dpsk.dipentestku
Let’s talk
← Back to overview
ASSESSMENT FIELD GUIDE / DIPENTESTKU

Defined scope.
Deeper understanding.

We follow industry best practices, blending automated scanning with deep manual testing to uncover complex vulnerabilities.

Looking for functional QA? View the QA scope.

Discuss your assessment
01 / Testing approach

Our Assessment Methodology

MODALITY / 01

Black Box

Simulating an external hacker attack without prior information about your system. The tester only knows the target URL and attempts to penetrate the system like a real-world attacker.

  • Real-world attacker perspective
  • Uncover vulnerabilities exposed to the public
  • Test your perimeter defense
  • Suitable for compliance requirements (PCI DSS, Security Audits)
BEST FOR: E-commerce, public-facing applications, websites with sensitive data
MODALITY / 02

Grey Box

Testing with limited information such as standard user accounts. Simulating insider threat scenarios or an attacker who gained initial access to the system.

  • Balance between coverage and efficiency
  • Focus on privilege escalation
  • Find business logic flaws in business process
  • More time-efficient execution
BEST FOR: Web applications, SaaS platforms, internal systems
MODALITY / 03

White Box

Comprehensive testing with full access to source code, documentation, and infrastructure. Includes code review and architecture analysis.

  • Most thorough coverage (including code-level vulnerabilities)
  • Detect logic bombs and backdoors
  • Code review for secure coding practices
  • Detailed remediation guidance
BEST FOR: Applications before production launch, fintech, healthcare
02 / Assessment complexity

Scope & Complexity Tiers

SCOPE / 01

SIMPLE

Characteristics:

  • Static website or basic WordPress
  • 5-20 pages/endpoints
  • Minimal or no database interaction
  • Simple authentication (admin panel only)
  • No payment gateway
  • No API integration
  • Shared hosting or basic VPS

Scope:

  • OWASP Top 10 basic checks
  • Authentication testing
  • Input validation
  • SSL/TLS configuration
  • Basic information disclosure

Duration: 3-5 Days

Deliverables: Executive summary, Vulnerability report, Risk rating, Basic remediation steps.

SCOPE / 02

MEDIUM

Characteristics:

  • Dynamic web application with database
  • 20-50 endpoints/pages
  • User authentication & role-based access
  • Form processing & file upload
  • Payment gateway integration
  • CRUD operations
  • REST API (basic)

Scope:

  • Full OWASP Top 10
  • Business logic testing
  • Session management
  • Authorization bypass attempts
  • API security testing
  • File upload vulnerabilities
  • Payment flow security

Duration: 5-7 Days

Deliverables: Executive summary, Detailed tech report, PoC, Risk matrix, Remediation roadmap.

SCOPE / 03

COMPLEX

Characteristics:

  • Multi-tier architecture
  • 50-100+ endpoints
  • Complex user roles & permissions
  • Multiple API integrations
  • Real-time features (WebSocket)
  • Mobile app backend
  • Cloud infrastructure (AWS/GCP/Azure)

Scope:

  • OWASP Top 10 + API Security
  • Advanced business logic flaws
  • Race conditions
  • GraphQL/REST API deep testing
  • Third-party integration security
  • Mobile API security
  • Cloud misconfigurations

Duration: 7-12 Days

Deliverables: Exec summary, Detailed report, Attack narratives, Video PoC, CVSS scoring, Compliance mapping.

03 / Before the engagement

Client Requirements

Black Box

Required Preparation

  • Scope definition: Target URL/IP, In-scope subdomains, Allowed hours
  • Legal docs: Signed agreement, Auth letter, NDA
  • Emergency contact: Tech support (24/7), Escalation contact
  • Preparation: System backup prior to testing, IT team info

NOT Required

  • User credentials
  • Source code
  • Documentation (Architecture, etc.)
  • Infrastructure details
Grey Box

Required Preparation

  • Access: If application has multiple roles (e.g. user, manager, staff), provide at least 1 test account per non-admin role.
  • Basic docs: User guide, Workflows, User roles
  • Scope & Legal: Target URL, NDA, Contacts
  • Preparation: Create dedicated test accounts & test data

NOT Required

  • Source code
  • Database access
  • Infrastructure diagram
White Box

Required Preparation

  • Complete Access: All credentials (including admin/dev), Database read, VPN/SSH, API keys.
  • Source Code: Git repo access, Deployment scripts, .env sample.
  • Documentation: Architecture diagram, ERD, Swagger/Postman, Tech stack.
  • Infrastructure: Cloud details, LB config, Firewall rules.
  • Development: CI/CD access, Code review process.
  • History: Past security reports, Regulatory requirements.
04 / Engagement timeline

Testing Process

  1. 01

    Pre-engagement

    Kickoff meeting, scope finalization, legal agreement signing, access provisioning, and rules of engagement (2-3 days).

  2. 02

    Reconnaissance

    Information gathering, asset discovery, attack surface mapping, and threat modeling (1-2 days).

  3. 03

    Active Testing

    Vulnerability scanning, manual exploitation, business logic testing, privilege escalation attempts (3-15 days).

  4. 04

    Reporting

    Vulnerability documentation, risk assessment, proof of concept creation, executive summary (2-3 days).

  5. 05

    Presentation

    Findings presentation, Q&A session, remediation roadmap discussion, and priority setting (1 day).

  6. 06

    Retest (Optional)

    Verify fixes, regression testing, updated report, and security posture assessment (2-3 days).

The final timeline is agreed based on scope and complexity.View sample report
Quality assurance / QA

Functional QA for web applications and APIs.

QA checks expected product behavior. Penetration testing examines exploitable security weaknesses. We define the objectives and coverage for each service before testing begins.

What we test

  • Agreed user journeys and acceptance criteria
  • Forms, validation, and application workflows
  • Expected API responses and error handling
  • Regression checks around changed functionality

What your team receives

  • Test coverage and results for the agreed scenarios
  • Bug reports with reproduction steps, expected behavior, and actual behavior
  • Supporting evidence and agreed issue priorities
  • A summary of issues and recommended next steps

Before testing

Share the features to review, expected behavior, supported environments, and release priorities. Test accounts, test data, and access requirements are agreed during scoping.

Discuss a QA scope
The next step

Let’s define your assessment scope.

Let’s discuss your security