Penetration test your own systems, safely

Test your internet-facing websites and servers the way an attacker would look at them first. Start an automated test whenever you like, or request a manual test by a specialist.

Penetration test

Most break-ins start with something simple that is visible from the internet: a database port left open, a forgotten .git folder or .env file, an old TLS setting or a test system nobody remembers. A yearly manual test is valuable, but your systems change every week.

• Only systems you have proven you control: ownership is verified by DNS or a file on your website, and an admin records the authorisation before any active test.
• About 100 common ports are checked, with the greeting each service sends by itself, so exposed databases, remote desktop and admin panels stand out.
• TLS versions and certificates, security headers, cookies, CORS, allowed methods and directory listing are checked with normal GET, HEAD and OPTIONS requests.
• Well-known sensitive files such as .git, .env, configuration backups and phpinfo pages are found, with protection against false positives.
• Software versions on show are compared with the CISA catalogue of known-exploited vulnerabilities, and DNS zone transfer, DNSSEC, SPF and DMARC are checked.
• Every finding explains what it means and how to fix it. Each test gets a grade, a comparison with the previous test and a PDF report for your auditor or IT supplier.

Is the automated test safe for my website?

Yes. It doesn’t use exploits, doesn’t guess passwords, doesn’t send attack payloads and doesn’t change anything. It makes at most 5 requests or connections per second and stops after 10 minutes.

I see “OZAG-Security-Pentest” in my server logs. What is this?

An automated penetration test that the owner of the system started in OZAG Security, after verifying ownership and recording an authorisation. If you did not expect it, contact us at security@ozagsecurity.com and we will look into it straight away.

What does an automated test not find?

Logic flaws, broken access control behind a login and chains of small issues need a human tester. You can request a manual penetration test from the same page.

Do you test systems I haven’t verified?

No. Host names found in public certificate logs are listed so you can check them, but they are never tested until you add and verify them yourself.

OZAG Technologies · KVK 42167370 · Laan van Oversteen 20, 2289 CX Rijswijk · +31 6 24496620 · support@ozagsecurity.com