Path
Home / Services / Security audits
Scope
Pentest, Code audit, Hardening
Result
Report with proposed fixes
Reported vulnerabilities
45+

We test your application before it goes live.

Start a project → Examples ↓

Penetration tests of web applications, code audits and server hardening, including for software we did not write. Backed by what we learned from more than 45 reported vulnerabilities.

1What we test

Available individually or combined.

Penetration test
An attack on your web application from outside, with the permissions of different roles.
Code audit
A review of the source code for permission checks, input, output and file access.
Plugin audit
Moodle and ILIAS plugins, before they go into production.
Hardening
Servers, web servers and configuration, so that only what needs to be reachable is reachable.
Impact analysis
After an incident: was the vulnerability exploited, and who is affected?
Retest
After your fix, we check whether the vulnerability is really closed.

2Examples

Two typical cases: a vulnerability in a plugin, and the question that follows.

SituationA tip from outside or a bad feeling: the plugin might contain a vulnerability.

Fig. 2.1: Path of the vulnerability, before and after
Participants Plugin Teachers Comment with script Output is filtered FIX before: script runs on opening after: text only 1 2 3
  1. ①A clear finding. Who can trigger the vulnerability and what happens then.
  2. ②A fix in the right place, as a merge request against your repository.
  3. ③With a test, so the vulnerability does not return with the next refactoring.

SituationThe vulnerability is known and fixed. Still open: was it exploited, and who is affected?

Fig. 2.2: Who is affected?
VulnerabilitySTORED XSS, FIXED 2 entries1 AUTHOR 9 affected INCL. 2 TEACHERS Admin sessions: 0 AssessmentFOR MANAGEMENTAND DATA PROTECTION 1 2 3
  1. ①Look for traces instead of guessing. Directly in the database and logs.
  2. ②Narrow down who is affected. Who saw the crafted content, and when?
  3. ③A clear assessment. For management and data protection: what happened and what did not.

3Process

  1. 3.1

    Scope

    What is tested, with which roles, on which system.

  2. 3.2

    Testing

    Preferably on a test system; on production systems only by agreement.

  3. 3.3

    Report

    Findings with severity, evidence and a proposed fix, clear to both technical staff and management.

  4. 3.4

    Retest

    After your fix, we test again.

4Frequently asked questions

Do you need the source code?

No, a penetration test also works from outside. With the source code, however, we find more in less time.

Will the test disrupt operations?

We prefer to test on a test system. Tests on production systems are agreed with you in detail beforehand.

What is in the report?

Every finding with severity, evidence and a concrete proposal for the fix, plus a summary for management.

Is it kept confidential?

Yes. On request, we sign a non-disclosure agreement beforehand.

5 / Contact

Do you need someone to test your application?

Describe your project in three short steps. We usually reply within one working day.

Start an inquiry → kontakt@madasolis.de