Find Vulnerabilities
Before Attackers Do
VAPT engagements run to NIST SP 800-115, PTES and the OWASP testing guides. Gray-box by default: we test with live credentials at every role, then repeat unauthenticated for the black-box view. Every finding is manually validated, mapped to OWASP ASVS, and shipped with a working proof of concept and a free 30-day retest.
- 5
- asset classes covered
- 100%
- findings human-validated
- CVSS v3.1 + v4.0
- severity scoring
- 30 days
- free retest window
Service overview
An AxVeil VAPT engagement is two disciplines layered together. The vulnerability assessment uses authenticated scanning, configuration review and template-driven discovery — we ship the upstream Nuclei binary against your perimeter, run Burp Suite Pro's active scanner against authenticated user journeys, and pull a software bill of materials so we can correlate dependency CVEs against published exploit code. The penetration test then takes those candidate weaknesses and proves which ones an attacker can actually chain into impact: account takeover, tenant boundary breach, data exfiltration, lateral movement into the corporate network.
Every finding is human-validated before it enters the report. Scanner output is an input, not a deliverable. A CISO presenting the PDF to the audit committee should be able to defend each line item — we do not pad reports with informational chaff to inflate finding counts. The 2024 Verizon Data Breach Investigations Report attributes 14% of breaches to vulnerability exploitation, nearly tripling year over year, with stolen credentials and phishing the dominant other vectors. Our scope reflects that reality: technical vulnerabilities, identity controls, and the trust boundaries between them.
Engagements are scoped to the standard you need to satisfy. Series-A SaaS targeting SOC 2 Type 2 typically asks for ASVS L2 across the production app and a perimeter network test. Payment processors handling card data ask for PCI DSS v4.0 Requirement 11.4.x coverage with quarterly external and annual internal segmentation testing. RBI-regulated entities in India ask for the cyber security framework's annual penetration test plus a CERT-In-aligned report format. We deliver against the framework you specify, not a generic template.
Scope by asset class
Web applications
Gray-box by default: we test with live credentials at every role, then repeat the key flows unauthenticated for the black-box attacker's view. OWASP Top 10 (2021) plus the full ASVS v4.0.3 control set at L1, L2 or L3. Business-logic flaws: race conditions, IDOR, workflow bypass, multi-tenant boundary breaks. SSRF into cloud metadata. SAML / OAuth2 / OIDC misconfiguration. Burp Suite Pro is the primary harness, with manual exploit development for anything custom.
APIs (REST, GraphQL, gRPC)
Mapped to the OWASP API Security Top 10 (2023). BOLA / BFLA enumeration, mass assignment, broken authentication, excessive data exposure, GraphQL introspection abuse, query depth and alias-based denial of service, gRPC reflection where exposed. Schema-driven fuzzing where OpenAPI / Swagger / Protobuf definitions are available; black-box discovery where they are not.
Mobile (iOS + Android)
OWASP MASVS v2 plus the OWASP Mobile Security Testing Guide. Static analysis of the IPA / APK, runtime instrumentation with Frida, certificate pinning bypass, biometric auth bypass, IPC / deep-link abuse, insecure local storage (Keychain / Keystore misuse), and backend API testing under the mobile threat model.
Network infrastructure
External and internal penetration testing per NIST SP 800-115. Service enumeration, version-based vulnerability identification, exploit validation, and Active Directory attack-path mapping (Kerberoasting, AS-REP roasting, ADCS misconfiguration, NTLM relay). Wireless and VLAN segmentation testing on request.
Cloud (AWS / Azure / GCP)
Control-plane review against CIS Benchmarks. IAM privilege-escalation pathing, role assumption chains, public S3 / Blob / GCS exposure, Lambda / Function trigger abuse, Kubernetes RBAC and admission-controller bypass. MITRE ATT&CK Cloud matrix used to structure the report.
Out of scope by default
Denial-of-service against production, social-engineering of staff (covered separately under the red team service), physical intrusion, third-party SaaS where written authorisation cannot be obtained, and any test that risks customer data integrity without an agreed rollback plan. All exclusions are documented in the Rules of Engagement before kickoff.
Methodology
Six phases derived from PTES and NIST SP 800-115, calibrated to a typical four-to-six-week web + API engagement. Network and cloud engagements use the same phase boundaries with discipline-specific tooling.
- 01Pre-engagement & scopingAsset inventory, Rules of Engagement, allowlisted source IPs, test accounts at every role, written authorisation for invasive checks, escalation contacts. Testing mode fixed in writing — black-box (no credentials or prior knowledge), gray-box (live user credentials at each role, the default), or white-box (full source and config) — alongside the target ASVS level (L1/L2/L3).
- 02Reconnaissance & surface mappingPassive OSINT, DNS and certificate-transparency enumeration, subdomain discovery, technology fingerprinting, JavaScript route-mining for SPA endpoints, OpenAPI / GraphQL schema extraction.
- 03Automated discoveryNuclei templates against the perimeter, Burp Suite Pro active scanner against authenticated journeys, dependency CVE correlation against the SBOM. Output is a candidate list — none of it ships to the report unvalidated.
- 04Manual testing & exploitationThe bulk of the engagement. Tester walks every authenticated workflow, exercises business logic, validates each scanner candidate, develops PoC exploits, and chains findings into impact paths (auth → IDOR → tenant breach, SSRF → IMDS → role escalation, etc.).
- 05Post-exploitation & impact analysisWhere in-scope, demonstrate downstream impact: pivot from web compromise into the supporting cloud account, enumerate accessible data, map the blast radius. Findings rated against CVSS v3.1 and v4.0 with environmental modifiers applied.
- 06Reporting & retestDraft report walkthrough call, written report with executive summary and full technical detail, remediation guidance per finding, and one free retest within 30 days of remediation. Letter of Attestation issued on PASS.
Deliverables
A single PDF report (typically 60–120 pages) plus machine-readable artefacts. Every finding is reproducible from the report alone — no follow-up call required to understand impact or remediation.
{
"id": "AXV-2026-0014",
"title": "IDOR on /api/v1/invoices/{id} permits cross-tenant invoice read",
"severity": "High",
"cvss_v3_1": "AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"cvss_score": 8.5,
"cwe": ["CWE-639"],
"owasp_asvs_v4": ["V4.1.3", "V4.2.1"],
"owasp_api_top_10_2023": ["API1:2023"],
"endpoints": ["GET /api/v1/invoices/{id}"],
"validated_by": "manual",
"remediation": "Enforce tenant-scoped authorisation in the data layer; reject any invoice_id whose owning tenant_id does not match the JWT sub claim.",
"retest_status": "pending"
}Frameworks & standards
Methodology and reporting align to the standards your auditor will check.
Engagement timeline
Calendar weeks for a typical web + API engagement. Network, cloud and mobile slot into the same shape; complex multi-asset engagements run phases in parallel.
Frequently asked questions
What is the difference between a vulnerability assessment and a penetration test?+
A vulnerability assessment enumerates known weaknesses using authenticated scanning, configuration review and template-driven discovery (we use the upstream Nuclei binary plus Burp Suite Pro). A penetration test goes further: a tester chains those weaknesses into a working exploit path, validates real-world impact, and proves data, identity or service compromise. AxVeil VAPT engagements always include both — the scan is the floor, manual testing is the ceiling.
Which standards do you map findings to?+
Every finding is mapped to OWASP ASVS v4.0.3 (L1, L2 or L3 as agreed in scope), the OWASP API Security Top 10 (2023), CWE for taxonomy, CVSS v3.1 and v4.0 for severity, and NIST SP 800-115 for methodology. Mobile work additionally references OWASP MASVS v2 and the MSTG. Cloud findings map to the CIS Benchmarks for AWS, Azure or GCP and to MITRE ATT&CK Cloud (Enterprise matrix).
What does a PASS look like?+
A PASS for an ASVS L2 web app means: zero unresolved Critical or High findings, no exploitable authentication, session, access control or injection issues, all Mediums either remediated or risk-accepted in writing by an asset owner, and a free retest verifying remediation within the 30-day window. We issue a signed Letter of Attestation referencing the engagement scope, the ASVS level achieved, and the report hash so auditors can verify integrity.
Will testing impact production?+
Default posture is non-disruptive: read-only payloads, throttled request rates, no destructive Burp Intruder runs against production, no automated exploits that write to user data without written authorisation. Where load or denial-of-service testing is in scope, we run it in a staging environment or in a pre-agreed maintenance window with rollback procedures documented.
How do you handle false positives from automated scanners?+
Every Nuclei or Burp Suite Pro finding above Informational is manually validated by a human tester before it enters the report. Findings that fail validation are either removed or downgraded to Informational with reasoning recorded. The final PDF only contains validated, reproducible findings — each with a step-by-step PoC, request/response capture and CVSS vector string.
Can you align the engagement to SOC 2, ISO 27001 or PCI DSS evidence requirements?+
Yes. We tag each test case to the source control: SOC 2 CC7.1 / CC8.1, ISO 27001:2022 Annex A.8.8 / A.8.29, PCI DSS v4.0 Requirement 11.4.x. The deliverable pack includes a control-mapping appendix that drops directly into your auditor's evidence request list, plus a Letter of Attestation referencing the engagement scope, dates and the lead tester who signed off the work.
Go deeper on VAPT
AI/LLM Penetration Testing Methodology — A Practical 2026 Playbook
Seven-phase methodology for testing chatbots, RAG, agents, and fine-tune endpoints. MITRE ATLAS, OWASP LLM Top 10, tooling, and EU AI Act / NIST AI RMF / ISO 42001 overlay.
Read the article →API Penetration Testing Methodology — REST, GraphQL, gRPC
API pentest methodology for REST, GraphQL and gRPC mapped to OWASP API Security Top 10 2023. Tools, BOLA payloads, mass assignment and SSRF chains.
Read the article →Mobile Penetration Testing Methodology — iOS and Android
Mobile pentest methodology for iOS and Android: static analysis with MobSF and JADX, dynamic with Frida, Objection, Drozer, MASVS L1/L2/R alignment.
Read the article →Scope your VAPT engagement
Send the asset inventory, target ASVS level and audit deadline. We respond with a fixed-fee proposal, lead-tester biography and a sample report from a comparable engagement.
Request a scoping call →