nandsec

Penetration Testing

nandsec is focused on and specialises in all types of penetration testing. This includes web applications, APIs, cloud infrastructure, internal and external networks, mobile applications, wireless networks, and desktop and thick client applications. We also review source code and test applications written with LLMs. nandsec also accepts bespoke or niche penetration testing requests.

View own orderView any orderIssue refundExport usersChange roles Anonymous401denied401denied401denied401denied401deniedCustomer200allowed200finding403denied403denied403deniedSupport200allowed200allowed200allowed200finding403deniedAdmin200allowed200allowed200allowed200allowed200allowed
Requests replayed: 20 / 20Findings: 2Green: allowed as designed. Red: allowed but should be denied.

Customer · GET /api/orders/2290 → 200 OK. Expected 403. The server checks the session but not who owns the order.

Web application penetration testing

Web application penetration testing covers the full range of vulnerability classes across an application's attack surface, such as authentication and session flaws, broken access control, injection, cross-site scripting, server-side request forgery, business logic abuse and security misconfiguration. We offer black-box, grey-box and white-box testing.

Test coverage

  • Authentication, sessions and password reset
  • Authorisation between users, roles and tenants
  • Business logic and workflow abuse
  • Injection flaws: SQL, command, template and cross-site scripting
  • Sensitive data exposure in responses, storage and logs

How it runs

We agree the scope and test accounts with you before testing the environment you choose.

API penetration testing

API penetration testing covers the vulnerability classes specific to APIs. nandsec assesses each endpoint for broken object-level, property-level and function-level authorisation, broken authentication, unrestricted resource consumption and unsafe consumption of third-party APIs. nandsec's testing covers REST and GraphQL APIs, mobile back ends and partner integrations.

Test coverage

  • Object-level and function-level authorisation
  • Data returned beyond what the client needs
  • Rate limiting and resource abuse
  • Logic flaws across sequences of calls

How it runs

We work from your API specification or from observed traffic.

Invoice
requestBurp Repeater
GET /api/v2/invoices/7301 HTTP/1.1
Host: app.example.com
Authorization: Bearer [session of user 1042]
Accept: application/json
response200 OK
{
  "id": 7301,
  "customer_id": 1042,
  "customer": "Your company Pty Ltd",
  "total": "1,240.00",
  "bank_ref": "XXXX-4411"
}
Expected behaviour. Your own invoice is returned.

AI-built application assessment

AI-built application assessment addresses the vulnerability classes AI coding tools introduce most often: missing or permissive database access policies, secrets exposed in the client bundle, broken access control, injection and cross-site scripting, and hallucinated or typosquatted dependencies. nandsec assesses applications built with Lovable, Bolt, Replit, v0, Cursor, Claude Code and similar tools, and confirms which of these weaknesses affect your application.

Test coverage

  • Row-level security and database access policies
  • Secrets in the client bundle and the repository
  • Authorisation on routes and server functions
  • Injection and cross-site scripting
  • Dependencies, including hallucinated packages
  • Tenant isolation and business logic across user roles
  • Authentication provider configuration (OAuth redirects, JWT validation, email verification)
  • Storage bucket and file upload policies
  • Webhook signature verification, for example on payment events
  • Server-side request forgery through AI features and URL fetchers
  • Prompt injection in any LLM features inside the application
  • Rate limits and spend abuse on paid APIs, such as exposed LLM API keys
  • Secrets in git history and deployment environment variables

How it runs

Each finding comes with a fix prompt for your AI coding tool.

SecretsKept in a managed vault and rotated
Sign-inMFA for staff, rate-limited login
Data accessRow-level security on every table
InputValidated on the server
ErrorsGeneric errors, detail in logs
LoggingAudit log for sign-in, payments, admin
BackupsDaily, restore tested monthly
DependenciesPinned, updated weekly
Production ready

Source code security review

Source code security review examines the security-critical paths of a codebase, including authentication, authorisation, input handling, data access, cryptography and secret handling. Our engineers combine control-flow and data-flow analysis with taint tracking from source to sink, and examine memory safety, race conditions and error handling. nandsec traces each flaw to its root cause, and also reviews weaknesses that affect reliability and performance, such as resource exhaustion, regular expression denial of service and unsafe concurrency.

Review scope

  • Authentication and authorisation code
  • Input handling and data access layers
  • Cryptography and secrets handling
  • Patterns that repeat across the codebase

How it runs

We often pair the review with a web or API test to confirm each finding.

routes/projects.js (Express 5)as generated
app.get('/api/projects/:id', requireLogin, async (req, res) => {
  const project = await db.projects.findById(req.params.id);
  if (!project) return res.status(404).end();
  res.json(project);
});
Any signed-in user can read any projectHigh
requireLogin proves who the caller is, not that the project belongs to them. The lookup uses only the id from the URL, so ids can be enumerated.

Cloud security review

Cloud security review assesses AWS, Azure and Google Cloud environments for misconfiguration, such as over-broad IAM policies, privilege escalation paths, public storage, network exposure, Kubernetes RBAC and gaps in audit logging. nandsec maps how identities, roles and trust relationships connect across accounts, to show each path from an exposed resource to sensitive data or administrative control.

Review scope

  • Identities, roles and permissions for people and workloads
  • Storage exposure and encryption
  • Network exposure and segmentation
  • Container and Kubernetes configuration
  • Logging and alerting coverage

How it runs

We work from read-only access and map each finding to the change that fixes it.

role/reporting-lambda · inline policyJSON
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": "s3:*",
    "Resource": "*"
  }]
}
Reachable scope214 buckets
S3 actions allowedall
Can delete or change bucket policyyes

The function needs read access to one prefix. The policy allows read, write and delete on every bucket, and changes to bucket policies.

External attack surface testing

External attack surface testing spans every internet-facing asset of your organisation, including forgotten and undocumented systems. nandsec enumerates assets through certificate transparency logs, passive DNS, ASN and IP range records and cloud provider address space, then fingerprints each exposed service. Testing covers administrative interfaces, remote access gateways, known vulnerabilities in exposed software, leaked credentials and dangling DNS records open to subdomain takeover.

Test coverage

  • Domains, subdomains and certificates
  • Exposed services and admin interfaces
  • Forgotten test environments and storage
  • Known vulnerabilities in exposed software

How it runs

We confirm ownership with you before testing anything we discover.

1
seed domain
46
subdomains found
19
hosts that answer
31
open services
5
findings
ct logstaging.example.com203.0.113.24443Directory listing on /backup/ with database dumps
dnsvpn.example.com203.0.113.10443VPN portal, version in the login page
ct loggrafana.example.com198.51.100.73000Dashboard login, default account disabled
wordlistdev-api.example.com198.51.100.318080API documentation public, 6 routes need no login
dnsmail.example.com203.0.113.525Mail server, STARTTLS offered
ct logold-shop.example.comnonePoints to a deleted cloud bucket: takeover possible
range203.0.113.40203.0.113.4022SSH with password login enabled
ct logstatus.example.com198.51.100.12443Third-party status page: out of scope

staging.example.com Unmanaged staging server. Directory listing exposes a recent database export.

Internal network penetration testing

Internal network penetration testing measures what an attacker can reach from inside your network. Testing covers segmentation, Active Directory, name-resolution poisoning, NTLM relay, Kerberoasting and credentials exposed on file shares. Our engineers operate from the position of a compromised workstation or a device on an office network port, and work towards domain privilege escalation and your critical systems.

Test coverage

  • Segmentation between user, server and management networks
  • Services and devices reachable from a normal workstation
  • Active Directory attack paths to domain admin
  • Legacy protocols: LLMNR, NBT-NS and unsigned SMB
  • Default and exposed credentials on shares, printers and network devices

How it runs

We connect an approved test device on site or remotely during agreed hours.

Mobile application penetration testing

Mobile application penetration testing covers iOS and Android applications and the back ends they call, including local data storage, Keychain and Keystore use, certificate pinning, authentication and session handling, exported components and deep links. Our engineers combine static analysis of the application package with runtime instrumentation on test devices, and test the APIs each application relies on.

Test coverage

  • Data stored on the device, including keychain and local databases
  • Authentication, session handling and biometric checks
  • Communication with the API, including certificate pinning
  • Exposed components, deep links and inter-app communication

How it runs

We test a build you provide together with the API it uses.

Wireless network penetration testing

Wireless penetration testing assesses corporate and guest Wi-Fi: WPA2 and WPA3 configuration, 802.1X and EAP methods, RADIUS certificate validation, rogue access points, handshake capture and pre-shared key strength. Our engineers also attack wireless clients through evil twin access points, test segmentation between wireless and internal networks, and assess wireless intrusion detection coverage and Bluetooth Low Energy devices where they are in scope.

Test coverage

  • WPA3 and 802.1X configuration, and RADIUS certificate validation
  • Separation of guest and corporate networks
  • Rogue access points and evil twin attacks
  • WPA2 handshake capture and offline cracking of pre-shared keys

How it runs

We test on site within the access points and areas you list.

Thick client and desktop application testing

Thick client testing examines compiled software, such as desktop applications, endpoint agents, installers and other native binaries. nandsec reverse engineers each target for local privilege escalation, DLL search order hijacking, client-side trust decisions, insecure inter-process communication and unsigned update channels.

Test coverage

  • Installers, local privileges and file permissions
  • Secrets and trust decisions held on the client
  • Communication with back-end services
  • Update mechanisms

How it runs

We test a representative build together with the back-end services it uses.

Local service · High The service listens on a named pipe that any local user can write to, and runs the commands it receives as SYSTEM.

Other services

Security Architecture and AdvisoryThreat models, architecture review and secure design. AI and Agent SecuritySecure setup, review and testing for AI tools, agents and AI-built software. Red Teaming and ForensicsRed and purple team engagements, compromise assessment and malware analysis. Embedded and Firmware SecurityDevices, firmware, operating systems and compiled software. Security EngineeringHardened systems, secure pipelines and secure firmware for your products. Software Design and EngineeringArchitecture, full-stack, mobile and systems development. Applied ResearchSecurity research across operating systems, memory safety, malware, firmware and AI agents.

Scope a test

Email [email protected] with what you want tested, the environment and your deadline. We reply with a scoping outline. For sensitive discussions, or if you prefer, message us on Signal or SimpleX.