binary, your environment, and your engagement record.
center
CREST
Accredited company & testers
CERT-In
Empanelled auditor
SOC 2 Type II
Independently audited
ISO/IEC 27001
Information Security Management
Mapped to engagement requirements across
SOC 2 Type II · PCI DSS · HIPAA · ISO/IEC 27001 · GDPR · NIST CSF · FedRAMP · and others
AUDITED.
CredentialStrip-1-bhveo4
dark
badge-row
TextSection
Why a web pentest can't see this
Web testing stops at HTTP.
The risk lives past the boundary.
Your web pentest reaches authentication, session, and the API. The same binary running on a workstation also reaches process memory, named pipes, the registry, the DLL search path, and the kernel. SecureLayer7 operators load your binary into Ghidra and Frida and report the chain that starts where the HTTP scope ends, DLL hijack to SYSTEM, hardcoded key in.data, IPC ACL bypass to a privileged service. Every finding is reproducible, code-level fixable, and re-tested before sign-off.
/media/thick-boundary-v2-9ee1786d.svg
Two scopes from a single binary, a short cream arrow stops at HTTP labeled WEB SCOPE; a longer orange arrow extends through PROCESS, IPC, MEMORY, and KERNEL waypoints to a final BINARY SCOPE label.
right
BOUNDARY.
TextSection-3-1d6hdj
light
RawHtml
control
RawHtml-2-thick-runtimes
What we test
Six desktop runtimes. One engagement.
Each runtime gets a manual reverse-engineering pass against its real attack surface, binary on disk, process in memory, IPC channels, and the backend it pairs with. Intensity tunes per scope.
Windows native (PE / COFF)
DLL search-order hijacking, COM hijacking, Authenticode bypass, named-pipe and RPC ACL abuse, service / scheduled-task permission writes, registry hijacks, AppLocker / WDAC bypass, signed-installer write-paths to NT AUTHORITY\SYSTEM.
.NET assemblies
dnSpy / ILSpy round-trip, hardcoded keys and connection strings in /resources, BinaryFormatter and ObjectStateFormatter deserialization gadgets, Json.NET TypeNameHandling abuse, reflection bypass, Strong-Name forgery, ClickOnce manifest tampering.
Java desktop (JAR / JavaFX)
JD-GUI / CFR decompile, signed-JAR replacement, classpath shadowing, Spring / Beanshell injection, JMX management exposure, Java RMI deserialization, native-library (JNI) hijack, hardcoded JDBC credentials in /META-INF.
macOS native (Mach-O)
DYLD_INSERT_LIBRARIES, weak-dylib hijack, codesign and hardened-runtime bypass, XPC service ACL abuse, TCC / privacy-prompt evasion, Keychain ACL misuse, sandbox escape via privileged helpers (SMJobBless, installerd).
Linux native (ELF)
LD_PRELOAD on SUID binaries, RPATH / RUNPATH abuse, .got and .plt write paths, systemd unit override, capability misuse, world-writable shared libraries, D-Bus policy bypass, namespace and cgroup escape.
Electron / Tauri / CEF
ASAR unpack, nodeIntegration leak across renderer-to-main IPC, contextIsolation bypass, custom-protocol handler abuse, autoUpdate signature bypass, Chromium-extension prototype pollution into Node, hardcoded tokens lifted from app.asar.
What we test ,
Four planes of the call. One engagement.
Each layer gets a manual, threat-modelled review against its real attack surface, signalling, media, infrastructure, and the trunk edge. Intensity tunes per scope.
Signalling, SIP / SDP
REGISTER hijacking, INVITE flooding, BYE/CANCEL race conditions, SDP rewriting, ALG bypass, digest-auth replay, contact-header rewrite, and presence-leak via SUBSCRIBE/NOTIFY.
Media, RTP / SRTP
RTP eavesdropping, ZRTP/SRTP downgrade, DTMF injection, codec confusion, replay across the media stream, comfort-noise abuse, and media-relay bypass.
Infrastructure, PBX core
Asterisk AMI/CLI exposure, FreeSWITCH event-socket misconfiguration, Cisco CUCM AXL credential leak, dialplan logic abuse, voicemail PIN brute force, IVR fingerprinting and option escape.
Edge, SBC + SIP trunk
SBC peering misconfiguration, voice-VLAN hopping, SIP trunk toll fraud, IAX2 brute force, NAT/ALG traversal abuse, peer-spoofed call replays, and geo-routing rule override.
What we test
The whole airspace. Not just the SSID list.
Each layer of your wireless estate is reviewed by hand against its real attack surface, corporate Wi-Fi, 802.1X / RADIUS, the rogue-AP boundary, and the BYOD / guest edge. Intensity tunes per scope.
802.11, WPA2 / WPA3 / WPS
PMKID capture via hcxdumptool, 4-way handshake collection under deauth, offline crack with hashcat, WPS PIN brute force (Pixie Dust), WPA3 SAE downgrade (Dragonblood), MFP / 802.11w not enforced, PMF-not-required client trap.
802.1X, EAP-TLS / PEAP / EAP-MSCHAPv2
Server-cert validation off on clients, PEAP outer-tunnel bypass, EAP-MSCHAPv2 cleartext relay, EAP-TLS cert-pinning gaps, RADIUS shared-secret re-use across SSIDs, MAC-RADIUS bypass, NPS / FreeRADIUS misconfig.
Rogue AP, Evil Twin / KARMA / Deauth
Same-SSID rogue stood up with hostapd-mana, broadcast-PROBE-RESPONSE KARMA, captive-portal harvest of corporate creds, MAC randomization detection bypass, Wireless IDS / WIPS evasion, deauth flood under MFP-off.
Captive / BYOD, Guest VLAN / NAC / MDM
Captive-portal UAM bypass, guest-to-corporate VLAN escape via DHCP / IPv6 abuse, NAC posture-check bypass, MDM-issued client cert lift, BYOD MAC-allowlist spoof, Wi-Fi Direct lateral pivot, hidden-SSID probe-leak reveal.
What we test
Eight application surfaces. One engagement.
These are the surfaces SecureLayer7's app-sec practice operates across. Every surface in scope by default; intensity tunes per engagement.
Authentication & Session
Login bypass, session fixation, token prediction, password reset flaws, MFA weaknesses, federation bypass, OAuth/OIDC misconfig.
Authorization & Access Control
IDOR, broken object-level auth, privilege escalation, multi-tenant bleed, role/scope-checking gaps in API + UI.
Business Logic
Price manipulation, workflow abuse, state-machine bypass, race conditions, the chained exploits unique to your application.
API surfaces (REST · GraphQL · gRPC · MQTT)
REST + GraphQL, BOLA, mass assignment, query-cost, schema introspection. gRPC, protobuf field abuse, reflection leaks, streaming-method DoS, mTLS misconfig. MQTT, broker auth, ACL bypass, retained-message exposure, topic-injection across IoT/real-time brokers.
Data Storage & Encryption
Local storage exposure, key management, encryption-at-rest verification, transit ciphers, certificate pinning.
Injection & Execution
SQLi, XXE, SSTI, command injection, deserialization, prototype pollution, tested manually with chained exploits, not just signatures.
Configuration & Secrets
Exposed admin panels, misconfigured headers, leaked secrets in JS bundles, third-party SDK exposure, server-side config drift.
Web3 / Smart Contracts
Solidity audit (reentrancy, integer over/underflow, access-control gaps, unchecked external calls, gas-griefing, oracle manipulation), EIP-712 signature reuse, wallet-connect phishing flows, multicall + delegatecall abuse, ERC-20/ERC-721 approve-and-drain, bridge replay, MEV / front-running on dApp UX.
What we test
Four AWS surfaces. One Org-wide engagement.
Every AWS pentest is threat-modelled to your Org structure, IAM graph, and account topology, then exercised by hand against named bug classes across identity, compute, data, and posture controls.
Identity & access
IAM role chaining, sts:AssumeRole over-scope, IAM Identity Center / SSO permission-set drift, Cognito user-pool ID-token confusion, instance-profile credential reuse, federated-role trust-policy bypass, IAM Access Analyzer blind spots, root-account fallback paths.
Compute & runtime
EC2 IMDSv2-bypass via SSRF, Lambda execution-role over-scope, EKS service-account abuse, ECS task-role chaining, Fargate trust-policy reuse, EBS snapshot exfil, AMI-based persistence, Systems Manager Session Manager impersonation.
Data & storage
S3 bucket-policy bypass, Object Ownership confusion, KMS key-policy misuse, Secrets Manager rotation drift, RDS IAM-auth gap, DynamoDB stream replay, EBS snapshot public exposure, Glue catalog data leakage.
Posture & detection
CloudTrail trail-tampering, GuardDuty finding suppression, AWS Config rule drift, AWS Organizations SCP gaps, CloudWatch log-group ACL bypass, EventBridge rule reuse, Audit Manager evidence drift, IAM Access Analyzer false-clean.
What we test
Four cloud surfaces. One engagement.
Each provider gets a manual, threat-modelled review against its real attack surface, control plane, identity, network, and workload. Intensity tunes per scope.
Amazon AWS
IMDSv1 SSRF, IAM role chaining, public S3 enumeration, Lambda over-privilege, EKS cluster-role abuse, KMS key-policy misuse, Cognito user-pool misconfig, Secrets Manager exposure.
Microsoft Azure
Managed identity over-scope, Storage Account SAS leak, Function App env exposure, AKS pod-identity abuse, Key Vault access policy bypass, Azure AD application consent, Logic App secret reuse.
Google Cloud Platform
Workload-identity confusion, service-account impersonation, Cloud Run scope abuse, GKE node pool escape, Secret Manager IAM gaps, Cloud Storage bucket policy bypass, Cloud Functions trigger replay.
Kubernetes
Pod escape via privileged container, RBAC bypass, etcd exposure, kubelet API abuse, sidecar/init container attack paths, NetworkPolicy gaps, admission-controller bypass, ServiceAccount token theft.
What we cover
Six surfaces in one enterprise penetration testing engagement.
Each surface scoped against named bug classes, not generic checklists. One pod chains findings across surfaces, so a phishing foothold can follow into AD and then into the cloud on the same SOW.
External perimeter
Subdomain takeover, exposed admin panels on edge devices, default credentials on appliances, leaked credentials in paste sites and code repos. Inventory feeds the internal phase.
Internal network
SMB relay, Kerberoasting, NTLM hash capture, lateral movement via WMI and PsExec, unconstrained delegation paths. Assumed-breach foothold, then chain to identity.
Active Directory / identity
ADCS ESC1–ESC8 abuse, constrained delegation, DCSync, BloodHound paths to Domain Admin, Entra ID conditional-access bypass. Identity is treated as its own surface, not a footnote.
Cloud: AWS · Azure · GCP
IMDSv1 SSRF, IAM role-chain abuse, S3 enumeration and policy gaps, Lambda over-privilege, AKS pod-identity abuse, GCP service-account impersonation across projects.
Web applications + APIs
Authentication bypass, IDOR, business-logic flaws, SSRF into cloud metadata, deserialization, GraphQL introspection abuse, broken object-property authorization on REST.
Email · phishing · OAuth abuse
Sender spoofing on misconfigured SPF/DMARC, MFA fatigue, browser-in-browser pretexts, OAuth consent grant abuse against M365 and Workspace tenants.
How an enterprise engagement runs ,
Five phases. One closed loop.
A written plan before traffic flows, four execution phases that chain findings across surfaces, and a consolidated report with a free re-test on the same scope. No phase ends until its evidence is in the report.
01
Threat-model & scoping
Enumerate the surfaces in scope, the business-critical assets behind each, the attacker objectives that matter to the board, and the rules of engagement. Output: a written engagement plan with named bug classes per pillar, signed off by your security lead before a single packet flows.
02
External + reconnaissance
Subdomain enumeration, certificate-transparency mining, leaked-credential checks across paste sites and breach corpora, exposed-admin discovery on edge devices and SaaS tenants. The inventory and any initial footholds are handed cleanly to the internal phase.
03
Internal + identity
Assumed-breach foothold on a workstation segment, then Active Directory path discovery, Kerberoasting, ADCS ESC8, unconstrained delegation, BloodHound graphs to Domain Admin. Lateral movement is chained against business assets, not isolated as a finding count.
04
Cloud + applications
The same pod pivots from on-prem identity into AWS, Azure, and GCP control planes, then into the web and API attack surface above them. Findings chain across, phish to AD to cloud to app, and are written as one kill chain, not four bullet lists.
05
Report & re-test
One consolidated report with chained-finding narratives, code-level remediation, CREST-mapped severity, and PoC artifacts your dev team can replay. A free re-test on the same scope once fixes land, with a delta report for the auditor.
What we review
Four review surfaces. One engagement.
Each surface is read for intent against the live config, then probed by hand for the chain that survived the policy. Every finding ships with the exact rule, the proof it passes traffic, and the fix. Vendor-specific for ASA, Cisco IOS, Palo Alto Networks, FortiGate, Check Point, pfSense, and Juniper SRX.
Ruleset
Any/any ranges, shadowed and preempted rules, dead policy, stale comments, source/destination group drift, NAT translation chains, log-scope coverage, asymmetric-routing exposure.
Deployment & segmentation
Zone map and blast-radius from each zone, redundant placement, fail-open vs fail-close behaviour, management-plane isolation, jump-host enforcement, out-of-band path scope.
Services & management plane
SSH cipher and KEX policy, HTTPS-mgmt scope, SNMPv2 community strings, TFTP and HTTP exposure, AAA · RADIUS · TACACS+ scope, two-factor on admin paths, session-timeout policy.
Software & signatures
OS train versus vendor advisories, IPS signature freshness and drift, AV pattern coverage, SSL-inspection coverage and decryption-bypass gaps, TLS 1.3 visibility, EOL-hardware risk, planned-upgrade gaps, vulnerability-feed staleness.
What we test
Four GCP surfaces. One method.
Each surface scoped against named bug classes. We chain across them. A Workload Identity token misuse can land in BigQuery, exfiltrating data tagged for VPC Service Controls.
VPC + perimeter
VPC Service Controls bypass, firewall egress oversight, Identity-Aware Proxy misconfig, Cloud NAT exposure. Lateral movement chained inside the perimeter.
IAM + identity
Service account impersonation via iam.serviceAccounts.actAs, allow-policy plus deny-policy interaction gaps, Organization policy drift, custom-role privilege creep.
GKE + workloads
Node pool escape via privileged pod, GKE Autopilot constraint bypass, Workload Identity binding abuse, metadata API exposure inside the pod.
Storage + secrets
Cloud Storage bucket IAM, signed-URL leakage, Secret Manager accessor scope, Cloud KMS key policy bypass, Firestore unauth read.
What we test
Six surfaces. Every one read on the bench.
IoT is a stack, a board, a firmware, a radio, a mobile companion, a backend the device dials home to. Each layer is reviewed by hand against the real attack surface, in the protocols and tools your team ships in.
Hardware bench, UART · JTAG · SWD · SPI flash · I²C
Enclosure opened. Test points probed with a logic analyzer. Debug interfaces brought up under OpenOCD / J-Link. SPI flash desoldered or read in-circuit, then dumped. Boot ROM and bootloader behaviour exercised against fault-injection where in scope.
Firmware, binwalk · squashfs · u-boot · secure-boot · hardcoded creds
Image carved with binwalk, root filesystem mounted, init scripts and busybox binaries reviewed by hand. Hardcoded API tokens, TLS keys, and PEM blobs extracted. Weak secure-boot anchors and unsigned bootloader-stage upgrades reported with the patch path.
Radio, BLE · Zigbee · Z-Wave · LoRa · Sub-GHz · 802.11
Packet captures with HackRF, Ubertooth, RFCat. BLE GATT walked for unauth read / write. Pairing bypass under Just Works mishandling. Zigbee key-establishment replay. LoRa join-accept tampering. Wi-Fi WPS and EAP downgrade where the device exposes them.
Mobile companion, paired iOS / Android binary
Companion app pulled from the store, instrumented under Frida, the pairing flow and deeplink handlers walked end to end. Hardcoded device secrets, weak certificate pinning to the cloud, and OAuth-state mishandling in account-linking flows.
Cloud, MQTT & OTA channel
Broker authentication walked for client-id reuse and topic over-subscription. Topic tree walked from a low-priv account for tenant isolation gaps. OTA update channel tested for unsigned image acceptance, downgrade attacks, and roll-back to a vulnerable build.
Web / device admin UI
Local admin UI, mDNS / SSDP service, and any cloud portal tested for default credentials, CSRF on state-changing endpoints, exposed /debug or /diag routes, command injection in network-config forms, and authentication-bypass via unauth API parity.
on record ,
Accredited testers, audited handling.
CREST is the standard for offensive security execution. CERT-In, SOC 2 Type II, and ISO/IEC 27001 cover how SecureLayer7 handles your cluster evidence, Kubernetes artefacts, and your engagement record.
CREST
Accredited company & testers
CERT-In
Empanelled auditor
SOC 2 Type II
Independently audited
ISO/IEC 27001
Information Security Management
Mapped to audit requirements across
SOC 2 TYPE IIPCI DSSHIPAAISO/IEC 27001GDPRNIST CSFFEDRAMPAND OTHERS
Scope ,
Four cluster planes. One engagement.
Most cluster reviews stop at isolated findings. We chain control plane exposure, workload breakout, identity and secrets, and supply-chain trust in one engagement, mapped to your topology and exercised manually against the bug classes that appear once an attacker already has a foothold.
Control plane
kube-apiserver anonymous-auth, etcd 2379 exposure, kubelet 10250 unauth, scheduler / controller-manager metrics leak, admission-webhook race, audit-policy gap, /healthz info disclosure, in-cluster API server SSRF.
Workload & data plane
Privileged-container escape, hostPath / hostNetwork / hostPID abuse, SYS_ADMIN & NET_RAW capability misuse, missing seccomp / AppArmor, PodSecurityStandards bypass, NetworkPolicy default-allow, sidecar trust-boundary leak, ConfigMap secrets leak.
Identity, RBAC & secrets
ServiceAccount token theft and replay, escalate / impersonate / bind verb chaining, over-scoped ClusterRoleBinding, projected-token reuse across namespaces, IRSA / Workload-Identity confusion, External-Secrets misconfig, kubectl auth can-i blind spots.
Supply chain
Mutating-webhook abuse, unsigned-image admission, ImagePullSecret leak, base-image typosquat, SBOM tampering, GitOps repo and pipeline takeover, Helm-chart values injection, registry-credential reuse across clusters.
What we cover
Eight layers. Every one read by hand and hooked at runtime.
Mobile is a stack: the binary, the runtime, the IPC, the network, the backend it actually calls. We test each layer in the language and toolchain your team ships in.
iOS native, Swift · Objective-C · SwiftUI
Keychain access-control mishandling, ATS bypass via NSAllowsArbitraryLoads, URL-scheme hijack, Universal Links validation gaps, App Group leakage, jailbreak-detection bypass under Frida.
Android native, Kotlin · Java · Compose
Exported-activity hijack, intent injection, ContentProvider authority abuse, insecure SharedPreferences, Keystore mishandling, root-detection bypass, Smali patch under MOBSF / objection.
Hybrid, React Native · Flutter · Cordova · Ionic
JS-bridge exposure, deserialised props from native to JS, asset bundle tampering, hot-reload server abuse on dev builds shipped to prod, Flutter snapshot reverse-engineering.
WebView surface
addJavascriptInterface RCE, file:// URI access from a remote origin, mixed content, intent:// scheme abuse, JS-to-native bridge auth gaps, cookie scope leakage between WebView and host app.
Inter-process communication (IPC)
Android intents, iOS URL schemes, Universal Links, App Links, broadcast receivers, deep-link OAuth-state mishandling, activity-stack tampering, share-sheet payload injection.
Mobile API & backend
REST and GraphQL endpoints called only by the mobile client, broken object-level authZ, mass assignment, mobile-only auth flows, refresh-token rotation gaps, abuse of mobile-specific headers as trust signals.
Embedded SDKs & native libs
Third-party SDKs (analytics, payments, in-app messaging) audited for over-permission and data exfiltration. JNI / NDK native libs reviewed for buffer overflow, format-string, use-after-free, and unsafe FFI boundaries.
Reverse engineering & resilience
Mach-O / DEX / Smali disassembly under IDA, Ghidra, jadx. Hardcoded API keys, signing material, and crypto secrets extracted from the binary. Control-flow obfuscation and tamper-detection tested against real bypasses, not vendor claims.
What we test
Four network surfaces. One engagement.
Each boundary gets a manual, threat-modelled review against its real attack surface, perimeter, AD-joined estate, wireless edge, and the devices that route between them. Intensity tunes per scope.
External, internet-facing
Subdomain takeover, exposed RDP/SSH/SMB, vendor-portal SSRF, VPN-appliance CVE chains, perimeter mail-relay abuse, exposed git/CI endpoints, ASN-wide cert-transparency mining, and credential-leak correlation against the perimeter login surface.
Internal, east-west + AD
SMB-signing NTLM relay, kerberoasting and AS-REProasting, mitm6 + WPAD coercion, ADCS ESC1–ESC8 abuse, LAPS-password reuse, Group Policy preference passwords, BloodHound-mapped attack paths to Domain Admin and Tier-0 hosts.
Wireless, Wi-Fi + 802.1X
WPA2/WPA3 handshake capture and crack, EAP-TLS cert-pinning bypass, PEAP/MSCHAPv2 relay, rogue-AP and KARMA, 802.1X NAC bypass via MAC spoof, guest-network pivot, captive-portal credential harvest.
Devices, firewalls, switches, routers
Exposed management interfaces (SSH/HTTPS/SNMP), default and stale credentials, ACL bypass via spoofed source, SNMPv2 community brute-force, IPv6-routing override, firmware-CVE pivot to lateral access.
What we test on-demand
One engagement model. Every target you ship.
Web, mobile, API, network, internal, brought under one delivery model. You don’t have to pick a discipline before you scope; we right-size the team and the depth to your target.
Web applications
Single SPA, multi-tenant, e-commerce, internal portal. Auth flows, RBAC, business logic, payment-stage integrity, manually walked, not scanner-rubber-stamped.
REST + GraphQL APIs
OWASP API Top 10 mapped. BOLA, mass assignment, broken object-level authZ, rate-limit bypass, schema introspection abuse, refresh-token rotation gaps.
Mobile apps (iOS · Android)
Native, hybrid, and cross-platform builds. Static + runtime instrumentation under Frida, deeplink hijack, Keychain / Keystore mishandling, addJavascriptInterface RCE.
Network IPs (internal + external)
Service enumeration, exposed admin panels, weak auth chains, default-credential pivots, RCE chains into the application stack, walked by hand, not just nmap output.
Internal apps + admin portals
VPN-gated, SSO-fronted, role-segmented apps. Same auth depth as external surfaces, mapped to your insider threat model and least-privilege contract.
Cloud + container surfaces
AWS, Azure, GCP, Kubernetes, IAM mishandling, managed-identity over-scope, IMDSv1 SSRF, pod-to-host RBAC bypass under your real workload identity model.
What the crew brings
Seven attack surfaces. One adversary.
These are the surfaces SecureLayer7's red team operates across. Black Box engagements run all seven. Assumed Breach and Threat-Led include the digital surfaces by default; physical, social, and wireless are scoped in when the engagement narrative requires them, not bolted on as upsells.
Network
External reconnaissance, internet-facing service exploitation, then internal east-west pivoting once foothold is established. Mapped to ATT&CK Initial Access + Lateral Movement.
Identity
Active Directory trust abuse, Kerberoasting, delegation paths, cloud-IAM lateral movement, credential theft chains, and the misconfigurations checklists never reach.
Application
Chained business-logic exploits, authentication confusion, multi-step flow abuse, and the auth boundaries scanners cannot model. Web, API, and SaaS-tenant boundaries.
Cloud
AWS / Azure / GCP IAM misuse, metadata-service abuse, secrets-manager pivoting, cross-account trust paths, and SaaS-tenant trust escalation. Scoped to the cloud surface area you actually run.
Physical
On-site reconnaissance, tailgating, badge cloning, lock bypass, and covert-access device placement on a wired network drop. Once inside, the digital crew picks up from the physical foothold. Engagement is consent-bounded, recorded, and de-escalated on first detection by your team.
Social engineering
Spear phishing, vishing, pretexting against helpdesk / IT support, MFA-fatigue prompts, and supply-chain personas (vendors, contractors, recruiters). Targets the humans your security awareness training assumes are trained.
Wireless
Rogue access points, evil-twin captive portals, EAP-credential capture, and segmentation-bypass paths from guest VLAN to corporate. Tested at your physical perimeter and inside acquired tenants.
What we test
Six SAP surfaces. One engagement.
Every layer of the SAP landscape gets a manual, threat-modelled review against its real attack surface, kernel, database, presentation, transport, custom code, and authorization. Intensity tunes per scope.
NetWeaver / ABAP kernel
RECON-class unauth user creation (CVE-2020-6287 family), ICMAD memory corruption (CVE-2022-22536 family), authority-object bypass against S_TCODE / S_DEVELOP / S_RFC, ABAP code injection in dynamic CALL TRANSACTION and EXECUTE IMMEDIATELY, transport-request abuse, message server unauthenticated registration.
SAP HANA
SQL injection in custom procedures, SYSTEM privilege escalation, cross-schema access via shared CDS views, _SYS_REPO mis-grants, encryption-at-rest verification, audit-policy gaps, XSA tenant boundary bypass, replication-route abuse on system replication.
S/4HANA & ECC business logic
Segregation-of-duties chains that move money, vendor master maintenance + invoice posting + payment release in one user; F110 payment program abuse via spoofed bank master; MIRO three-way-match bypass; goods-receipt reversal-and-repost flows that paper over inventory shrink.
Fiori / UI5 frontend
OData service authorisation gaps, CSRF token reuse across sessions, UI5 mock-data leakage, Launchpad role-hiding bypass, Gateway service /sap/opu/odata/ exposure, web-dispatcher header-rewrite abuse, BSP application chained-XSS to ABAP RFC.
SAProuter & RFC Gateway
Gateway ACL bypass (reginfo / secinfo gaps), unauthenticated RFC server registration, message-server SXM access, SAProuter route-permission leakage, DIAG / RFC protocol replay where TLS isn't terminated, exposure of internal load-balancer behind public listener.
Custom Z* code & roles
Z-program authority-check omissions, hardcoded SAP* / DDIC credentials in customer transports, ABAP open-SQL injection in customer namespaces, role/profile drift between DEV and PROD landscapes, derived-role inheritance abuse, GRC mitigations that whitelist the chain rather than break it.
What we harden
Four server surfaces. One engagement.
Each tier is brought to a defensible baseline against its real attack surface, then probed by hand for the path that survived. Intensity tunes per scope.
Linux servers
Ubuntu · Debian · RHEL · CentOS · Alma · Rocky. Kernel sysctl, ssh key & cipher policy, sudo & PAM, /tmp & /var noexec, fail2ban, auditd, AppArmor / SELinux, package-manager hygiene.
Windows Server
Server 2016 / 2019 / 2022. SMB signing, LSA & credential guard, RDP NLA, GPO baseline (CIS / STIG), AppLocker / WDAC, Defender ASR, audit policy, scheduled-task review.
Web servers
Apache · Nginx · IIS · LiteSpeed. server-tokens, mod_status, request limits, TLS / HSTS / OCSP, ModSecurity rule set, .htaccess audit, PHP-FPM pool isolation, fastcgi cache scope.
Databases
MySQL · MariaDB · Postgres · MSSQL · Mongo · Redis. Default-creds review, least-privilege grants, network ACLs, audit logging, backup encryption at rest, secrets-manager binding, replication-account scope.
on record ,
Accredited testers, audited handling.
CREST accredits our organisation and every tester on your engagement. CERT-In empanelment plus SOC 2 Type II and ISO/IEC 27001 controls govern how source artefacts, secrets, and engagement records are stored, accessed, and handed back.
CREST
Accredited company & testers
CERT-In
Empanelled auditor
SOC 2 Type II
Independently audited
ISO/IEC 27001
Information Security Management
Mapped to audit requirements across
- SOC 2 Type II
- ISO/IEC 27001
- PCI DSS
- HIPAA
- GDPR
- NIST CSF
- FedRAMP
- and others
Scope ,
Seven stacks. Same depth on each.
Auditors who still ship production code in these stacks review yours by hand. We throttle depth based on trust boundaries and data sensitivity, with authentication surfaces, deserialisation paths, parsers, query builders, and IPC earning mandatory deep dives every time.
JVM, Java · Kotlin · Scala
Jackson polymorphic-typing gadgets (CVE-2017-7525 lineage), Spring SpEL / EL injection, JNDI / Log4Shell-style lookups, JDBC string concatenation, lock-order races on shared state, Servlet filter-bypass chains.
Go
Data races on shared maps and channels, `unsafe.Pointer` arithmetic across cgo bridges, raw-string SQL in `database/sql`, JWT `alg=none` acceptance, `text/template` over `html/template`, dependency-confusion in `go.mod` proxies.
Python
`pickle.loads` on user input, SSTI in Jinja / Mako templates, `eval` / `exec` reachable from request handlers, f-string SQL interpolation, `yaml.load` without `SafeLoader`, `subprocess(shell=True)` argument injection, path traversal via `os.path.join`.
Node · TypeScript
Prototype pollution through `lodash.merge` / `Object.assign`, ReDoS via catastrophic backtracking on user-controlled patterns, `child_process.exec` argument injection, JWT `alg` confusion, sandbox escape in `vm` / `node-serialize` patterns.
C · C++ · Rust unsafe
Buffer overflows, format-string bugs, use-after-free, double-free, OOB reads, integer / sign-conversion overflow in parsers and codecs · Rust `unsafe` audited for aliasing and invariant breaks across FFI boundaries.
PHP
LFI / RFI through `include` paths, object injection via `unserialize`, PHAR deserialisation gadgets, type-juggling (`==`) auth bypass, raw-SQL in legacy modules, `extract()` variable overwrites in framework caches.
Ruby · Rails
Mass assignment through `permit` gaps, `YAML.load` on user input, dynamic dispatch via `send` / `public_send`, raw-SQL in scope chains and `find_by_sql`, `Marshal.load` in cache stores, `constantize` on user input.
Telecom security ,
Assessments tied to how telecom fails in production. Not generic checklist work.
Attacks on telecom rarely stay in one layer, they cross signaling, core elements, and access edges. We scope around those boundaries so findings map to engineering work with clear risk, not scattered vulnerabilities on a spreadsheet.
Since 2012 we’ve tested operator-adjacent systems alongside enterprise apps and infrastructure, experience we use to model realistic paths, rank impact, and write remediation network teams can ship.
Reference scope: core, SS7/SIGTRAN interconnect, signaling trunk, RAN/LTE access
Coverage ,
Four planes we pressure-test. One engagement story.
We group telecom work into four themes, signaling, core stack, access edge, and enterprise voice, so planning stays readable. Pick what matches your risk focus; we tailor tasks inside each theme.
Signaling & interconnect
SS7 and SIGTRAN exposure, interconnect abuse paths, and protocol-level risks across peering, modeled for real operator handoffs, not generic scanning.
Core & mobile stack
GSM/3G core and LTE architecture reviews, segmentation and NE configuration, including MBSS-style baselines, so paths into HLR, SMSC-class systems and peers are explicit.
Access & subscriber edge
Air-interface penetration testing and SIM / USIM application security, where bypass, cloning, and misuse scenarios often show up before they touch core nodes.
Voice & enterprise telecom
IP-PBX, PSTN, and switching-adjacent environments reviewed for configuration drift, trunk abuse, and paths into the wider org.
Adjacent services ,
Often booked with telecom assessments. Same SL7 standards.
Pick the surface that matches your wider risk story.
Network penetration testing
Explore
In-and-out paths attackers actually take.
Subnets, firewalls, exposed services.
Ranked so you patch what hurts most.
Application security testing
Explore
Review + dynamic tests for APIs & apps.
Auth, sessions, data across tiers.
Shippable fixes for engineering.
Web application penetration testing
Explore
Browser flows attackers actually exploit.
OWASP-style depth, no filler checks.
XSS, injection, logic flaws.
Cloud & wireless-adjacent security
Explore
AWS · Azure · GCP drift & misconfigs.
Wireless + perimeter, same picture.
Cloud edge to LAN in one story.
Red team assessment
Explore
Real tradecraft & persistence.
Detection, IR, escalation, tested.
Leadership-ready, not vuln lists.
Scope & quote, contact us
Get in touch
Send scope, regions, timelines.
Proposal & deliverables, fast.
Same SL7 standards end to end.
ExpertSpotlight
ExpertSpotlight-services-telecom-network-security
## Q&A
Q: How long does a telecom network security engagement take?
A: Three to six weeks of active testing, plus a one-week scoping phase up front and a free re-test after fixes land. Window depends on core element count, signalling stack (SS7, SIGTRAN, Diameter), and roaming-partner scope.
Q: What is tested in a telecom security engagement?
A: Core elements, signalling, and control plane. Named bug classes: SS7 / SIGTRAN MAP message abuse (SRI-SM, AnyTimeInterrogation, InsertSubscriberData), Diameter S6a peer-spoofing, GTP tunnel injection, SIP trunk toll fraud at the IMS edge, core segmentation gaps between HLR / HSS and IT, and roaming-partner trust over-scope.
Q: Do you include a re-test?
A: Yes. Every telecom engagement includes a free re-test of the same scope after fixes land. The proof-of-exploit reverts on patch and we sign written closure for each finding.
Q: Which compliance frameworks does the report map to?
A: ISO/IEC 27001, SOC 2 Type II, NIST CSF, GSMA FS.11 / FS.19 / FS.20, and 3GPP TS 33-series alignment. Severity is CREST-mapped. SecureLayer7 is CERT-In empanelled.
Q: How does this differ from a generic network scan?
A: Generic network scans do not speak SS7, SIGTRAN, or Diameter. Telecom security testing exercises the signalling stack by hand, MAP message injection, peer-spoofed GTP, SIP-trunk toll fraud, risk-ranked against your core segmentation.
Q: Is the report regulator-ready?
A: Yes. CREST-mapped severity, a working proof-of-exploit per finding, segmentation diff guidance, and a regulator-ready PDF accepted across ISO/IEC 27001, SOC 2, GSMA FS-series / DoT review cycles.
---
# Thick Client Penetration Testing | United States
https://securelayer7.net/us/services/thick-client-pentest
Thick client application penetration testing from SecureLayer7. Manual reverse-engineering of Windows, macOS, Linux native apps plus .NET, Java, Electron desktop. DLL search-order hijack, named-pipe and XPC ACL abuse, IPC injection, memory analysis, anti-debug bypass, Frida runtime hooking. CREST-mapped report with free re-test.
Sl7WaptHero
Thick client application pentesting.
Past the network. Into the binary.
Manual thick client penetration testing across Windows, macOS, and Linux native apps plus .NET, Java, and Electron desktop, tested by hand for DLL-search-order hijack, named-pipe abuse, and local privilege escalation, with findings mapped to the SOC 2 and PCI DSS controls your US auditors check.
Talk to a security expert
/contact-us
security-posture-review
/media/thick-hero-v3-5a064ced.svg
Four desktop binary tiles, Windows PE,.NET, Mach-O, ELF, each annotated with one named bug class, traces converging on a reverse-engineering proof-of-exploit card lifting a DLL-hijack chain to NT AUTHORITY\SYSTEM.
Decompile
Instrument
Exploit
Report
ShieldCheck
Native binaries
Windows PE ·.NET · Java desktop · macOS Mach-O · Linux ELF · Electron / Tauri / CEF, every desktop runtime your team ships.
FileSearch
Evidence
Reverse-engineered proof-of-exploit and code-level fix guidance on every finding, Ghidra, Frida, x64dbg artefacts attached.
RotateCcw
Re-test included
We verify your fixes at no extra cost. One engagement, closed loop.
THICK.
top-right
outline
Sl7WaptHero-0-keg24a
TrustStrip
TrustStrip-services-thick-client-pentest
CredentialStrip
On record
Same accreditations on every engagement.
CREST is the standard for offensive security execution. CERT-In, SOC 2 Type II, and ISO/IEC 27001 cover how SecureLayer7 handles your binary, your environment, and your engagement record.
center
CREST
Accredited company & testers
CERT-In
Empanelled auditor
SOC 2 Type II
Independently audited
ISO/IEC 27001
Information Security Management
Mapped to engagement requirements across
SOC 2 Type II · PCI DSS · HIPAA · ISO/IEC 27001 · GDPR · NIST CSF · FedRAMP · and others
AUDITED.
CredentialStrip-1-bhveo4
dark
badge-row
TextSection
Why a web pentest can't see this
Web testing stops at HTTP.
The risk lives past the boundary.
Your web pentest reaches authentication, session, and the API. The same binary running on a workstation also reaches process memory, named pipes, the registry, the DLL search path, and the kernel. SecureLayer7 operators load your binary into Ghidra and Frida and report the chain that starts where the HTTP scope ends, DLL hijack to SYSTEM, hardcoded key in.data, IPC ACL bypass to a privileged service. Every finding is reproducible, code-level fixable, and re-tested before sign-off.
/media/thick-boundary-v2-9ee1786d.svg
Two scopes from a single binary, a short cream arrow stops at HTTP labeled WEB SCOPE; a longer orange arrow extends through PROCESS, IPC, MEMORY, and KERNEL waypoints to a final BINARY SCOPE label.
right
BOUNDARY.
TextSection-3-1d6hdj
light
RawHtml
control
RawHtml-2-thick-runtimes
What we test
Six desktop runtimes. One engagement.
Each runtime gets a manual reverse-engineering pass against its real attack surface, binary on disk, process in memory, IPC channels, and the backend it pairs with. Intensity tunes per scope.
Windows native (PE / COFF)
DLL search-order hijacking, COM hijacking, Authenticode bypass, named-pipe and RPC ACL abuse, service / scheduled-task permission writes, registry hijacks, AppLocker / WDAC bypass, signed-installer write-paths to NT AUTHORITY\SYSTEM.
.NET assemblies
dnSpy / ILSpy round-trip, hardcoded keys and connection strings in /resources, BinaryFormatter and ObjectStateFormatter deserialization gadgets, Json.NET TypeNameHandling abuse, reflection bypass, Strong-Name forgery, ClickOnce manifest tampering.
Java desktop (JAR / JavaFX)
JD-GUI / CFR decompile, signed-JAR replacement, classpath shadowing, Spring / Beanshell injection, JMX management exposure, Java RMI deserialization, native-library (JNI) hijack, hardcoded JDBC credentials in /META-INF.
macOS native (Mach-O)
DYLD_INSERT_LIBRARIES, weak-dylib hijack, codesign and hardened-runtime bypass, XPC service ACL abuse, TCC / privacy-prompt evasion, Keychain ACL misuse, sandbox escape via privileged helpers (SMJobBless, installerd).
Linux native (ELF)
LD_PRELOAD on SUID binaries, RPATH / RUNPATH abuse, .got and .plt write paths, systemd unit override, capability misuse, world-writable shared libraries, D-Bus policy bypass, namespace and cgroup escape.
Electron / Tauri / CEF
ASAR unpack, nodeIntegration leak across renderer-to-main IPC, contextIsolation bypass, custom-protocol handler abuse, autoUpdate signature bypass, Chromium-extension prototype pollution into Node, hardcoded tokens lifted from app.asar.
What we test ,
Four planes of the call. One engagement.
Each layer gets a manual, threat-modelled review against its real attack surface, signalling, media, infrastructure, and the trunk edge. Intensity tunes per scope.
Signalling, SIP / SDP
REGISTER hijacking, INVITE flooding, BYE/CANCEL race conditions, SDP rewriting, ALG bypass, digest-auth replay, contact-header rewrite, and presence-leak via SUBSCRIBE/NOTIFY.
Media, RTP / SRTP
RTP eavesdropping, ZRTP/SRTP downgrade, DTMF injection, codec confusion, replay across the media stream, comfort-noise abuse, and media-relay bypass.
Infrastructure, PBX core
Asterisk AMI/CLI exposure, FreeSWITCH event-socket misconfiguration, Cisco CUCM AXL credential leak, dialplan logic abuse, voicemail PIN brute force, IVR fingerprinting and option escape.
Edge, SBC + SIP trunk
SBC peering misconfiguration, voice-VLAN hopping, SIP trunk toll fraud, IAX2 brute force, NAT/ALG traversal abuse, peer-spoofed call replays, and geo-routing rule override.
What we test
The whole airspace. Not just the SSID list.
Each layer of your wireless estate is reviewed by hand against its real attack surface, corporate Wi-Fi, 802.1X / RADIUS, the rogue-AP boundary, and the BYOD / guest edge. Intensity tunes per scope.
802.11, WPA2 / WPA3 / WPS
PMKID capture via hcxdumptool, 4-way handshake collection under deauth, offline crack with hashcat, WPS PIN brute force (Pixie Dust), WPA3 SAE downgrade (Dragonblood), MFP / 802.11w not enforced, PMF-not-required client trap.
802.1X, EAP-TLS / PEAP / EAP-MSCHAPv2
Server-cert validation off on clients, PEAP outer-tunnel bypass, EAP-MSCHAPv2 cleartext relay, EAP-TLS cert-pinning gaps, RADIUS shared-secret re-use across SSIDs, MAC-RADIUS bypass, NPS / FreeRADIUS misconfig.
Rogue AP, Evil Twin / KARMA / Deauth
Same-SSID rogue stood up with hostapd-mana, broadcast-PROBE-RESPONSE KARMA, captive-portal harvest of corporate creds, MAC randomization detection bypass, Wireless IDS / WIPS evasion, deauth flood under MFP-off.
Captive / BYOD, Guest VLAN / NAC / MDM
Captive-portal UAM bypass, guest-to-corporate VLAN escape via DHCP / IPv6 abuse, NAC posture-check bypass, MDM-issued client cert lift, BYOD MAC-allowlist spoof, Wi-Fi Direct lateral pivot, hidden-SSID probe-leak reveal.