Skip to content
Lapsor
Services Methodology Findings Company
Request an audit Call+34 658 360 930
Español English

OFFENSIVE SECURITY

Audits with real-world exploitation: the attacker’s route, documented step by step

We do not deliver scanner alerts. Every finding is exploited manually to prove its impact, with a proof of concept, CVSS scoring and remediation.

Request an audit

Team certifications and the platforms where we report

OSCP · OffSecOSCP+ · OffSeceJPT · INE SecurityeWPT · INE SecurityeWPTX · INE SecurityCRTO · Zero-Point SecurityCRTL · Zero-Point SecurityBSCP · PortSwiggerCISM · ISACAHackerOneBugcrowdYesWeHack

Individual credentials, verifiable on request.

SERVICES

Three complementary services

See all services
SERVICE 01Penetration testingManual exploitation of your exposed surfaceEvery vulnerability is exploited until the impact is proven, and testing stops before causing it.
  • Web
  • REST API
  • GraphQL
  • Infrastructure
  • Mobile
  • Working PoC
  • CVSS
See the service SERVICE 02Continuous monitoringYour external surface, monitored throughout the contracted periodA continuous watch over what you have exposed, with every alert validated by a person.
  • Attack surface
  • CVE
  • Leaked credentials
  • Cybercrime forums
  • Phishing
  • Telegram
  • Providers
  • 24/7
See the service SERVICE 03Active Directory auditActive Directory reviewed from an assumed breachPaths to domain admin, delivered as a privilege-path graph and a prioritised hardening plan.
  • Kerberos
  • GPO
  • PrivEsc
  • Trusts
  • Lateral movement
  • EDR evasion
See the service

METHODOLOGY

Audit phases

Five phases, each with a closed deliverable, and a single point of contact from start to finish. Testing follows the OWASP WSTG cases and the PTES phases. Techniques are mapped to MITRE ATT&CK and the testing approach to NIST SP 800-115.

See the full methodology
PHASE 01Scope statement and rules of engagement
  • Assets included and assets excluded
  • Rules of engagement in writing
  • Execution window, notification channel and NDA

RESEARCH

Published technical analyses

Technical analyses of real findings, anonymised and published after remediation.

All analyses
8.3High

Cache poisoning through a header left out of the cache key

Read the analysis Reflected headerPoisoned cache entryServed to other visitors9.1Critical

Second factor skipped: the session was issued before the code was checked

Read the analysis Cookie at the first stepCode screen discardedFull account access8.6High

Administration panel reached by rewriting a 403 in the response

Read the analysis Data in the error bodyStatus rewritten to 200Invoices from other companies9.8Critical

Blind SQL injection in an HTTP header leading to command execution

Read the analysis Non-standard headerDB administrator privilegesSystem stored procedures

TEAM AND COMPANY

Business and engineering, at the same table

About Lapsor
Miguel OvejeroMiguel OvejeroCO-FOUNDER · CEOA single point of contact throughout the engagement. From the first conversation to final delivery, he stays with the client and keeps the project moving to plan. LinkedInMiguel ArrabalMiguel ArrabalCO-FOUNDER · CTOResponsible for the technical direction and execution of the audit, for the rigour of the testing and for the quality of every deliverable. LinkedIn

Frequently asked questions

Can the audit affect service availability?

No. Exploitation is manual and stops before any damage is caused: the vulnerability is proven without affecting the service. Destructive testing is excluded unless authorised in writing and run in a prepared environment.

What happens if a critical finding appears during the audit?

Critical findings are reported immediately through the channel agreed in the rules of engagement, together with the minimum containment steps to reduce the risk. Notification does not wait for the final report.

Is the report valid for ENS or ISO 27001?

We prepare the report with the technical evidence these audits usually ask for: CVSS scoring, reproduction steps, evidence, remediation and a separate executive summary. The report can be submitted as evidence of the security testing carried out, although final acceptance rests with your auditor.

Do you sign an NDA?

Yes. We sign it before you send us any data and we can work from your own template. The report goes only to the recipients you name, and the NDA covers evidence storage, retention and destruction. Any analysis we publish is anonymised and needs your prior approval.

CONTACT

Request a proposal with the scope defined

Tell us which assets you want tested. We reply within 24 hours.

Request an audit Call
Request an auditCall