CyberShells

Penetration testing and red team

From one forgotten subdomain to your payment run.

That path is what a penetration test is for. Walk it through from the outside in, then read exactly what lands on your desk at the end of it.

Run the free perimeter scan Walk the attack chain
Remote worldwide, GMT+3 More than 600 engagements Reply within 24 hours Fixed price against a written scope
01

The chain

Recon to crown jewels, six steps

An intrusion is not one clever exploit. It is six ordinary mistakes, joined up by someone patient enough to look.

  1. 01

    Recon

    Staff names, forgotten subdomains, and credentials already sitting in old breach dumps. Nothing sent, nothing to detect.

    Access heldnone

  2. 02

    Foothold

    One finance user opens the attachment. One character was wrong in the sender domain, and that is enough.

    Access heldone workstation

  3. 03

    Escalate

    Standard user to local admin through a service unpatched since 2023, then an IT administrator's cached credentials.

    Access heldlocal administrator

  4. 04

    Move

    Sideways through the estate using your own remote management tooling. No malware, all signed binaries.

    Access heldmultiple hosts

  5. 05

    Domain

    A service account with domain rights and a password last changed in 2019 hands over the directory.

    Access helddomain administrator

  6. 06

    Crown jewels

    The payment run, the client records, and the backups that were supposed to survive exactly this.

    Access heldeverything that matters

Illustrative composite of findings we see repeatedly, not any single client environment.

02

Engagements

Fixed price against a written scope

Scoped to what actually needs testing, not a scanner report with a logo on it.

Network penetration testing

External perimeter and internal estate. What is reachable, what is exploitable, and what it reaches next.

Web and API testing

Authenticated, business logic aware testing of the applications your customers and staff actually use.

Red team assessment

Goal based and full scope. We agree an objective that would genuinely hurt, then go for it without telling your defenders.

All engagements, scope and coverage in detail

Also available

  • Purple teamThe same attacks, run alongside your defenders, so every miss becomes a detection rule before we leave.
  • Cloud security reviewAzure configuration and identity review, tested the way an attacker would actually pivot through it.
  • Detection engineeringMicrosoft Sentinel rules in KQL mapped to MITRE ATT&CK, written by someone who spends the rest of the year evading them.
  • Report writingTurning raw findings into a document your board and your engineers can both act on from the same page.
  • Security consultingPosture review and vulnerability advisory for teams that need senior offensive input without a full time hire.
03

The deliverable

Figures below are illustrative

One document, two readers: the person who signs off the risk, and the engineer who has to close it.

Findings by severity

  • 3 Critical
  • 7 High
  • 14 Medium
  • 22 Low and info

Remediation tracker

  • Certificate template escalationClosed
  • Unpatched print serviceClosed
  • Backup network segmentationOpen
  • MFA on legacy VPNIn progress

Finding 01Critical

Any employee could issue themselves a certificate as the domain administrator

Evidence
A workstation template on your certificate authority let the requester choose whose name went on the certificate, and enrolment was open to every domain user. From an ordinary account we issued one in the domain administrator's name and authenticated with it. Request ID, template ACL and command output in Appendix C.
Impact
Any staff account, or any one of them that gets phished, becomes a domain administrator in under two minutes. No exploit runs and no password changes, so your logs show ordinary certificate activity. The certificate stays valid for a year, so resetting every password in the domain would not evict us.
Fix
Strip the requester-supplied-subject flag from the template, restrict enrolment to the machines that actually need it, and revoke anything issued from it since the template was published. Password resets alone do not close this one.

RetestTemplate corrected and certificates revoked. No longer exploitable.

How the engagement runs

  1. Week 0

    Scoping call, then a written scope and fixed price within 24 hours

  2. Week 1

    Testing window. Your team knows the dates, your defenders do not

  3. Day 3

    Anything critical is called the hour we find it

  4. Week 2

    Report, then a walkthrough with the people who have to fix it

  5. Week 6

    Retest of everything you have closed, then an attestation letter your auditor can accept

04

Credentials

Every one independently checkable

Certifications you can verify yourself, not logos on a page.

  • OSCP+Offensive Security Certified Professional
  • eCPPTCertified Professional Penetration Tester
  • eWPTWeb Application Penetration Tester
  • eCIRCertified Incident Responder
  • AZ-500Azure Security Engineer Associate
  • SC-200Security Operations Analyst Associate
  • SC-300Identity and Access Administrator Associate

View the credential wallet

05

Pricing

Agreed in writing before anything starts

Scope and cost are settled after the scoping call, and then they hold.

from $500 Web application test Typically 3 to 5 days
from $1,500 Internal network and Active Directory Typically 5 to 10 days

Starting points, not estimates that move once work begins.

See full pricing

Find it with us, not with them.

Tell us what would hurt most if someone took it, and we will tell you how close we can get to it.

Book a scoping call

30 minutes, no pitch. Pick a slot that suits you.