From 5926e6f003d0da621e0b7e5cd5ead9e65bcfa33c Mon Sep 17 00:00:00 2001 From: Mohammed Nafees Date: Wed, 27 Nov 2024 18:38:16 +0530 Subject: [PATCH 1/8] add pentesting docs --- pages/_meta.ts | 1 + pages/penetration-testing/_meta.ts | 9 ++ .../analyze-remediate-retesting-accept.mdx | 91 ++++++++++++++++++ pages/penetration-testing/faq.mdx | 37 +++++++ .../penetration-testing/process-overview.mdx | 38 ++++++++ pages/penetration-testing/ptaas.mdx | 20 ++++ .../penetration-testing/reports-documents.mdx | 9 ++ pages/penetration-testing/test-report.mdx | 50 ++++++++++ pages/penetration-testing/types.mdx | 61 ++++++++++++ public/penetration-testing/process.png | Bin 0 -> 45262 bytes 10 files changed, 316 insertions(+) create mode 100644 pages/penetration-testing/_meta.ts create mode 100644 pages/penetration-testing/analyze-remediate-retesting-accept.mdx create mode 100644 pages/penetration-testing/faq.mdx create mode 100644 pages/penetration-testing/process-overview.mdx create mode 100644 pages/penetration-testing/ptaas.mdx create mode 100644 pages/penetration-testing/reports-documents.mdx create mode 100644 pages/penetration-testing/test-report.mdx create mode 100644 pages/penetration-testing/types.mdx create mode 100644 public/penetration-testing/process.png diff --git a/pages/_meta.ts b/pages/_meta.ts index 39b797a..8e3666f 100644 --- a/pages/_meta.ts +++ b/pages/_meta.ts @@ -1,5 +1,6 @@ export default { "index": "Introduction", + "penetration-testing": "Penetration Testing", "integrations": "Integrations", "oneleet-agent": "Oneleet Agent", "guides": "Guides", diff --git a/pages/penetration-testing/_meta.ts b/pages/penetration-testing/_meta.ts new file mode 100644 index 0000000..c1d65ad --- /dev/null +++ b/pages/penetration-testing/_meta.ts @@ -0,0 +1,9 @@ +export default { + ptaas: "Penetration Testing as a Service (PtaaS) at Oneleet", + types: "Penetration Testing Types", + "reports-documents": "Penetration Test Reports / Documents", + "process-overview": "High-level overview of the Process", + "test-report": "The Penetration Test Report", + "analyze-remediate-retesting-accept": "Analyze, Remediate, Retesting and Accept the Risk", + "faq": "Frequently Asked Questions", +}; diff --git a/pages/penetration-testing/analyze-remediate-retesting-accept.mdx b/pages/penetration-testing/analyze-remediate-retesting-accept.mdx new file mode 100644 index 0000000..85e75f7 --- /dev/null +++ b/pages/penetration-testing/analyze-remediate-retesting-accept.mdx @@ -0,0 +1,91 @@ +# Analyze, Remediate, Retesting and Accept the Risk + +After receiving the penetration test report, there are several steps you can take, such as remediation, accepting the risk, or rejecting the findings. + +Here’s a brief overview of actions you can take once the penetration test report is ready. + +## Analyze + +When deciding to address a vulnerability, the first and most crucial step is to allocate sufficient time to analyze and interpret the report. Your employees responsible for the penetration test should consider the following questions: + +- Does this vulnerability meet the risk threshold we have agreed upon internally? +- What is the actual (business) impact of a possible vulnerability exploitation, considering factors that may not be known to the penetration tester? +- Who will be responsible for remediating each finding? + +## Remediate + +Before taking any further actions, it’s crucial to verify that the vulnerability is reproducible. This not only enhances your understanding of the issue but also helps identify the systems at risk and different intrusion techniques. + +To initiate the remediation phase, it’s essential to comprehend the scope of what needs to be fixed. While technical fixes may be necessary, there could also be underlying causes, such as: + +- Management practices that require improvements; +- Alternative approaches; +- Ineffective or overly permissive security policies; +- Communication issues within or between departments. + +Nevertheless, in most cases, a technical fix must be implemented. We advise remediating the findings as soon as possible, as the chances of the penetration tester still being intimately familiar with the vulnerability are higher, and the probability of an exploitation is lower. + +## Retest + +At Oneleet, we are committed to safeguarding your company. We provide free retesting for a year after the penetration test is delivered, giving you ample time to address vulnerabilities and improve your company’s security posture. However, it’s crucial to adhere to your internal policy regarding vulnerability remediation, particularly in light of compliance requirements such as SOC 2, PCI, or ISO 27001. + +## Accepting the risk + +Marking vulnerabilities as `Accepted Risk` on our platform is entirely at your discretion. We recognize that each client may have a higher or lower internal risk threshold for remediation, and we respect your decision if the analyzed impact is deemed too low to warrant action. + +However, we advise against accepting vulnerabilities with a `Medium` or higher risk. As these vulnerabilities pose a growing business risk, they are not a matter of if but when they will impact your organization. Therefore, ensure that you allocate sufficient time and effort to remediate these risks effectively. + +Our recommendation is to always provide a clear reason for accepting a risk. This rationale will be included in the penetration test report, allowing you to offer additional context to internal and external stakeholders regarding the acceptability of the risk. + +--- + +# PCI DSS Penetration Test + +If you hired Oneleet for a PCI-DSS penetration test, there will be a few minor differences compared to our regular penetration testing process. The primary objectives of the PCI-DSS penetration test are to: + +- Validate that the cardholder data environment (CDE) is isolated, secure, and compliant with PCI DSS standards. +- Ensure that the CHD is protected from unauthorized access. +- Identify and remediate vulnerabilities that could compromise the CHD. + +As a result, the following processes will be slightly different: + +- The scope of the penetration test. +- The documentation before the PCI DSS Application penetration test. +- The frequency of penetration testing. + +## Scoping of a PCI DSS Application Penetration Test: + +During the scoping call, in addition to the already mentioned points, the following aspects will also be considered for a PCI DDS application penetration test: + +- **Application Security Testing** + - Test all applications within the CDE that handle CHD to identify security vulnerabilities, including those that adhere to OWASP standards. This involves evaluating for common threats such as SQL injection, Cross-Site Scripting (XSS), authentication vulnerabilities, and authorization flaws. +- **External Application Testing** + - Simulate attacks on externally accessible applications that provide access to or protect CHD. External testing verifies the security of internet-facing applications by identifying misconfigurations, exposed ports, and external access vulnerabilities. +- **Internal Application Testing** + - Perform assessments on applications accessible from within the internal network. This involves testing for unauthorized access, privilege escalation, and potential risks of lateral movement if a user gains unauthorized access to the CDE. +- **Segmentation Testing** + - Confirm that network segmentation effectively isolates CHD-related applications from the rest of the environment, minimizing the PCI scope. + +## Documentation provided before the PCI DSS Application Penetration Test: + +Consider providing the following documentation after or before the scoping call: + +- A network diagram illustrating all network segments within the scope of the test; +- A cardholder data flow diagram; +- A list of all anticipated services and ports exposed at the CDE perimeter; +- Details on how authorized users access the CDE; +- A list of all network segments that have been isolated from the CDE to minimize the scope. + +## Frequency of PCI DSS penetration tests + +According to **PCI DSS Requirements 11.3.1 and 11.3.2**, penetration testing is mandatory at least annually and after any substantial alterations to the network environment. These alterations may encompass infrastructure upgrades, application modifications, or the installation of novel system components. + +The definition of a **“significant change”** fluctuates based on an **organization’s risk assessment** process and the specific configuration of its environment. Since PCI DSS doesn’t provide a rigid definition of a significant change, it’s up to each entity to assess whether a change could potentially compromise network security or expose cardholder data. If a modification could potentially affect security or access to cardholder data, it’s generally regarded as significant and should prompt a penetration test. + +### Example of a Significant Change: + +**Migration to a New Firewall System**: Upgrading or replacing the firewall safeguarding the CDE is a substantial change because it directly affects network security. This transition could introduce novel configurations, alter network paths, and influence data flow, potentially compromising cardholder data. Given the critical role firewalls play in security, a penetration test is essential to validate that security controls are functioning as intended. + +### Example of a Non Significant Change: + +**Patch for a Non-CDE System**: Applying a minor software patch to a system outside the CDE that doesn’t interact with or impact cardholder data would be considered a non-significant change. This maintenance doesn’t alter security controls in the CDE or affect access to sensitive data, so a penetration test under PCI DSS is not necessary. diff --git a/pages/penetration-testing/faq.mdx b/pages/penetration-testing/faq.mdx new file mode 100644 index 0000000..6ee6c34 --- /dev/null +++ b/pages/penetration-testing/faq.mdx @@ -0,0 +1,37 @@ +# FAQ + +### Does a Penetration Test at Oneleet include DDoS? + +No. At Oneleet, we recognize that such attacks increase the probability of operational disruptions or the risk of collateral damage. We firmly believe that there is no genuine advantage to conducting such tests when doing a penetration test. + +### Is the source code assessed? Between a Black, Gray or White-box Penetration Test, what should I choose? + +Opt for a **White-box Pentration Test** if you are prepared to provide the source code and configuration files to the penetration tester, or if the application is open-source, as it effectively simulates threats that have or had access to the source code. Select a **Gray-box Penetration Test** for a best-of-both-worlds approach, as it allows the penetration tester to uncover most vulnerabilities accessible to bot an out- and insider. Choose a **Black-box Penetration Test** if you are main concern is about external threat actors. + +### Do I need to set up a staging environment, and where do you test? + +We usually conduct tests in the staging environment and advise against testing in the production environment to minimize the risk of operational disruptions or collateral damage. Having said that, testing in staging is discouraged if it doesn’t accurately reflect the production environment or lacks representative data, as this will provide less value from a security perspective. + +### Can we implement significant system changes during the penetration test? + +We advise against implementing significant system changes during the penetration test. While pushing small changes is acceptable, we recommend maintaining a stable environment throughout the engagement to ensure the accuracy and reliability of the testing process. + +### What to expect on the penetration testing scoping call? Should I prepare something? + +See [this](/penetration-testing/process-overview) section. + +### What type of qualifications should I look for in a penetration tester to evaluate their skill level? + +Technical background, certifications, communication skills. Evaluate a penetration tester’s technical background and certifications, starting with the industry-standard, the OSCP, and continuing with any other Offensive Security certification that you believe it’s relevant the penetration test, such as OSCE or OSWE. Effective communication is equally important — ensuring clear guidance from the initial scoping call, throughout the assessment, and through support with Letters of Attestation and Engagement. + +### What are the lead times for a penetration test? + +The average time from contract signing to the start of the penetration test is a few days if you are rush, extending up to 1 week during busier periods. + +### What happens if no vulnerabilities were discovered during the engagement? + +Although such engagements are highly unlikely, the outcome depends on the engagement scope and business size. For a startup with over 10 employees and a Gray-box penetration test, vulnerabilities are typically found, especially if it’s the first test. If the scope is limited or the application security is strong, there can be no vulnerabilities, but the tester should explain their methods, failures, and challenges. + +### Do I share the penetration test report with customers? + +You may share the penetration test report if you choose, but we provide a document designed specifically for this purpose. At Oneleet, we offer a Letter of Attestation, which provides a high-level overview of the penetration test, including the tester’s profile and the overall risk score or number of findings. We recommend the Letter of Attestation to be shared with stakeholders. diff --git a/pages/penetration-testing/process-overview.mdx b/pages/penetration-testing/process-overview.mdx new file mode 100644 index 0000000..c285119 --- /dev/null +++ b/pages/penetration-testing/process-overview.mdx @@ -0,0 +1,38 @@ +# High-level overview of the Process + +![](/penetration-testing/process.png) + +1. **Scope** + +- 30-minute scoping call, in which our penetration tester will be present. +- We expect you to provide a comprehensive overview of the product, including a demo of the application. While an architectural design is not mandatory, it would be appreciated. +- A showcase of Oneleet’s platform used for vulnerability management is provided. +- The assigned penetration tester will attend the meeting and ask questions to better understand your application/infrastructure. +- The Rules of Engagement will be discussed (timeline, scope, ways of communication, etc.) +- After the scoping call we will send over a summary of what was discussed. + +2. **Prepare** + +- Provide the necessary permissions and details of the environment discussed during the scoping call, including user accounts, IP addresses, and possibly required credentials. A summary of the required information will be provided after the scoping call. +- An invitation will be sent to your team in charge of supervising the penetration test to create an account on Oneleet’s platform. + +3. **Test** + +- Any found critical vulnerabilities will be immediately brought to your attention via Slack. +- Using various tactics, techniques and procedures to identify security caveats, our penetration testers will attempt to exploit the identified vulnerabilities to assess how deeply they can penetrate the system. + +4. **Report** + +- The discovered vulnerabilities will be uploaded on Oneleet’s platform. +- Once the engagement finishes, an internal team will revise the Penetration Test Report which shall be available within 2 to 3 business days. +- The final Penetration Test Report will include an executive summary, risk ratings, detailed findings, and recommendations. + +5. **Remediate** + +- If necessary, you can remediate the vulnerabilities, and our penetration tester will retest the system within a couple of days. +- At this stage, you also have the option to accept the risk or reject the vulnerability. +- Once all the findings have been addressed, an updated report will reflect the new state of each finding. + +6. **Evaluate** + +- For instance, discuss any unaddressed risks that your company accepted, confirming that these decisions align with your risk management strategy. Ensure that the risk remains acceptable over time. diff --git a/pages/penetration-testing/ptaas.mdx b/pages/penetration-testing/ptaas.mdx new file mode 100644 index 0000000..e7d66d2 --- /dev/null +++ b/pages/penetration-testing/ptaas.mdx @@ -0,0 +1,20 @@ +# Penetration Testing as a Service (PtaaS) at Oneleet + +## About Us + +Oneleet is a United States-based cybersecurity company, established and ran by experienced penetration testers. The company offers flexible penetration testing options and a comprehensive platform for managing and addressing security vulnerabilities. Its interface facilitates the tracking and remediation of security findings, ensuring that organizations maintain robust and current defenses. Oneleet provides both expert testing services and a management system to facilitate the maintenance and enhancement of security posture. The company has received backing from venture capital firms such as Y Combinator positioning itself as a key competitor that prioritizes support, effectiveness, and communication. Oneleet serves a diverse clientele, ranging from enterprises to early-stage startups. + +## Our Penetration Testing Goal + +> Identifying vulnerabilities to reduce risk. Simulating real world attacks on your applications, systems and networks. +> + +The primary objective of a penetration testing at Oneleet is to identify vulnerabilities before malicious actors exploit them, thereby fortifying your security program. We are excited to collaborate with you in your commitment to uncovering vulnerabilities and implementing robust protection measures. + +## Services + +Oneleet offers expertly conducted Penetration Testing services by our team of highly qualified professionals from NATO countries. They hold advanced certifications like OSCP and OSCE or OSWE. Our team’s expertise encompasses network penetration (wired and wireless), web and mobile application security, social engineering, and code reviews. This extensive skill set enables them to identify vulnerabilities across various systems and technologies. + +We provide flexible retesting options as part of our standard penetration testing package and offer a comprehensive platform for managing vulnerabilities. + +At Oneleet, we frequently conduct penetration tests to meet compliance requirements for frameworks like SOC 2, ISO 27001, PCI, HIPAA and more. diff --git a/pages/penetration-testing/reports-documents.mdx b/pages/penetration-testing/reports-documents.mdx new file mode 100644 index 0000000..9176940 --- /dev/null +++ b/pages/penetration-testing/reports-documents.mdx @@ -0,0 +1,9 @@ +# Penetration Test Reports / Documents + +At Oneleet, we offer several types of documents + +| Name | Description | Target +|-----|-----|----- +| Full Report | - Generated at the conclusion of the engagement.`
`- This report presents all the findings, accompanied by a *Description*, *Business impact*, *Reproduction steps*, and *Remediation steps* section.`
`- It includes an executive summary that highlights positive findings and recommendations.`
`- The results section provides a high-level overview, a table listing vulnerabilities, and an overview of the scope of the engagement.`
`- After remediation, the report will be updated to reflect the current state of each identified finding. | Internal Usage / External Stakeholders +| Letter of Attestation | - Verifies the successful completion of a penetration test, offering a succinct summary of the scope, methodologies employed, and the tester's proficiency.`
`- Offers a comprehensive evaluation of the application's security, identifying the number of vulnerabilities discovered. | External Stakeholders +| Letter of Engagement | - Notifies that you are undergoing a penetration test.`
`- Offers a comprehensive overview of the test's objectives, scope, methodologies, and the dates of the assessment.`
`- Assures you that any vulnerabilities discovered will be promptly reported for remediation. | External Stakeholders | diff --git a/pages/penetration-testing/test-report.mdx b/pages/penetration-testing/test-report.mdx new file mode 100644 index 0000000..149ccfc --- /dev/null +++ b/pages/penetration-testing/test-report.mdx @@ -0,0 +1,50 @@ +import { Callout } from "nextra/components"; + +# The Penetration Test Report + +First of all, the report includes the findings from the penetration test. Among other data, key points of our penetration test report include: + +- **Risk Assessment:** The overall risk of the vulnerability, categorized from Low to Critical based on its impact and probability. +- **Vulnerability Description:** A comprehensive overview of each identified vulnerability, written in a clear and accessible manner for a broad audience. +- **Business Impact Analysis:** A brief assessment of the potential consequences of a malicious exploit on the business. +- **Steps to Reproduce:** Detailed instructions for engineers on how to replicate the vulnerability, including the use of publicly available tools whenever feasible. +- **Recommendations:** Specific guidance on how to address the vulnerability, varying in detail depending on the type of finding. These recommendations can range from granular to high-level. + +Before comprehending the remediation process for the vulnerabilities discovered during the penetration test, it's crucial to grasp concepts like Finding States, Characteristics, or Overall Risk. + +## Finding States + +| Finding State | Description | +| ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| Open | - The initial state of every vulnerability once it becomes visible to you.`
`- While it's open, you can transition to one of the other states. | +| Ready for Review | - You mitigated the vulnerability that was ready for retesting.`
`- If the penetration tester couldn't reproduce the steps that led to the initial vulnerability, the finding is marked as resolved.`
`- However, if the penetration tester managed to reproduce the steps or discovered a similar way to find the vulnerability, the finding is marked as open. | +| Risk Accepted | - You are prepared to accept the risk that comes with the vulnerability. | +| Rejected/Closed | - If you deem it appropriate for any reason, the finding will be closed, and further discussions will be held. | + +## Finding Characteristics + +| Characteristic | Description | +| -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | +| Probability | - The probability of the vulnerability being exploited.`
`- Three levels of probability: Low, Medium, or High, based on:`
` - Ease of vulnerability exploitation;`
` - Attack vectors;`
` - Business criticality of the affected asset;`
` - System and network complexity. | +| Impact | - The severity of the vulnerability's effect.`
`- The impact of a vulnerability can range from little to no damage to system compromise.`
`- The impact can be at 3 levels - Low, Medium or High. | + +## Risk Levels + +| Risk Level | Description | +| ------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| Informational | The discovery doesn't directly impact security. However, it could present an opportunity to enhance security, deviate from best practices, or make a security-relevant observation that may lead to exploitable vulnerabilities in the future. For instance, it could involve missing HTTP security headers or documentation that encourages poor security practices. | +| Low | Low-risk vulnerabilities are more of a nuisance than a genuine threat. These vulnerabilities are usually those where exploitation wouldn't cause substantial damage, or where the likelihood of exploitation is very low. | +| Medium | Medium-risk vulnerabilities are those that could potentially lead to damage if exploited, or where the likelihood of exploitation is moderate. | +| High | High-risk vulnerabilities are those that pose a significant risk of causing substantial damage if exploited, or where the likelihood of exploitation is high. | +| Critical | Critical risk vulnerabilities are vulnerabilities that have a high potential for exploitation and could lead to data loss or total system compromise. | + +> **Note:** Once all remediation efforts have been completed or risks have been deemed acceptable for certain findings, a second report will be generated to reflect the updated status of each individual finding. + + + For clients conducting a penetration test for compliance purposes, it's + crucial to address vulnerabilities in line with your organization's + vulnerability management policy. Failure to do so may lead to concerns raised + by auditors. + + +If your organization lacks a vulnerability management policy, don't hesitate to reach out to us, and we'll gladly help you establish a reasonable timeline for remediating the identified vulnerabilities. diff --git a/pages/penetration-testing/types.mdx b/pages/penetration-testing/types.mdx new file mode 100644 index 0000000..9137168 --- /dev/null +++ b/pages/penetration-testing/types.mdx @@ -0,0 +1,61 @@ +import { Callout } from "nextra/components"; + +# Penetration Testing Types + +At Oneleet, we tailor our approach to meet each client’s needs. We recognize that businesses vary in size, goals, and requirements, so we develop customized strategies for success. + +Generally, there are three types of penetration testing scenarios. Sometimes, there’s also a distinction made between internal and external penetration testing. Let’s break it down: + +## White Box Penetration Testing + +The tester possesses complete knowledge of the system’s source code, architecture, and network details. This scenario resembles an attacker with in-depth understanding of the system’s inner workings. Such an attacker could be a disgruntled employee, a contractor, or someone who has gained unauthorized access to sensitive internal information. + +## Gray Box penetration Testing + +The tester may have limited access to internal documentation or user credentials, which could be exploited by an attacker with some inside information or limited access to the system. + + + This is the type of penetration testing we most often recommend to our + clients, as it provides a balanced approach in terms breadth, and depth. + However, depending on the company's nature, product, and likely attack + vectors, other types of penetration testing might be more relevant. + + +## Black Box Penetration Testing + +The tester, lacking prior knowledge of the system, adopts an external hacker’s perspective. The simulated attacker embodies a hacker attempting to breach the system from the outside. They employ techniques such as reconnaissance, social engineering, and vulnerability scanning to identify potential weaknesses. + +## External vs Internal Penetration Testing + +**External Penetration Testing** simulates an attack originating from outside the organization, specifically targeting internet-facing assets such as web applications, firewalls, and public servers. The primary objective is to uncover vulnerabilities that an external attacker could potentially exploit. Common targets include websites, virtual private networks (VPNs), and cloud resources. These tests encompass a range of scenarios, including misconfigurations, compromised passwords, and outdated software. + +**Internal Penetration Testing** simulates an attacker who has already gained access to the internal network. It focuses on internal security controls, access permissions, and lateral movement capabilities, targeting internal systems, applications, and sensitive data. + +--- + +Multiple types of Penetration Tests/Engagements fall within the expertise of Oneleet’s penetration testing team, some of them being: + +| **Network Pentesting** | **Mobile App Pentesting** | **Web App Pentesting** | **Wireless Network Pentesting** | **Social Engineering Pentesting** | +| ------------------------------ | ------------------------- | ----------------------- | ------------------------------- | --------------------------------- | +| **Pentest Program Management** | **IoT Ecosystem Testing** | **Red Team Assessment** | **Digital Risk Assessment** | **Secure Code Review** | + +--- + +At Oneleet, we offer **3** different types of Penetration Test Packages. + +| Feature | Compliance | Comprehensive | Custom +|-----|-----|-----|----- +| Description | A high-level assessment of your product, evaluating the effectiveness of your security measures in mitigating potential breaches for compliance purposes. | A thorough penetration test that examines all aspects of your application's attack surface to identify vulnerabilities across all categories. | A thorough penetration test that examines all aspects of your application's attack surface to identify vulnerabilities across all categories. +| Target | - Web Apps`
`- Mobile Apps`
`- APIs | - Web Apps`
`- Mobile Apps`
`- APIs`
`- Networks`
`- Cloud Assessment`
`- Secure Code Reviews`
`- Social Engineering | - Web Apps`
`- Mobile Apps`
`- Networks`
`- APIs`
`- Cloud Assessment`
`- Secure Code Reviews`
`- Social Engineering`
`- Red Teaming`
`- IoT Devices +| Use cases | - Vulnerability testing of existing & new features`
`- Often sufficient for early-stage companies going through SOC 2. | - Vulnerability testing of existing & new features`
`- Microservices testing`
`- Testing based on several OWASP frameworks | Companies with multiple applications, red teaming, etc. +| Testers | Manual test with a penetration tester that is at minimum OSCP & OSCE/OSWE certified | Manual test with a penetration tester that is at minimum OSCP & OSCE/OSWE certified | Manual test with a penetration tester that is at minimum OSCE/OSWE certified +| Customizable Report | Not Included | Included | Included +| Support | - Answer within 48H | - Dedicated point of contact`
`- Answer within 24H | - Dedicated point of contact`
`- Answer within 24H +| Free Retesting | 12 months | 12 months | 12 months +| Rush delivery | Optional | Optional | Included +| Letter of Engagement | Included | Included | Included +| Letter of Attestation | Included | Included | Included +| Customized Letters | Not included | Included | Included +| Onboarding Support | Slack | Slack & Live | Slack & Live +| Dedicated Customer Success Manager | Not included | Included | Included +| Used Standards | Pentest conducted in accordance with industry-standard methodologies such as OWASP Top-10 | Pentest conducted in accordance with industry-standard methodologies such as OWASP WSTG, OWASP ASVS, etc. | Pentest conducted in accordance with industry-standard methodologies such as OWASP WSTG, OWASP ASVS, etc. | diff --git a/public/penetration-testing/process.png b/public/penetration-testing/process.png new file mode 100644 index 0000000000000000000000000000000000000000..4c771ec43feeab02118c76868fd601847e4a49cd GIT binary patch literal 45262 zcmeFZbyQSs+dhnhl!SmHAR*l#Egd4=-5?-2APqyKf}(VHgEW#-0}4tCNarBZodeR} zHQx9AKF=H9?{$6ueQW(#Yi9P$-uv2nUuPZXah?}%)K%s1aL92`P*Cs`pcE|_Ec_*J-n6cE=jz{2Xj4meo)1E z@5##f%0S@tqr)uT)qz=GOq4V1%*U}W>`|lH29mypqH}lA7jY|?1l?Mzn!bTcC872? zGBOgS>Q-$a*RB)FW4NhDyu)S9b=zHzVD2aa6e2vARGO$P-2EFUd#td>sRSq*14ha{ zN!<_2B;|0>UV7);w_$ckxL?GwPxVU0j~(;pU6k$((M&!xl!(4)o4b3w*`ZIkItQKx z%iluD!2aOuv_pTRvzTy3ngYAi)n9j-K$t9WM44iAX`koj2UpH;X?&7p1y}Ept3mgR z-PklbiaiUwQfMI`pRTw~a)Z%S+~;L|%AZs&hE^n<(}aP9*d)hr%BbbbgR_kq^?OW|L34*;TTo4cA* z@jp12N~PPgXC@Pn=4(=`B`wKyu`PDu)_7Zd@AclZra^r!Nn?&mR%T~T)Qy^3pBYN! zU9^RLQ1hqSm(kekuF1likL;YR% zO|=ID7z;F*@II2f&KGc^PsH7?uNE>e*{Hv!p_R5=&mW>~d4=MoVBG=2=*}n5CwlQZ zxKsTp_ji23PJb6?QB>1Q3y)6*A6MH&VKc;;MAO(&SQFTkFK38lWrwqJ@8bz)2UM|= z+DWXSHiV`+d86#0jpguEgi)Z%&E7e)SPU4dp|E;X@^RU~;wt~Lf$UsDMv;(3po4HASnD>q!!abkCBIM5*6$%w( z$x=?01ukf@Qj8zY+ua-aGWF#S%IS&h=^2zb@0Sw|w0yqNClKX_TT5Hp^_~~!mJo`s z*pFk0ql_BsPikT0D69DU*2Aa_VSQZazY?=MGM=F*2VqpbI&`_Q(@yd01r6cNTuD*+ zo5bcvDbF*MK9O*v^<#X=CSgY_mBN@r5qPm}PCAK6-hTTzQTh$iPu9;VXJ3^T5x1bU z{-FHzjs^=m=fSN`l!vlqgqWQe77t+Zghauev_0~yvB9rzlkuRXgvHacMdMfzYrfc$ z#ecvQb0{z3O5yX`ovt!QjXAU=Px$>q`v`nF17-?5xyA4Mwl{^zI3BO&DGj;SlFz*v z&tv-jcFm&}%|H0q0!6Fih?}?nwxz{=b{wTo!w*>maM?cfR@s-~JA@3LvW^EM%&A>y z2ij9U(iwls@kSl!Vp^=(`{IoOqpa*Q+AIAf(?WXvB>VO|EPQk>)FkfEXsKjrX2$s2 z^+fnYsvWJP3f^+`M2Ob{j|o1K#=SACrjYN!;oA)AA|xo5wsfkD~qLHR!2W zvb2>Am8KPhRhy(Y=>2I*V^n%Lm&{#p43s%(lVZH0qhczfvtlH)_*isFxD-ibB~zXl zC{9V+^ty%*4?wio4pE1YDgTAr6#2+xCQXle249csVTATIu_H z2W|UN2jlPF3PnTZYmR5=&&VOzmT3(;2ur**CwLTj z+uq8V#DQz<;ckb}8; zJipUa;nlkQ^*P0MeS7)Tc4>21^Jwcp>rBTm-B@1lBBN5+oo|Ny!mA2LWSZ5@(*@!N z24Cx5+c=7N-t}cVw+?a(;`?FV?i)#J!?^mG=I%WreWJ;``IPa5+P9BrCPjtlJ_>vk z?BuY5cE3@Vw)I{+7)mp?(Ro!r^@ci*8L-sw?FVc9sK(6C*#-c*S@6Ggl&9RP9cyG z_MAsCnL?Z&829}(&4Ra%RJ&82yVLs9I{&=VmbTa2h#ci=VK(KjzQ(IH9bMb;(6W;$jj5UHbGKMm&(&BrEjNNU zbzi1_CMqz-6{^}N3CV{uP{y?~R%Xt!;UzhJlR5ah%D=MNPJODIQocnx)qy%6(i=jc zMO3tvRl=_$TIZ2^St~n|dFLkSl>lYdKo(rI!}04Z8G%i;jZ^BYe#Nvg(V3^m7gHH- z(kqTxN*QTlCnvP4xp!opR~f!Jq&kZR4qSA#y}ZygD$`)+fHk)JehPi{OZxlgdRaQs za+9O-$Lg**qm8v?M}1GPe&V)8{;Io}xMEmWnoexuGHHAFQMqO7t83fxjGk>dv+=(7 z@>&9-G`Un!x79?<1#!wVQH|&D-oeU2xRMZ5wEaR>>drH;i)%fHUUW9r$@m5^_04fIZr&M7tNnUmz;}kl%%dC!4_k|Uowso3Ct9-V z+IE7*f=gb!d%=K^zpOojhxUg?eqH){EMpOtn%0trPvt4xvi*80rZ=xiE{Q6SDlM?= z+IwLiMjT5l#>A^C?vy#{cQTr+HDUPFa9TAiOWcd`SATKMR!!I7X}X9jeDfj)w+t7L zbdGDhp{b7QVs8871!M<;ND}4bH$85d9ThLRoV?S<##DLJRLm{Hcl#%zdvjZm$Z59e z(ay6jj!)$kGmjd~=2$)+p6;akzVu}{;onUXInn&Epf-|?lbRWt>Ge@tRlY${w&w_Cw1#a zzZ!fm8!s=3GUJPW-Dx+M9T~ad-HL}|$b)jrTRbmPC-a&FLnG7R4%P)znJ67=xCn~J z-nCdE=GELRy7}N;?~9PLBNvp%BPg#=(ATW{D-_b}#l4-0Ch*lyrB4Ozx{!G= zU83{S4R@)e;>YT-*&S>@@6H@OZ;()gTk9)4Q&B--1>0CC=r_nwFu>Lg@Djg4@gLhy zZZM;u{r(*l1trW51^w@1RKX|mFB-g%=lu1F78{C!3BD15mv=VmKSyH~W~2SHjj{pu zp-5@TC@6qWElXExYbQ5bXLmdy^kwh^_H%gyHx!h+AlJFea6>_peh-X4VW+L{uCJmj zZ0QW)w6Jo1YR%~ld5#T2~&So86dzfT9>#At2Z-Jc6{ad~-paeDD`I=k9% zJ$&@&5f?WP7Y`2yID*5?$I0Eoo5RVC?yo`q8RxOJo29GWb9XyuCmQ6q7Ehf$+{I{V zkr(=pzrXI&+S~45S8{Uu`?0_Sav}F{J>=x(`j4@}siMeVh1Ko6tsM;>+d;sbfoq8K z@bZcNKK{S$`PUWy?M(fDJCo<(e>(NwcKz2=b=<67Wt<`4n(pHNlGoqY{r8=JpD4agsE*}~&#`zqs z__vY4tzwyWjh;=#J(Whefles-2XEQ!sMhF(B>M4Ne{?t)@%{}|tzWb>K`5wLfADti zHVyX|EVdNdKRli=`Lov_-1hH7+Fzptvpmu7A^F2+4QeNWq5a8CBcJODI+pUo&x(bA zdOUjJ9_61*IP%W9X(i3WZ|m~N{^66-aKGC9v+1S@3c3yC^R6nE<&VSzo-~-n5A#oD z{|<{V`RU69<=cPwq*%%eB7Z1&8uQ0MK6GVP;eYs~lIA$`e<*mA8+54Xh4(BNwEoN} zP>?E){|DOr`;h;u;{Ssh|NmOWV}m`uz9X~${1SU3FG^hV?OhH{iK}0EB^4FAkm*{D z?ddwLR^Jm{G)#PLk*%s1tZZz3(ZtjbkeW`S_@ib}Tq}-IB|P55$EVSL9@e@sl=EUl zSI};lei%yszj@~1&%nlreh4{?vwQq}!&D*&_on+XawI#~?4_q?=3ghg@RC@&6^a-p zu0ltuf3`X5go#&1)6uY!+d!p7N9e|n7X-R8VfZ>|H*aidVj+ z`I7QRAx&2OF{+yA{!7CubE!{?v$?XkOhT>ZWU;sZ-~3Pz9dLrHZ=Y}1O_Z=zwhY&F zO0bcZZcbG0-dbP0URw3?KR@;eO{NiAwjo{t4k}n0hlG|}wzp=&)VDavEWm)@b|^dg z3mq5Iri00eCSChD5{}&U-xqsqj*|@@;?_|fNc~GQB}u!jC!ZSVg>vkS6h%!#H_J0N z$Djc%Y8638!&eJo)P*=7cVXux@K)aU8~LCl zagr5XZOR@qHd+4ZmX?Kl3YY!W>>ej`UZsf52@%<{_wUt7-i zKsn<6qv3{kg1 zx7VI_z5ClS(VGRe$1m;DDZWNQUBPf|jqZz3K0JTPf!yhWe&j%@arnNhOnb(uxqRAV z!eopg$vC&kWAm)h{#f&_*Ccm3>vLW?NG6on??x^o> zYtk7dZJU%Q+-H?`%9n)r209Kyb{2))w7IC# z@@8=dzYk^^E>&y`xb!PX$|k{9wLsdfqHH!{m&8O!JBeP19(pXBqaV!_NbuUSs_x{hJkgILyKsQvuS@Z+?V$q0u0{qT!W6J04 zH!P@`oKCB)`{Kp@-lLn1m+Eo3SQkiQ(U_}BN(e^QFgRI#)v%;Q`iCmiSGI$5M03wO z@X(7s-oy5bAWyD-z92o;=(ajqg|C^wJ1D9ZK_%Ao)j?L$FCwl+3Vq|9GB=I-8czAYCRgqq2Of&0jL*Lsu2ue~j4cAShyW8U4EvI6f&!q=T#vK~T7a{TNRWtVZtt|ZEHEDr~*zck)g4?7$y4dR&Bapa=R%HC%=Ng*=DJdy&4UkmM5Z3vYAu`cu zFr6)h#xRp4VJF`J48Hcmm+ED{sNcKA!br_pKg?WdzWSXVJYy)J0-9Q>3R!j zigH7n=Iw{k0+(;OV9))Y^(QZgzTy%K@5yp!^4B zc0P6hH`qhi4YWzI#c591=GVaci9K8srAVDucNrwm3HNY1#jbn~nP2&!YOUS)NCNAM z*)Yds<(@)iN`D?={o?d$EA9DL$E|j}z5w!`>OiYs^~Fh2aOe7|XNhwd33X7!hWv6& z%XSVcyNE5l16(Cdpl(3yWLDni`X_1I-tx&xnzLbb`9epS5peP+{ww8j1_mh}OEGeW zo_d=xy>0emtVPPlJ)X9iPFKetQxho(Nm$H?9t26+VacDb)ZaK@-L~b7tM!2+wsR=_ zN;e@Hl-U+jQq1Gx=Ua$dnt$^$)=22+m-QwU&8NhgjzGZJ_A~)c7|2?ropAT-JV#U7;qP)ND(6>dUrC8{sdAoVyiP>d7q(1C`rC3;# z3_06`C$qomCQNJUXI=YhJv(7BDgJr+%*iMapHIv^Si!lZuV*rqzATdmi>2pPsx(lq zu|eZB%iE(L$oQT2?%ZMcuCuJ4ur?>NK*$UY_KOUZHSiL-Gj&{^Perrb!ds4H^LbLLxv=)B+oNvr6m)2*7pmH4rW z=A9DLfKzL0%(#~oHiFu{_|+QMS0`;UBk2BBKnov<RG7V;n@}CYq*G z`7Fi62h}PJ=f#VxLo#Z8Z8AI(W8s=dJ^0ER{%1!D90FsZ>()HquM`>J&`pljdpr)~ zW!f3J{pl`W$y9eATG$~Dm_G59m9fjA1P|ZtZs>}aKK5JIxjfsf9Me)0D}Y@d8?FAT zG5>@*R&A}s&?c7OCAB`K1ig7H6$Bqj#PN)?2=!F(%Z*;P$|Hv6)0MOgc=_xr&!CSZ zZ}TYEb~u0D0RcvtCdrfcmKl@WIH{wF%Xy$zF!>~1rOCR}Q_)>H^e&D2B2 zIGeX}>)}v`I;$Qc#ClOyNtF0mciQ8gfS3n?`S{8JU{0f+W|sAS@wAhhwTluvRv%_; zii3|UoHW97rf1y`&Zca#Sg@PodaNi4lZuCc4ViKBb>nF?eqYb9>aNd=6jtn+9Cdvc zPjP2Z^zfaQnRC;ObDPQK0zu#&r{cHGWwj8ylIQ&ZJ@nvof~avgqr}y!4Ib5BF$Bh| z;<@Xu8st7%?8NBT+p_rB=xm{Y()JrA@KVR@!%_zD8O6*H&opC}{ zTFuA^Y?LHJ61Mtvw!3W3WZ)ZY8ey}EMXx|Je>}SbnRyg=G_K&}YTcY@(rxbOe{Vic zRk#PcJ&|Wh%ua+LXdwO32pN?@g_3j4H-UlZ?Y6VA%JfYbyt?_2C|S(nGrG-33$hgx z)TTKLI41u6_W&U-F-9C2cAsrf#6O6p_CL~CZGzqMFw@al7R_dvh_L#|&{#pM#Tm@f zRD7$Ly@Smr?SL|K>ak>t!nq@rUnB}@&z()Yp3)RHEKh)xIhx9Js!g zQN}qyLo!FZmY0|9*M@QwOOhShvVR0In=608C#HT$e4Db82Ykx<&`xW}43 z8sImNFZScmUsU0)Pc&P97FgqH8CT0k=L6BhioC_+@z zAee+uy&C0u3kz#j?Q^y}9|F{HOZ`Ne>b}hel(u1wv8_ zb;2=#9=oEtgdTiAE9H0;=s9SV*D~FDVgPWW)e{Lj!Ms~F>vNfuFKwqjO~U*T3u`Uw z9V^@IBxY0qRRs?db+69q(^tUGHfjY1Va(*%J@_S6Pok(G8EylQ2KHKy(HIhMrFkyA zA~ghPp$+i~llpP5&Bd?%agbf4p4IrqDwYd6!$oc0|6GicfLHr^eb@?fDx1GLZWzC# zXS|ReS4gxXWQl2P1Pm0=x(%r5T-c+lFi04N4e=~0R7K;S0U$HKgb+L-)q2r_U=7~2EaY6Os63t zLth$9Cn<;#9t{j9*jqGYN)^_d*6#Ct>PmD^-aXgtv1X>8Yu{m*n{)i(kP~XdxwMNP zcN~nx{um`Vmk6oSdb$A;lT!4s<4JtJ?{TkS4QRLgH+%gpMD!Ur{Bx#_1Q(4%4`Lkl zcJ{ycXNY)Jr0IOsYd%DoZz2%gll*%0s)VU4;a$JShKx>;Jw;Bn>jz2a+S%*Lv(og7 z-h0s+YC#1bqA9%Kep{T)9L+ZIL$L}dZ>VN1p5kMO^nLcY0oN8EjU8gDL4Jv1e&sEb+`Oo}X<_aukatkqBx>-805`xPq zue54ne$pFTUrC=Fh7AIS5zS7|Mm&oay9m$p#DIL7apr*+{C7yf3(fdi;gd%yCLA zM~HMB0rA?IojQPL*ZI1B*kUqImuUQ0UR3%1y}Uo?dUZl+zNb)vRCXi)Y=WMRuB|aF zn|ID`#syR`3(^TX&D!Eoi_eyrwFMX&t=9XyUP@D`f5`gmRT_uTIk;29{3*oswjpQs zO_SH-g836t70Z(ye!{`qPCj!J(x&laeV=>*)HDtDn{jJ|Z`AW1*b}Hwhg-1TGjhhI zhOXtbhjF$p9}Or~!uZ@@jaO)G|VIjnp)pJjHo$4igLErvH2`7m%Z{1Bn}KI=&u0{hxELx}N> z;2w8-s*uZ5Nhb-eR8b#S!_2AN?^cjUj}T70YhkiOc+x&45;OE_J8PuSr8gPb3KF*y z-%28rA9c-np2p-QjyCkGHPXnfg*Se7OQF{BMRECZcbwrinLdTiGrt`N@sOG>!{lSm zi;X~6i=Rj|xRrA+ogy4w|2cyICw^o`xY3qFt;r@;xdDKCoT;lO#4s9D2XxhSq|YHu z0OALEK8ZopdZECL7=PgdCRrsIxO`=V9|B1J*RZE`U;QqcxCY)NFf;>$D*5AKN5ZlY=q!Gl0?s)ij8 z@#z++W(@bTEyrT=FF$#2+(iJD@8xK2xeJJ<01El&NI|m{QfF+@#;dc<4AbF!OpnWE z+V!o46#w}oY4pyt+LJqpfSyqwMLoTL{h9S@R7>r2TE?e}sdpE{hg-hQtVCkeaP4@! zTxJ+m3&%t)l5Hn*C80h3*8B}@^%zM^|L%L2=!55`P4Sl?pG0#@h_iAwd{daXV_Bmz zyr<9*zLS-{v>7M*Y5ki~C<;!~WO*gi?())Tvs0G1e@JYBM;5cm>XVdwIkLt#8*`yl zL$oH>P>H0o$0>{|sY^!A060fgliU3U!bfpB&NDH6eqE82XkpePT>0I55>t#LAm1pI zu5WXitDm-KD+=RWFHpM5cQ|&8b1&H8PvV?;!H5((9xGEH7^N276b3Ov<@4;ZM(G%I-}AU%yNSdlgiuN zR*h+x!J}Rw&{ebk!368^q$L3p;gd}BB)|L}gJ>pH+k@yCSu=PKL=W|xN1@d~K6OH%5)^c~GTR|&4rzU={0 zTJA4Pd;KnfUdgp5XFNb}zi<$q{7Nbw2i&BZi0&*PQc`qX#N#ku%+?#2`W|nk)JGN{ z3)ls-6mGC&-`5+4>3Z1T2xhtM*#H8A*2(a<`djmhkmQh+bHt{NPZzPLU{2Ir0!!+Q z3DZVt<_XC7b1UrEN&A*RzvG)d%fJ4J<;!DgrUq9++o_9XhV0T?%KA!NcS&3=xF@lh ztUNnA2id6KrpNa5SQ^J6P`?l)GuE*ET6n(M%Xt$3Z@kerBjYJf9Y5oH%8l!fCsasR zbpn5CPw!;2sGh2%-AstH2B#UKHli0MZ=EV~26#uQ@x(tXT;Fb(kBk@JAvjf@S>Xj% zE`H;3R>@5r&bgnJ-g-q(s*>-O_~`|v(ZS2WO4HW#qChJw>h-63yLhG1 zK=V`(X9rXubgR)MwUb=hbx9w?nK};Fx>(5a^g}zaQkULbNL;R~6}NrQlfz_qi;xlL zrn^fUB&mVBw)!;%RqH3bn}j9~>5)zBcqs%NZCerJMmgut&W_dxxUu2K{IbPneS$V{9WHi7O}vdhHr+)SkFz~C4~J{%JqWXjbSvYr%L?s917EhQjlV8>`%?;h5hMWS+K}M%O+bWS*a9y5S%Lln6|=Rt-^a+3an37gnbBmrx@m zuDs_3mKck?VqF9gJe~g3?p1qEZ;{c_>Bgm%4kuw>m4j5^fp(rdDVvy#|F4Cx7*?vH za^AVnFD!9JQ;yq}X{x5ySVE89OuV4XtM7VsOZg#Wqg)Va)2V+MXMsW!`$Sklw5Lv! zeiD<^a^W%{G2P(UE&<)EEw@2&C%6+S!C@HsT<2)k#&PDnb#n|07Naxw`f8JFKqbL7 zMJ-(@0rgIEq`Ijol~DYP+4RG4y_EvYILEkKU$Ubf27cq8K(8pA$T4a5Of;Sy5cr;G zL;TYXeIrs*-M6B_Bn93l6Mhh+P}l=vtD~MXZdU|FQnAp0jVs<~BQCqXJY`U5+AH@0 zb)3TTXVtJXXFTk9m$3VaY_DxT0YINl)!gF22?W-&kg|BcRC(H0C`A?}n1~QS^40nx zsCoF%npn0Kj$g|`FPnc?LNFTU&5hK5j4uQj-(IPX&0V5o%^(vFF?V^oWr3ib(sw@V z8KCaw56n)(cVdt)OAW3W(9plL39#_6K+*L_z!ffoaEyQ~eq4+^T;@`fX`C52;on-< zn!oAu0tHo;Ejz318I+Yzm0_{gqj085$l7%?v;5Ly#Q$QyYg|=iJHC!1u}M*{#nrW> zVd5{*jHl@V;hNmIe7Y}%Nl9X8Fw)952kK6CkirJM1d1$>ur_$CW_Uf@x|%Tx7Lr(M z-9#403LXI9<2#ece5m1M6&~M1p?ua@aWqM4o%+b_nIS=d)D4cak#%GphB%tin!+aC zCA9Jql&REy*h49o6wa85AwDDw!!+uG$PB6gg1c!qc!!Vd9mmYj%xC6_NCvDS-VRKO(q z(&pjo0{vF!Y-WVmYk;ADTbYq4U<5sj#bqQAJBsE9RoU9ic6{+)=JUe8C1vP({qQ{@ zDpo%B5>OoCR=%Ey5KyZ;pH|sD{UE}n_NI5w?%B!Nr`ulvg>V~OR7{iCT6Pi#rZ1TH&PL#HN9ZLq0l5@mZ z_Ja)1AFZi{P9+?7&xki3TD0}aYCH4JdAR!HQ7DS38Zpb{`!rDVbIYPiwQOQw6egEB zgBpb2OdFsA=>qK>0OW)YvWx=c5vjwtO(zovGO=)JNr|gF2Zn9$?7zR)pfmHmoOY-z zXlwze!1y=}YoCYms3_g5%2o%$LDRy~QG2lTk!Vl0MCL7)@&~W_tEH&N-gUKGCQ-H)fe zr9JH=BZY7%vRqog60KyesDc=-1* z#*v$)olJ<+)86Wj0BuYz;T8G~cp$RlvMJ)uxD#A=C_Iq4(X>zXE#QG&HYJTJln$tZ zo7l1&R;Qf$d(apU_!_8wvA5c{fl^Iybm5B+i?y#@(6oRLT5-sFF&!9(7@Kk6z|HP|>RuyOpLlUVJDl50Tpu)mglNeX&m_^t(?Qkah;!YlaA zvA~;P7RC*h$oqON^My@xv?4*vXD&QT33SvxDzl^`fAd>7Ug{ zET>VJ6>!!Q>%u$N)a` zYypSy{)PyRyeFsiE~6T9r{WUp`Eh<(Hqb*rAM1k(+Vd-`%-{Kc`%#bmKhikhcs+cj zDD00#U91-0V`Uz0H^Pjd!vh3lgCrpQ>b@(DfO=Cp)m;LiA1F%Hi6g$I5>Go{w^QB* zW?=s0H&b%A8!;<15TSg7$L9shPGd#<=C8%56BDI-fCXefRw*~EJ1A%bg>vN0&`B}F z1q@bRG+{>>VNM??pZSGK&JlIjiFtXLdM{uoLAm$qbq=x>hOC6|iKrUc@^F8#@<+5} zfeJRwLAy00s+KbT;Qdwof^+Y-tj2-9MqFaxkSZi+7tOS9iwzk=u}0gm~ z;F?ah$A!}~`M`EcirQU`u`i)xZwQc@ehA2{9S8TNrL|y8s_u1MLcaS0pmSrRPlf=+ z4lvKtRame)0mKQN)7KUiEhA zOklV5#MJESCtF0SSJP%iv!9(6ShB{Z2aQ7?;4-Z3Zpd8X=tHuE?ik8hWg8Ha_=hnn zf2Yp9g0iSYt)w@P7WIZ26e6jim5df9H-GcX>KXc>z$h4iQG~-Y$J}@QOLfbuLDhfv z*1{qr${Hs1;^x3!;u-wSp^WL^ixU6@E>K+tBitHeSQJ4}|ME!B{UrV9@g_ttN@Pdq zByY5o>Vjz-GO7UWLacBdY85Ig7>ObM(g?FbkYvUkP};$r1WtF?p)`LkZUOhG$DP|V zy?zKNN6(q(+R!JPOr;^q9FWQrASD3^jce0G03^eWXtEZ~;#2!tN6YJ{dncaxR;u*1 zocINvZ#NKp8@KXJ%Wo%%Ly#CpvgMe45Z(v*&aqP>N@RFAj@cqz@a>U8mA6L>`Y^x7 zy6da+^YNrmWwXHJttmSb&&`fYbjaSU+aO|ju1GDb*6MKOn^NC-I~swqQW4ijBnt3R zYAm4W&Q`c~d0@w|Mn6Iy0gIoQsq)&M=7%I?AIPoqFZVEI9W8U*c=T6cpioU0Q9t0D zOU~%fgg4Ts-F>XLF`BPHY-S|v^0Tw5M7WRP`STy`!7z_}<=+7!^+SjsXp3NYfRsd! zX=*;32U&;y6+Ga4yR6_O#8$@|I^BgR2cRT)S zygI*=DY{kF;kRAj-chawopNs877$ZdJI@Y_29>><+9Q`u!qG%MJ-wpkK_o`?M^X?jYLz9i!z!86N=ieI+U0)%O0*1*qz7 ziKya}^D)gCta#|nZeNe4x;4vXd=Cg}s2)+vsRa!X#5vARE5Ipy)5}OG}=v;T)E&4s_Hf~D3 zXNCD=VTUoU@5p#T|7$wj?@&eQYsE=otJ~^8;w?%NzI6#sD>1U;H9!H~QruahGm(QH zCY`?JY+~lV{Ln>}mUx^KMunryhRa}I2@*q?2mYg_=%FJ&5Jw6gn4ekcIB({f-V>Yx zl{Z%R^BK^@U}nT>k{hN1dOXxNS-wD4J0fkMr*Y=wx)OY`Qnm4zQXs|A`30(0{yV9- z*&5HjEm*INhDISXh&P)o)*!4~t0g#*BZWCr2|HtT?_bIk^EGts*gxpwYRET&896n6 z5#FvHDHA)Mq}zU4#fRz|{A*0l4DVvx?{qn7{8<_#aokp3^40A7^Pg|I*nQ5Pd@T_D z`I>HcSfT2js4Nwq!Xm3!=tsPm7DY=olPMUm!*RiRKg(~a{CzBGqOv5Tcbp50mJq}i zULw^ImXVLXLP2pp!}MvPYKHwB=%-4Adn=rQs=a6xn?iBaySXxnIxZ76kkn5_zIlgW z6swZIl#3v@UN>P>ydq-md{-$?%=6QT3+l(5VV2BVX&^R>~!mc~> zPQ`A{Sjzibu5XwfK!J5vqM+gSYaTAVFurFgjHgjM5d&{yEAwN5k{lOx#IJrW!isqE zRyfv?eObz1RNq1;D0&=cVuhn91UVN4@-K+|h~tyWDhV2wR7gjyoxeuxBYjRm(0bgM z5UHlIyw-1yu%T^Owoy=ccBa19Z|Jyw&eLd9uk9?MvXv9~tBt!I%SwUQ9mugu~piV-E+H|))_2c9Ft0!(I2Toq}DYF zX@h@p@Q^{!^WtOX%K%Bb`jOvb?x+#M7NAuA=;p(1uH~y>_(n%ai%}hOOeF%--aT^<&S{ z^7?}Wo8EYqoaHI&BojZo0>KL9I8pcMJUN1S;h(ojlAktZYN|%Er5x+p1wJtkuMY&V z&I#`xH_f(0QNt&kw0U5WWsXb%J1eHpb%s*VaT3!oQfsHB#M$&XWl2u1*>jtAl|zsY z@U?0D4wqf8j-q+I_kPIF#9%c8VxMtSfIj$WCszVN@{F^O!CbcK=QqA3&3wE#EM(pQ zU||V-T(FJ~OdcFmK+i^7ZA9kJ8(rclQgW>hkUTIO#GrnYdN|D<(AR#D>{~VW z`7jbpI3L@jcy|(#?QHoi(Q!XO zIO%SVm-}zmH{d0m*Tpi9ST(gK%rnDzdM+ob?1r+XV71kzLl5Nx1Y7q$<0is8!kaU) zK}Lg!7j`kmo~bEl1GG`J{{?WoMod|L)nmn4MYY$nJAwK>2`C^0olPXVpD&r}basU^fN<& z#>&aupQer?1mVf!mvPM;>jDS;yo0sK7OVV-v%x5dD_aw{G znxyYQZS;B7s@VQFUWbvoB0-Uq)?fVLV7|W}$Trcu(r0HyK%dIUblY!C(8@jv-~WDlY<#cEmrbHl&Vdk6laNz96V3ydhB?LgZLd!`x@0ON)K^l|ju8}-Q-rEeV!G3+Vb6zeU0{Zy`|0(-jt&wH= zKy z5!EERT9?MWYflQxkQE)6e*=}i+r)KMW$mEfsvS|a+b$mUovOCB&~YEI zM*MK-xd!Z;+q6F!4+J!f4OEfxup4%S;*HeDu$Tk?9iR5W$pTQt9uv#R?kBly!tF+J z(X?A{sN5mr+P@PO5M2CZKw-8bV@>9Mb5~WBp3mzVP{)H=D#JhyA7*p6j zq}wJ(J=^ChyL?w|jCzAt|&m2$Wh+O)IZN35;JR@Y6En6qI(0Y+6QzK`eNve!M`$53hDvv+|@f)EX}j|9us}bI+>dN zeCr;7&Scn;ol;(2_+6F>mabhrXwQS!ze0#x(;|~=ec;6pAlw>eJzjt!9=|%@&04A0 z#q^oak-=PD_zv2)`;)}y+eui$X8T9O?&7e%VDIzre%51F_1-OHy5q<@vwxB^= zb@w&s2dmCM*J(6h{loxzWFb;etI>uoWWEKMR%s{TZH)mXXO;7t)8-LqdRIi{sWH~v z;8!=`Qz`T0d_8q{6TeyU9Q_I(uv z7^)~J;KFTYK&TRMJTkg3k$ldy`BdalZ*m_p=(KyBEYO{{(pks<_?m6EK3tG^bg%3L zfBkG51l@5N0x>Hc9i2y|o2~qc&g&L&>(E}$M-?yElXebxic>E!tfgs6gTw?TKv(~@{v&%5!>MukE@-Q-(&lgS+O62Ku+!Yl>t_ee z!pOeKsZZX;OUDt)X0T!cfp6@lE&6l7RrSKEO1Bog5K$Q?#}Psv$OdiDA^+aQbBcjG zg8i1rM4j^}%lVV6>KDhu<8@)u>P(s5xz${gtj!`DwS&AI`e4}u6ky#1G2>KFhu|!(7#mWyeNoeJ82;&D(=U&zX6TF>Dcly=U?L^|Z?! zWFW<3TkuM4fEqM+Q;^-|I4tG_3VE>WE8n8+4`C23JaRsDPXetHKwg%3?ZQi{tE;2a zN)auyc3m2fo7@(l0y zyOXI*rEvYSRRB`51=miW_mQ$5v^E&tSmzMwx>NbY zrJp!i^Zq%@?Sfm)`th$nYhWQe?_Xlr1}b^4YV!Yw5ME>8xIEwK2Vm_%BbkH5C$mo9&|Ks#{rhsnXm-$3 z9a|?sWRj{(`j*J#ISz6?14$#wwsXv`WH^ZCe;-ZA+TQ5Ij7R-@Rmi`+sq=uvDe?Uk zd}g;f@1_Vo!$mHghz6%eEa=8NXO;IYyZBBFY?dXlafB0uta6dTR>Ucpbs(m@h zY{xxkle1~3X;T}NCubV~mIT+oN0fcZkFHezuiLKUlr&c?-$ljwFAozG*ElQj*`zKm zPzaZh{|lhRuu;D}1yO9+_PpM(&9-8CZ_!w%71}uc(JA7xVY;W*)Y?*~vO0#LvXw{fwHc>pTK4YG%oI48m-E3JI!a^J4Ou#D;_2^85(fk|Uz~A>yniM_ z{oZiP^CRp3!`NR(McICTz^EWdsfZw;q)N9SB~l_tcOxmCBHf^fN(c_!T|;-t0Md3mG6}?f@I>$X%0lDG-D~2tA+s^n#W7V{3C#;0mK9k17 za>7P{nP)yFULkOTK2kk(`wIj9M<`mZ1~vvP1r1NyW#>8JnN79(^IJBD?yBy`-LqV% zpl%2zU&CY{wIH)`PlGwykTzirlV@9n?*hdYLMXnkHmo>%I9QGnaH>GQq zdVyY<^!e6!^2ll|Dt7Xv=#I^FS;OR6b@vASZafib$eLqVtf7EWZ72X8?craD3 zInm^|XQVc$kHZ8I*Aq;>!w{Ty%PUsCVes|6GrlmHX+Ol~Q!v2*w1F*ddF(aPMQb@L%%;3X(gR|Cq@2iz1;;XVA3dwU9f4aEZ zSG|Kx{0pbsfFugSV)hW3%qDm?Tm2;BlCzo$P2VLd`g*$tX1E{n}|Vg9>kocXVI9f z*X$gxr=z=nSjAYc8Jj|@fN@7M<=Qd=XPS`+G`a6EJVg7-MO)65iwo#ge1)Oz{Y;J3 z-L|}Bb|{@g8h_0Op9~&%Fd-oQZjky8b6 zj}o}FB)j_lhF<>UV31m>Gy5_4J}b`KO&ysnYhrNJIgf!aSnc?l1=t5q#?~BBJ17=R zzkAvUkDhRI-7hXv)pGMf8T}^ckO2q%{b)zuZ6bbQB+U%fA)Jn}G;pvboI_kk6`68Z zi3oC;_tDpgd(?L~Pu~=LC5a944`!XP=s>EPoEFyPOK5{nq~u^M;&f91lA>tKN%Dw+ z@NE9H!gCNRM1Y_R`oJZk$9R6n81BU)sDbE6rh2EK*V#vDk8g8%FDitJ&fPfe*bTc$-vQ?!o^0(Cdds z$*TFGk;x$>O{D`SFyT#&gPw3oXUML21LDaMldmsg6Om~ONs$p3q+}LIvTD_W_+7W3 z09WifADsI&z<1i@f(qA(_}oBv8y*xY;jwjmuRPituOvguQ8&>gKgHL?2z+d$TKLwCUU`}4xZD0(N3BG#~oXfU#Bzcd3 z$RE=3W$vz2F}lm!i@O4w&cJ@V86P1i$`6q{Nc4+OCGIp*8_MJ|S&Fw}8}gRygjG1z ztPxWL@EL;TC|R$-f=4oRf@#DG5Asy^Z)E?u%QAd0kO~)_>JwMFhpu92sKFX*?PE_j ztC6l_TY|DvTVQpOws9EQ%e8D3=+B;wkF)Ulb!Ws9NhoWgfPi!>4O4ofMWvYkSawh2 z>km-cBt~=l@vd+tNUh{1l2D!E{-_zAdkOA>AwRfj0S0_}1xCLq!szc12>QGh4e^y|Ew^(L7@b2_j`dSb6?g5tJI1RmL;d(;3F6G zxjO;znLbIyv_N&YZckKuC&oE7Z(A-XbX!_?_a2^vSh{S*A~sk(P;M3G)4d22y4m5W z{Ew^NKhqDY-$c@t(t{`?LS2HMC*+~q>vIHeiDFNF?{qXX0`ENV_#KY91_e!SwqMT; z`6oA9S5NP*w8GP8f<_d9mT$A)B?D_^A^^l(*U|)YBtYG$L5#wDPeXR4JP!!Qi;WQ{ zn<%rKkTq}kw~diSiB&b*tl9*RXt?=EDjl!RauxS-AszsV!Z=Q0r`tBSpQ&-LxrBkC zRy;Y4DJlT5n>`GU1^VG16_DCoIu+>|+PC?nDkkXb+hK9IvflzL1$I0~Jja@?vihts zA#DLVS<7vC(ECAcKadIplpiFi-?hj_oW`%izn3b_anZkmY$mMnQQhgV3GJ{KoTH++ zPSHk&1Rj8RVhmi25(E*L#GhTUzz4kDd``*jD{p6m+f#=!syOLBv@FAxsG4zIyMPac zt%cZr=s8D6&b|wrEZ)+&{Nd{oN#QZs%$k_~zw8k`&wj7h9^E{%wD7Z?H{<%bj zU<;B=V^!?xrV)RfEq{|A&e*MB9};#KM70cO`bY@d-KB4|r?ao~N586N7~f$SdFZ*v z#FY`sW^{0l?m-lB@4%cvDLcyxU(x0^zwU_L3u$l0aG|y7TKqr7q)MnT{B_q|IG6e1rdpzW2 zxm4=C@8m3BzZb3cRJq{bG|{qV`3XGVTl^6=wrpUB8j1ewzG;6&;M4gDDqW7S~m}iurSr-jRa**W9Z$WtO!I2)Jn7rhJRl zIUQ?+nrid{9&43Vzx^;}$yRo9@9+_|sU+rHS+r{|+YmFREiVF>h~B!E5K z>svfZCWnCK0E6i|tow0-O&wO}yX}CK6)*k7K6~b(k$ciRm8D#ea8Rm!F{zS!_%UH_ zx+*Mg5lU@e5^^{tSU4=!!1ctN%|8w(7wB-vu=-SNHL&ybnGbx2{B@wB!9=`5o_PPP zooqBR0A%Jc7Ci2^=nlmc>8M#L++vIsbwiiUa5Q6Y)X@MrWtF~ite9QCW-)BaFL5@<6ezj z<&P?IzLymf%NY8lCRE>3hy}roK=}rCe21*0wD%!xQNjqOFk8p+c0XI91#JxCOi~Mr z(VqC+-?LAi+PKZ)@%1grNkZjD5gXi&59wvLXNhn@O4V=QTC)fo^c;2sUPjVnC5%sw(AV9^YTf_|Bl$UDe+6j9Q8h|(LUh|4vH9P3A8yQGdXk%*G;W)5Zw@}Sh{N5y zjYZBT$e>s#`E8zvL3tYgHeb2sHzTZ15Vu`jG|M`Y++xv;BDG!@iz&v&n(&-cj+3Be9Df zwVUNBR0!9C(c3<}uY-ErxxhF`ry@M7(j3C zA46v;i7w&Q7c+8xvY4ljYjN}Xy;Zn2P2^!B_dsgS?oq;*xUd@#N7Xpxo~MPw7i;Qb zrwVb^nMAUJI?92(5Pi5EheyvbF`mNMQ5-v%C~NB2=t%$ z2s2UcQy6!|pLlp3*nX1P6yj=yB@n;kuEzztem{fWZ8<-S_M}$})#G$cW%#PSD`WiQ zqr&IB0;O8@i$@fA7xWv#7aGG=^9c1Ig?et#uC*kh&F+gFzEv4C&yow3XV zRZ%i;jy{{gvS6Q3Y)f`3ieafln{uw;{?ciR@BY}(m?Mq0OoUGFK(;{`_a>hrCj=l! zarxq{OqQl&=ee0UJbPU4J1j22luNh6%$82u=kZa}%{ur&b%Mb@EVn0iYSHQT@w-c9 zlJ4p_&(+E*0~z{?qD#!4-sUz|QHDqKy1lgK7e5btKoRq!-cI-(Cy*YR7)J0}!u>yJ z{cq*d@^)Nuzxz1zsl8z9UY6}pC4wphcjZ%d=I}DDjza@Nn4QXWGmc^!0z02=A+c|) zj?c_IyoaCk=1;RSBVkpPeVGv-!4DDoXMwxrR?|mK;e%%r%!YDb4duI)@X3>zVy6@c z!aIq$L_ufb<;-4ZL&ilf*3FIH2pHXL;a9X%Nq^9d{?HFgmuC&OlV;tW3bpnN$dWE{yR=sE)Hl-`Ssh zxTVN0H3?#-AZD=p4`s49JI4E=o8h*%*1E41BpuY%tJ6P6NUX^OfGCi7C02_$380ikLK~minUPcnn|&1~I~0i%5klmyoJXzcB6GU_;N4|Dv||+_?Fd3sONlA51CZvnUIn;y^s?mw_F+f`0Csy zCEGbuQ<<|hX-e2t-{Wnb(S>z0B53f&Q&GWc%WldcJ8R<>`9>ujHYdBD=)P9{Pa_t} z+Y-vI<28ublx8@op&^*b@W-pt?(KGwS<@)`q$5|g^W{zqEcZh3+3&4gCjt5g&~09K zrBZ$`)eWPLc^#=>+%Cbg-xp(jodq<`Xw*V=*-Ck+X@8|mcFuYP5Ru=h{w{xxr64(U zs!*t}8hzfAm<30oENiHF00^KK#VDs|sbI%=eWS<7q?e3&q2F8N{DW{ha-z0wvgM~H z>uNmuzKO`TFPD~6tCQ$8%DKNh3r&duwmBY^R%L z&LKnnl^zGDsn^L?|M}w0wdh=Uq_v84({yJdJ~rzr4oze@#!9?j{61h*Wr(Cm@;vV_ z;HQPF`0nlJy6+C-2=r*B$sP?{Of6fc1s~5_DTW1<`5}3|zFpb_o0?+> zGx!9nMC<&Cw_db4{2rMXhlB6xyp+S>BC$)tUG6%YJH}eQT%e`c~Pf_Qh&80?|k*u_?Q`U zGq6K4uJ~iH@Eg6xx0ZVG^aaTc#9_Px@=bHgL7DxfEOM7#Y;UuWeoW%u%reA?n$s+a z&~wQ)7%)}(i9JLuhzc;&!Mx8vb8)>ZmI=6WcRVxG5WHL@_>97?vxmfEt`^_hOeLiH zg(g+;mSn|ni}PAk+#mRBhRDNYoAD9O!Ny|IAr5eyl4y??I0vhQMcOFsW0AchKbg8O zovVF>H6NKFV_^+Qsf%Xadks=cXAWnl?)1S=2R!o2K}ow=fqL}NYxL|cqrjmdKuG7B z+(omj1^VCF_)in>L^nogk{u}|Ku(_n7bEzBLcp{w5>~U1@a{C>rC{8wl(_VML=(&- z>F;2C6X;B%BmoB}^_z24_;=fE^JJZ*zDoZEuEB?M^3G3hb;QwRnoYBIF7OO4<>Scy z{P@IQV*YI7?IVmVjxif-VR|Bv=ovEpQbUr)1Z%(KeDQ6YMDU^1@xocfl=pdZ{>8HX zIiUUSPZ5+uh9HnqW8nosR9X8?VgGc*>$q93=>{s6RKZLr5MDGF05r&b>GHuR`HK1k z3?p}>S!qXg87eXY7IOZQA_xIn^?5xv6{>F_JwJ1K>L&>uZS(8KKmD=uDt6)Jw<-^r zSrMz(N=%n!CW(DieHBI7OvgW&Xe$&B2V#VBAHZi=O~2TH0^~`*@N* z0}!cJ8i3+glu$2X|Nn)^+)Z=U8Z=v>WN7cSZTb~b}B51u5tsxwg>?ncWj#Ba2C^j)s^+r zVU^6aEcIPD*`P^P&mDzVL6q4724pxU9KWzT0X+HnD9pSebSJy_TS6lK{;rk2Wl@3) zoX?8+%nhhUuLx>49jM0VB9VOWcA7}rN10}`kLjFzrs~v$y$T%9cBD|Yy+<&DUjh4hBlYWtcURufo=CCmm96Vg z9oqGri-xt#h3rsqYbjXG%mqxfG?nI_{GHR7FGf=GgbE7Ld^&3x4l9R)2Qv+s+4G0K zC+pN4F}|Hqk7`cI+4<`fNWw>WG=F{$T_KLSyNxX&)q2k*fuZlDt2)sJSi|@*>@MN( z;9cu0iz3u?KcAalv6TBf)D{0s=bcMDB}dd`)o+>ZOTC*NLmur3FvjpAH!YN@1wQ27 zbW+Y{xiYie?Z@{W3sOv_ej>;_1hyQd;)_j0hUCEL_kPhVSy=X=yz+Jc=fyPEzHQV2 zq`Ao=ESp|(2gdh(W}A)rnYZ(-6yRe*RD8?^-%VxbX2*QAu2iNLkMx|stOMiD!(fJ>n^5C#Yi-u0!{kiLizk~N)Iw%AeChE3Ig*NgCcKoin+G>$UYW^v!#Xt@ zhz4wz(n*47xioh0V`wY$&wSrp-zdL0@*75YR=JMcG?cK5+It@BII=6@B6cc7Vz}?h_a^?F<}yW#$(5IV%eT)1BkRx22l+K!uh?LPCc+p3)~?<_h8ePx z5^agzpXQdOv49vw@-d0^ol-ux-&?ai-H%2z`*Av-WTGAGGW&e%`qW2)On8s>%5nCI zj!84wWr0KbQ)s}-pS}2O^iAu?YeMf<2CKy!dR)%RS)HEF6{BwQqi(+_s@d>K5?kIg zuI4yF2`FiaFnj3)EW^OSPjmW|`0Nq zV}i8fNp5y0Z}mZix0vnuv6#jAZyWo3J;u#ZcY<&!7A;Iz%|bGbUFe$=LGJ0aq!&eA zbCup3f1;X}gKZ<8g3TIiQr6eS9>Lq;D47|u-Asq=F+=Vc)$iYkD4h#wLXj-_?%#;% zIB1n?IMzmTK9`Rc>EV|}dACCG+96xaxMyxPH2q37u?abLWWp752dj|!fm!-l2!SWZ zdFH%uC|JI}m3QVAKzlUU!lC^Dc&;ssVDBHC^9LzvfXHaDGf&rZeXbF?`J z3}<#-e<-^sKL8dkgf4+R&9bfx3XXS6Z+Ky>xFtgva~GlYk~>c5I6Cgxvft;`RV7B?@^|osWC~=Q{3)}=$ROQ(fzz@Uno^Iw zA|U%MO<14&?e)}|2=(*b2P@h~YIaY=kjIa6Qolb1Y#U;;AhdgpmcE{|sDHrBGH-U_ z8IwN83dKLkbRo^=cU20CYn7H$>bqj_At*8w(F*Fc^}DI&uhzR*ogp0tw?>=m>(Ef! zxWJ@&e{mLr3lgyZFc~Z^%Vu2fo!;lT@6h3fHlk7gRAaKio1R*sh(gG050(L4Fx=>h zmToFr5^YUwvi$t%FPyz$4e8xwcBv^|RG!1aebLuW9m@y7%xFlBhjYUsUGGaI3-^Mx`cP%%je4bL`NA` z`nO`ZGv^k}GPV<6J+^&U9O&71GpqRtkP>wXM%0XJMD-MzBUJ?VE7l=Ti%XL@GGRA8 z%*{*P-og3XlV%6ATp7Q7hpvC+^*r-gb&wh1GB3+m?##$b;>~f2+h88hMTl7H*K2_5 zIQM%gITLGtepTk!w=N-xxUDss1A2I*v~_yG$U|A`HwTKdergqc$#Gtwj7fV`OqaJW z(0h=P)AykZQmse05lDxuy?kx*-P9!t&w#~EZ&i^7L`sCug?Ozuz8!0muf(HqsRwnb z!NRB}Y)fURzc8Rdtppm7#=m8L-^P+Ypt>O6T5NEx+(!x0$z8f>BMDJM4-_;Hny5jA z6NCdNR6JrK**HHAv)ES)rT7{j2#d%awOzfb)cI>`zo-E zCdD|>feilE{b-AS!Hf6nHbn zuA4dP?1P!iNtO@kmMaSvj_j9I=hhF)GKXCkR*%|^u(xl^O0i8TgPcl$I9r+ul35R? zx}d{{^2;-&^%HKbjIE9!8Y`WO*W$^&LqoJ9+KOE;)ahayT`XcrkMm%>p(TsU9qLNl zAdm#rfnLTHW%oYMlI5tQR|N%94fBQJEhCx>{X<+$gi-F6gJ6~*pWOhIQaY2;k_tUU z1$$ugsJ;np_K?+}v8Kx4f`f0vI65amd&4ZzzuCvU+@@-dbnHhojziZXf6Z$ARn5Tw zxNVz%s3CgGA@FO1JSPuwM!)3EHm~yexXFc=Afad9pIj*&NNG#ZBST-a=ynGm3weJa zL*5IYm>2fj!Rq^#w1Yf5{Xn~eFQD6I{a6pDU39wRL3BPGeLOn-cb(R2)RK?P6NE7stEB+qT1&EkCi z)+Hk8ONJ45&`3>>QD!!y%|qYDXK0T%y;xT!m^hYNof7{^X`A%tY|A$a3ih9DM zgqpV94|tT$$vWW|1;cd(?iPjRKIihN%@mYY-K7>TzR;9@+nRkhEbsOfYAvy2@>r2E zf#=ngSVekeT%^~=>;l%mmGpYUd-MPr5Qw#%Y3=JroP zjztH8v4Y&>i)()Sn8DSD6t+-xs_;^!NeC)WCHoR2b4~tPZw=2}pZ;|HM(tT2VXGR+ zO(50-rO5LDUH#@M*xiySZs+CMCHI9|u z?aWjxD&!Ry2{y{t^KOVU&E*73Q+wpv&#$Y%+H9B>`Vk8KL#eEg>ZM{NusW5_N8Jzj z+6nu{Oq<;snehV$?c7oAoNeT?`o(h!RBt2v*^;Xqg$i9RH@S@vgg*;H5E8nHHS{4hoOmc=)#{Z6{{VC48DpxdV ziPlK4%7T0>b7jI4v|bmM6KQopuS8dh8AyU9OOYM^LCL}Yli*DTgJHrbql)euWA*nz zllx-pc(Ckj8Lhp<`}c{8Pu2O!7m(6dtdR_vB-67v8D1I$4$p4x3KHu;L%Uv^Hag4hM>BFpAAK?-h1c^5?MfnQPS5UhyAe? zGjg>D+$A*G#{w>u!!oU2W}kIfL&+Ugl9d+v5c)OeMHnKYFB^xK~`HZ><`L#6*QRE|SJ+Vefv!Qtw zqAKjH)sR+etU2srI)-4Pi`R|*ZJyB}GIfaRUR}1^^l7w?T-VK(+CkE_P@? zF2fTB3%4V*(pDFlVnsGESFlePj=pflT5Nwq??8XA#_OoIW5YGrPY60PJ+$r>a$furX!A}vpIX=SXFIdr@uB`feq2(UZZ|M-RPb%Ky3J3A|14eM|;VqYH zH_P7jX<^EZqS3Pr9p%F!fwNNyn(9OD7m+;Bqealth0NY%C(yZhP!bNr@(|i=$hdq? zcefBhRHpZqD!&~k?;JM@^?gGjGfZ_z$^ARj!?O=Vu?zy5H}U*Hnif@Pf+XV{wO@Xo z^8PXJPE`SGr;3nIC7)H-x!W2&r%OEDo2(?VFx}nB=N9K@6~52wo&O3+8a{ajT&gMC z!U{6YK1s@=it_rxxnw97Osr(ugZEBIwFl3xQ9PjM5XWkH8*hHLb>G637vylwHhgH^ z%M@?ni<@57=wE{$Le=LJT*tpa=F2e&n~#~C-XL9&mtGmO)i_4K7csvQEvy;9(<~ic z>-N)wnct}}!?rkaws#Pk$GubHtE8a$mH#(8tY$>-!ro2Lma*Y7AFZL~fJFIAg4fsZ zvvY-&cv|kF9N#wfeSC8;b#~3v831T%C@wv|Z}}W@5h07xN&u&VdSqix|9#ehjP)P% zEil-uod{I7+}uI7j3_VQF;tO6<@!d{pG5A%mk7J4o@NJX~KcZ$_#}O;i9M{lXJ7}-tiS`fb46Gl({YsZ1t*SqGmiZ z;-02f@XCxGe!s2|Jza15XOb@D7E6k*hna4TCg;vcZ?W*(kd`h`p1eIKcABd7#3jqM zHuxCx&L@=z#WD`kS+doOx!$~}>%?^6*H-S3{zlgeeHDdt&j+P3M*%{cXS??FGif>= zHh4mjBMQ3dIv(0$Q9bCft`l5nGCF@I(XP4x1lXke{w60pryb+zMYyEjc+Oom)^;;? z$NJHCyaX(>BK9b5hov?5X>_Y-p0`(I>qH?r#m+raW|Fft-qW+}U!^9bvW=fTkWD9e z&Mc!>jg-2(i%?Pd1ef%fKU}r;OR&KH0U8xL?h=c7{oAr~pF?j3@n*K>W!Z6KRS25i zebG4a`Z4n`@<#9^$WWC_D<`V-cPYAkBEBMp?zx!dnd38M1|uICu2e68t}(U+y9J^Z-AOQsOLG_>kPlcudtl>^zHjSxCuq+@Xqb4blIFB$7h+q z;^atcM&5-FEFZ1&i|u45fS>*x0vDK3r+k9c%JL1F!#X#tW+~}BV4`H+Y(;xJ927ph zn%qYd9(9hNg~C)h5c(5smxA=S>;$LT^+Rt0OBegb10o#}T0P23Y{lW6v*b2N?_AEA z8=-)0kO1|QCQCa%`XF9{rZDy~#_NsV(vzi{!HQo&VQc<6Vg0dhTN$7=GMcXq!w4p%CnlfVr>QL2=39WFKo~*^EjPbjY zEeh|CM$>)PrNt0;is4%M<=LvTrVgmLZctO|CgH&8EHBLO_qxmbMU+QcgXMx5yL9u~ z?)hmgUG?EeWOy5>cKM}Z+`LS95=-kfM#}{eW(lc>utyH zVk5pDC)^)MmIX+{pc?z{Ci_A_Ues^KIQvZ0!yH8ci;DxBTn};9>lsn0T$aqw=Q%qk zFRrD>WzP`Mfthu3c5|2gyZUbfs}t?XKcea8#k;aH(DDa=cDODf8V))7*BF+1-*vSc z+yvOX+G~e;D2Cl5hu8!E7fAhS3>FEaqSnznRm#LoY%4-zWV6EB((hSboXF++ETC<} zGd+X5%yZ%Ua=s<5(BnN%^G=NE* z9~{^NQBJnch*_AA|@0wq%-`nR!db}B|?@VGDO?a`-q`g~(%}p3nSD}{>!acvS z65L6Odz)Y5T+mfp_9QL*8?62N8ae`dqR%6QQIm{uDqJmb0_rRlT1KUlEkiR8 zHxKCSN7e6_TKAviKR2vFV4nhC&WyI{^@dgs%6=OE5dCs6b<}g|djR>@ujqQ&Vo^x% z_qcbSIFClWEH24e%AnUf%ZRZ)cu9Ku4JjQc4A3-we0S(5H3Do{VLuInRBlmBl4({_ z+H{67DkGwUER_y81P*kJa^xB_>Uk$g>T`7YY$T&5=WgcukM?6P&;`B;indSDHgLM% zfwr}VT)QBQH$1M@@_CtN$f8V7&BL$(AYr<_CBwH6jm0E@#&P`@^1$@&kgB2E2>Y<) zCEq{B-y)r;&y&?Z;Bn>zLmY4Z!5WHI2Bb+4b1_)vr+=6_19 z1_(%ZGFG*uTb+>qhQv02>Bv(EgTG>@aBgDMR+R3{t@$Hh1iV5ywz-04RGwD;Ys+P;#K?x6-1;E?lPv>Ijg^(FGDHF$_>1o$V^Hav>d#}ZM%{`65vMVfQY;0{` zdgxQXWbsLt^2KuBGdPQ@rBlMvpzg7xA{vq~3O`3HAO5O?MZFb}SQgXDBb8Sp-%Uu72-q5zd$1cC z6CiNP@gC#(S6fh6ryW!&F&Ix$Q(iIU+$^s#s-(xCaxnPy1#)OcuRn>tN)?=$*h4O7 z&NXL?zZU!u#l4=wEwytXB>(P!Pg+(z-f(6BG?uA3V3_6E?!bCv1G-CvCU*pBv!}ac z!Fa$CGB{U!g0>L8Xu1`K%5WKFl%SXd*{OspY7I z>3j7N1a;T$-3x=&@2YlA?3#mON$ZyN3NB<+vFMXSCwWQVCEV3%50vjpz2S{0p?}>! zbo6+)J*@17!7!eq28*gb_G_W__bNTBGQO~I+i#15auQ%)9gq?538HY}*%Rq23UL92 zuZzeRpwWGaWM3YKF1T4Cm3sGydG}$k;K2h^>HA*7g#n3A{1^j%J{T*mtCxyva0Rj3 zL*unv-p!ScI4*V0DglvF7yg$lEBpa_qUn&EG`}}s`UCE8x1g1v2%|ydFQL&kW>e6feMxqOCl;3yR`_^~JKvbhe$!f;ew)-A4z_AtAJ?6N;Im zCc?q96`4nrE}qwVh&yLD`eAjbFGfnq1b^Z2y8}tZ`5I-K-1L7~)F%Kto&a>n3BwYY z(H}!TfWXU*AHosTn}Ca!^Sd0^uGqMPnGlkfaRA1ZYL3?KSdr?pI5ksbzMUj5S^CP2 z;BqI81Q8{;tGiF?Y7deo&Q}bRkjLxH$1=9^P}Mh(nWvdcXQb5TRHiSf{j)A6b1CHZ z(zQf9ew50C=8kljR(?L91|3k-3#bwJ|3gjrgv#oyt4J?gkHqNKd63rd&QCC2ViW~# zhqtg71X?h9-H-%W3OE5*T=Q<}@|^4gorcTC;&`PE2`+~zFL53E!6;qQ{-I1eh}%>Q zPX$fHrGL5S0nBybX;7q8uTf-09>4&?rX|ujRJU({Ts{E%Ey@a;IRt9oW9Q%dR(RJGM3h=GPWD~1M6s=(U_w0Uv$nan0HQYQ$LwlZ}tm(a@zrr6>yAcd~~IC zk5wAiwk5|(sa^)fY-*p>gM=sTnUap)mkin2QIh=xP7AUpvAs$auS~!z3~2E7gbXLL zOiOm!%!!!+Hevdpl`pXqdT$xDy*>cC1h8*^g1j|G8u2d&I?ERipug{Y_VXRvfQ?dJ zJhnk19_x1dJk4*9_@X1zcAx?>0IwF~k_V&sw;mTGz{Lb>LB)Svsv&}o%cqv%co?Xk z0frU%)|gsyqb>jl4b0BI(nX%XbdiNI)<{KWcN|xmHn&(7MsNMFG9Nf%=D&hur3i{J z%EpqIIa*W&t_@t}{T`#pabfIWu=-=f2Erg{DT6zpA^6lJWHzmz@L28(!G{!1MVZ3*DIKgi0j{uv3KeaM=OpkLA1WU$cLU|7-FpgDN|$lywH zcRuI&Rt_s@w4$$QRj3MbXEV6$uZ@G(TRG0d>HCh@YoPIsb_|bofeSCTG%!-BnmE#_2N4OdSd}B>&>jZwoBd z;vj<`{NMK|`hC@J2w!dAj2M=yggxDto^fR^AtA@H5L5V8-5T1DD<3N`pTC7;Y19V1@Vh?MGw)T->1l{pK3vGU=hCj>Fd+Ao7zuXzl6LkyanWZmu|KE?z0rYSeai9Bd z)~+b^6UB@Za+hI3UC3;45(m*JOpgnv2NIY6IN5Ki;e$3;|3{VYEc(}xd!_F-?+w=P zRb9wUS(i4khDvoU_MT8ZhAK^e35*)rxcfnu4*cXl?0_&|?K`#v`)Ee~s4!r%3Gaa4 zva?r%3vNxTRkz7J;gc}9j4k!|6Ck+_$TZGOuvM@>XWF+rOa45>Z&221rpxGtB~P_Q z8vE~)|G%^J5OY<}`-Qr&eSg>zI&RLA7f-d82dBf3uQe!>{j0dt&!C!Y2&#dJyI+WA zGb$@3WJyj?B2b}@?~na|ezx5o%07=whyU|c@Q?taw=U(~cG(wF-)9oVqBd9+-G7Gk zL=6Tt3H*okXV}%Mcch!A`t!!{KHSLotc}QC3}&WrX=rx*6G`_kH7B@tVg@xnJpIpC zL6VU!vY+lE*}T^8KWx;LtPqh#*oT+P^6}rV0qc9~SD4u#buMrT`yD!av({L_4zKe4 zBgQ(m2BMq{q67*T)tKHZj>20)4cs*?`Cx0xGgVZ-H9#m ziRWLxK@s_%gG|NYBU{Zl2EU&)^vOe_DYnDhu8Hp%k>#98C_3BRsqg;<=E$FuUfE|_-2#}KVq9?hG^#)6b@?2J$Gh(m%{0-A%9P^qJyHbh_}l| zyj7qmCjXDgV$+lYDQJ;%tHEmLek5pD;sMvVt+uQrlSg>DQT)`VMCEf1xbDBoBvF zs`@brNKcwhNw2o)+|9ZBI_UAgnqW`#c6dy3*$yewUWCjYI|NycEXzbq>BPcyEaP_j z9LJDU1gDL#HzRXlBDjCl_q}Nu zjl#I3GVhG`;PBJmlVDttRMG$6@B$i_#9Os9gSrUSXC&wO@0GmwFw^Ho?I#Bf7~Uz?k_9yT5>9(m=S$KT4m&-E=dhF~6Q zWIwGd-%n`X~cD@?6YVonH=eY)Mb~4dBH{2`O_!r>= z8Yvr}`ZMQ~8l<0!GI&i54IT`FWtOQ6PSdvgYg9)6T89BCh>x7X?37|qq4!^P1O8E6 zO>#;>UuyY1RmPjS(E0q_RS!OD!R-?)8n3)W^qn6Q_IbJE6(%3^wfN^$)4{Ky{7-0& z*aUyHD;1+&yS`pDds8X7lMzB|Q)WZ!wYxF=E_~`UHB={S6+_jc^-M#9 zzn^fWej<+O^4uTY+wFuUvvHMIG`H&GjJ&>mZr`wSEXx)qmeF=^p?KTn&z(_A^ly+Lods0gM6I>|`8SjR@%V*dPFn_q7m7DXDvU^Xo(>T_93#v5 zwVJ&wGlLg;+p#0steaigk13p{lcYSYULh*Op73ZvO!3LTp|uUiRc%W$G)}iD`(5mw zYJQmQzAcr?Bk}g$ukfK(67n*-Be!$)e08a$>XHoG@{bw0B19WALY0o^%Ip6krr^6k zFC{uZ{(ky@=mT3x>Ss1z%e{7`#^tnkalO!(q-afGuQ`?0nKWs0t7WZ^-?SKWew?Aa z_wQkk;+Xq&e1$I!7Q9y|r;gZ^-q$OUCC_6z=UU#6l25AsX6-t5xxXo~r)Q6H8a(?M zZ)MsaU;ZTnt^xMQrQo>IAO#_)kfQxZfBe4Dix_lu)MX`H-R1I+J29wk{4sRtgzHu)I}#KX5`&-x_Fy&vH!@2`WFc`N2`J;RGRwNi9!t>fEi`j z1w{qF)XBDN+|HCXH|Zgsm_P1s$;k3H``2tW=@n1UkeOahhfLU+uM?c|UVfi-!b+F4 zIUBG-(0ZkrzlZ-vUvDx3hQnSG{pVGXJ&{T_uDz2|7{S%|m3BE+{;4Opx}>PE71++D z7%95D-nwA2aLkUcZJP7J2I<3=mUJS=^q|VrjT%psO)SQZIL+zVoD6~_riVv<3o# z$*&zK0>aDPW>Z#^^(M|8mE2A+XD=?s-SGt}-Dgku&U#f(&iYdec<-P2qF2)%= zR+$l;VO`0KHGE_|iX(2%d17x}4qO;;{F9a=oK_EuBC6>rcZyr6c?+%0JorC0YFnKW+*J*gfz>nel|ER8MRi};f(&&m$Ia=#L&K>Or=+P|9s_K0Yu_aOW| z&ns}ofNg%ARQzz`rf>w6UlZC-aCoynml{)(Gu&1&2G%pvPZy5om!=1x^e5eC6TopyFl#aztYsfaN0o2e2k~)%%dUJmxm~Gqf5DcVx z-9umde>Q2R6Y5M4QwKOqJd8NI3Q@RD$xyGUG({r=_N&{SHL5u|^q6%lS;-6cI)JlF zg0bXlIZID^Nxsybwd0}tC`#Y3rtP~(@9w#%Ccsrr%58GKRlMC2KbXyn{al+VR4Q2P zT-#2>jHk&*^NVgoJYaJd3fL-&@-&Ne0(rw)WG=J6RqGp~MO#>TML{Ml%}Y8`D0v{p z{7UxpvB87cCv`arvJaT`MsX-xSvSsl82vhK;*`@XWK|yYD&q>*(GZ3CtnCpjS-J4bncOLuxL!gUhl8T`4#E~#*a9FJkg90Vo>3yY{gxMH0`Ro_KJ-c0l zI~o0G`*J{jdgA4cF6X8eu2>GXTR~oHBaTH+R%7(=yGyJu(9W9$P1*jIus`?=XUlnW z3N>t;#nG~^PIA&o2a zcf--ciw8}q@0Z;rsMb+ph;AOd;z#}3L-3<9C3%fYzO64oz>(sBH($>x|7qw>Bo+|0 zBdEUHK*(S9=KxPsRZmW8S3+M=7`&b+Wo~>;5aeH-4S-B6I_EWkq72oNJZwuj3WA!{ z^QI-;on|bJ7DdFWxVN@&!!Co3uP&Jjf9FJP6ubzS)elvaK!>tg>FQ%!E$g_0|S1num!*IzjE2Ul!-eK|wDhP{2A zXb`2C*8%fOnsQuWyUW*NvR$4>szxmlN83nH0grYSNYrG1NoCE#*%CQ^(S0^N&V}YM z^H=P~TbEouLN?7Zg!Iw!qHT}V^%j#S>-*jc5BXCunSv=K!-_qHu~#0&3qFNdE}av+ zQ`lhiVFIm}!(ntQ=zWnCx?l;;MYL0Iy5HJ=|J>NglZ$x#`YEx(N8y^7MgZbR znTj~kT7)YR-KE?LVb++;YP=ShkErX})e0^j$+8QP5`%jyUz#MJDXxTMXA?RQaF|!a zqmOm2#GBos*ex;79l)D)aT&KaUu02-I`{1T!sncj3JeCXLFpCpEnBQ_z>XD#9cOvC z3HHdODYf;3Q*(EgOW+Zb5`I+|8UvgaW0ggGeCA>}EGG84w)b~h%D{3XplKq(Oi^b+ zbGe}EWESUwz^~jT+uiE}LP;f;%JEB-75?d=3AM+I5q-$&5&nRGXun8#W0TS&o8e>S7gp}2#X6HwnkOp`bn$2oOA>-Qi z>Mt?wg#7RG%i^?w8jr1e3-3uLsqcUD30)3 z?h-3hH30Vba-C|QZ_hNlw4}h*v)}6Br+HYHft2p<)2gl%;yo)BaJbkQ#zMg!7Q+$K z-rs|PQdUpO+LmZN)&lbVSk9*ojKRc+!Zj^QXW8ES*c z#AAWI3jZ3Gvq3-ZGLoD4ygORp-Cqdys~x@ir(Ia!mbifJ(?v+AQhgU)Xr_BiVY>u9 zEHl;DO1|84*^ol=gO8pkZkz8D?OS|;@gcb}ipx6o`l(BFCA93t8;M_U$c`kBOa)&M z*V!%E$y|=aeCdYmQXOj}*@V|ZzzRvRCv?~e51xTyr7w!uV!PtDLDK3;iVx~}TkhY+ z`cSfk6LP2gqJdKAHK~E%%DUlku(5H%MaSC;vy=!Z!OQRpN?H#CBe}VJsTK0tsr%G! zK+kX6t+VfDLemZk_@5o$X+yxc1YiGx93w3R_F?kpn-)lgd60s`xla@+}^9k8gVpZ!m zi+lSjQ26c1I0J@yV#$_?Vm>3BFHoeL^mpr03T@--Y{=e}Q2jBZFl`k{S#MFaycGJW z2LIs?PgIcWwuqb@Y4>VJ1AWN07YJ)&m2hlR4u+XXtEN}rzhH#9-ed&L%EI}l)2u>$ z4kr;PxXffBQIO~J8$c_I-Q3m1m1l4Aqc!;;Cfa1u6)xz7I`rZ+p454al`6?y>NLrm zu`aE4u9VCPOh$1ObOut@#>G#h2iw*es$?E<9c(AIHBg&Qn@-n&oiIMFL6d z1<;9f=hntW_AJle#HW5dds`{GQ&gTduOc&x<|N@P{CF z812_18F|m$#Xr=OpyE_LrSv!i}OpT7im++hC*=ZS{4^j=4AZSk)}*-g{!8Med@?-dB#dySdG( zS)P68!0Uf}W=6_Z#$^fhem6d?s#j5Nxj^^o77z$1quxap9$w>?J@bQNvK_F2pIOPT z29t&+ENUU-S_yh}B>ePa#WI~yQ0__HDIM(lQ#?#$pM-JqWW&4b4(hb%Vd+c>+sN0z zxZKrdg~%_DE#3wP*L?Amk7;{q#w;*Mc#_`jr*SvsRLiX=$g-IBT`iu!8Bu3O!Wx4AHK!Yt@*Z|%PQ=?q7T0XUa;IZnM+rBQ8MPeHzE zly!a9yBK}FkWb0A@&czTZXHaeMJBa-YY0-FU-?bNy}S-B0@Z4@Nt7D1SSZCttQ>Zp zF)YN!)<+s(d&V-&JJV~$Gh#IzH`9))2GTMA8n&DXl`-J794~f{h2jT)9BLG3+N6#?Zpfzx7&O85AYiCWHAZtep4AqN+&ooIOnl~G=YVU~wNJzWiR7E4ns zRq<9JWx~h|-VY8;^-_c3Z zZTD^m<5h2R+?cR(qpi>*5*`znYPj2kQd}Xn0skzyg+CDW1xId-nmyqhm!V7(e|b#~bYjT5!3rYB0{3>gI-6xDJ+ z<|y7F(oVvIIht9l2mqK#Y=61a-V{ZA5FPwRSK(uP$lfYzNi!F-X#@~yVo`2BaGW5t zjaJ=eroiQJ3AZ`g0DTZzK=V(#f3`C0@5FBf(BF*yD64<3E-P!_7Bl&qZF~>sQSCqj zRP*?gms$Vtc!wVp?CZw^tX2hQBcq#ti+}%gH_)_s0KgDI4jwPL|JOBa`2tl5$XZsc zQ0w23>l6eO_~leeQTV!k`=v?(hGu c{sZgVmFe4xbujx>wgE4F9V6{hO{eJp0 Date: Wed, 27 Nov 2024 19:25:13 +0530 Subject: [PATCH 2/8] no need for vercel preview custom workflow --- .github/workflows/preview.yml | 25 ------------------------- 1 file changed, 25 deletions(-) delete mode 100644 .github/workflows/preview.yml diff --git a/.github/workflows/preview.yml b/.github/workflows/preview.yml deleted file mode 100644 index 573b9a0..0000000 --- a/.github/workflows/preview.yml +++ /dev/null @@ -1,25 +0,0 @@ -name: Preview Environment - -env: - VERCEL_ACCESS_TOKEN: ${{ secrets.VERCEL_PREVIEW_ACCESS_TOKEN }} - VERCEL_PROJECT_ID: prj_gXKEVY0vt6eS7uIN8IMduRblu4JM - -on: - pull_request: - types: [opened, synchronize, closed] - branches: - - main - -jobs: - deploy: - if: ${{ github.event.action == 'opened' || github.event.action == 'synchronize' }} - runs-on: ubuntu-latest - steps: - - uses: snaplet/vercel-action@v3 - delete: - if: ${{ github.event.action == 'closed' }} - runs-on: ubuntu-latest - steps: - - uses: snaplet/vercel-action@v3 - with: - delete: true From 79bb6ab400f9fa974c3213d85daf5fd4d41329b4 Mon Sep 17 00:00:00 2001 From: AlexCulda Date: Wed, 4 Dec 2024 13:00:00 +0200 Subject: [PATCH 3/8] Enhancements across the board. File Structure Reorganization. Made improvements based on Erik's indications & my reasoning. Reorganized the files & renamed most of them. --- pages/penetration-testing/_meta.ts | 15 ++--- .../classification/_meta.ts | 5 ++ .../classification/access-level.mdx | 29 +++++++++ .../classification/attack-vector.mdx | 8 +++ .../pci-dss.mdx} | 45 +------------- pages/penetration-testing/documents.mdx | 9 +++ pages/penetration-testing/faq.mdx | 12 ++-- .../{test-report.mdx => final-report.mdx} | 26 ++++---- .../findings-decisions.mdx | 40 ++++++++++++ pages/penetration-testing/offerings.mdx | 33 ++++++++++ .../penetration-testing/process-overview.mdx | 2 +- pages/penetration-testing/ptaas.mdx | 4 +- .../penetration-testing/reports-documents.mdx | 9 --- pages/penetration-testing/types.mdx | 61 ------------------- 14 files changed, 156 insertions(+), 142 deletions(-) create mode 100644 pages/penetration-testing/classification/_meta.ts create mode 100644 pages/penetration-testing/classification/access-level.mdx create mode 100644 pages/penetration-testing/classification/attack-vector.mdx rename pages/penetration-testing/{analyze-remediate-retesting-accept.mdx => classification/pci-dss.mdx} (57%) create mode 100644 pages/penetration-testing/documents.mdx rename pages/penetration-testing/{test-report.mdx => final-report.mdx} (63%) create mode 100644 pages/penetration-testing/findings-decisions.mdx create mode 100644 pages/penetration-testing/offerings.mdx delete mode 100644 pages/penetration-testing/reports-documents.mdx delete mode 100644 pages/penetration-testing/types.mdx diff --git a/pages/penetration-testing/_meta.ts b/pages/penetration-testing/_meta.ts index c1d65ad..3e9abb6 100644 --- a/pages/penetration-testing/_meta.ts +++ b/pages/penetration-testing/_meta.ts @@ -1,9 +1,10 @@ export default { - ptaas: "Penetration Testing as a Service (PtaaS) at Oneleet", - types: "Penetration Testing Types", - "reports-documents": "Penetration Test Reports / Documents", - "process-overview": "High-level overview of the Process", - "test-report": "The Penetration Test Report", - "analyze-remediate-retesting-accept": "Analyze, Remediate, Retesting and Accept the Risk", - "faq": "Frequently Asked Questions", + ptaas: "Penetration Testing as a Service (PtaaS)", + "process-overview": "Process Overview", + "classification": "Classification", + "documents": "Documents", + "final-report": "Final Report", + "offerings": "Offerings", + "findings-decisions": "Decisions on Findings", + "faq": "Frequently Asked Questions" }; diff --git a/pages/penetration-testing/classification/_meta.ts b/pages/penetration-testing/classification/_meta.ts new file mode 100644 index 0000000..56e4786 --- /dev/null +++ b/pages/penetration-testing/classification/_meta.ts @@ -0,0 +1,5 @@ +export default { + "access-level": "Access Level", + "attack-vector": "Attack Vector", + "pci-dss": "PCI DSS", + } \ No newline at end of file diff --git a/pages/penetration-testing/classification/access-level.mdx b/pages/penetration-testing/classification/access-level.mdx new file mode 100644 index 0000000..54afc2c --- /dev/null +++ b/pages/penetration-testing/classification/access-level.mdx @@ -0,0 +1,29 @@ +import { Callout } from "nextra/components"; + +# Classification based on Access Level + +At Oneleet, we tailor our approach to meet each client’s needs. +We recognize that businesses vary in size, goals, and requirements, so we develop customized strategies for success. + +Generally, there are three types of penetration testing scenarios. Let’s break it down: + +## White Box Penetration Testing + +The tester possesses complete knowledge of the system’s source code, architecture, and network details. +This scenario resembles an attacker with in-depth understanding of the system’s inner workings. +Such an attacker could be a disgruntled employee, a contractor, or someone who has gained unauthorized access to sensitive internal information. + +## Gray Box Penetration Testing + +The tester may have limited access to internal documentation or user credentials, which could be exploited by an attacker with some inside information or limited access to the system. + + + This is the type of penetration testing we most often recommend to our + clients, as it provides a balanced approach in terms breadth, and depth. + However, depending on the company's nature, product, and likely attack + vectors, other types of penetration testing might be more relevant. + + +## Black Box Penetration Testing + +The tester, lacking prior knowledge of the system, adopts an external hacker’s perspective. The simulated attacker embodies a hacker attempting to breach the system from the outside. They employ techniques such as reconnaissance, social engineering, and vulnerability scanning to identify potential weaknesses. \ No newline at end of file diff --git a/pages/penetration-testing/classification/attack-vector.mdx b/pages/penetration-testing/classification/attack-vector.mdx new file mode 100644 index 0000000..e91fbbd --- /dev/null +++ b/pages/penetration-testing/classification/attack-vector.mdx @@ -0,0 +1,8 @@ +# Classification based on Attack Vector + +Sometimes, there’s also a distinction made between internal and external penetration testing. +If the previous Black/Grey/White categorizes tests by what the tester knows/can access, the Internal/External one categorizes tests by where the testing originates. + +**External Penetration Testing** simulates an attack originating from outside the organization, specifically targeting internet-facing assets such as web applications, firewalls, and public servers. The primary objective is to uncover vulnerabilities that an external attacker could potentially exploit. Common targets include websites, virtual private networks (VPNs), and cloud resources. These tests encompass a range of scenarios, including misconfigurations, compromised passwords, and outdated software. + +**Internal Penetration Testing** simulates an attacker who has already gained access to the internal network. It focuses on internal security controls, access permissions, and lateral movement capabilities, targeting internal systems, applications, and sensitive data. diff --git a/pages/penetration-testing/analyze-remediate-retesting-accept.mdx b/pages/penetration-testing/classification/pci-dss.mdx similarity index 57% rename from pages/penetration-testing/analyze-remediate-retesting-accept.mdx rename to pages/penetration-testing/classification/pci-dss.mdx index 85e75f7..c10adac 100644 --- a/pages/penetration-testing/analyze-remediate-retesting-accept.mdx +++ b/pages/penetration-testing/classification/pci-dss.mdx @@ -1,44 +1,3 @@ -# Analyze, Remediate, Retesting and Accept the Risk - -After receiving the penetration test report, there are several steps you can take, such as remediation, accepting the risk, or rejecting the findings. - -Here’s a brief overview of actions you can take once the penetration test report is ready. - -## Analyze - -When deciding to address a vulnerability, the first and most crucial step is to allocate sufficient time to analyze and interpret the report. Your employees responsible for the penetration test should consider the following questions: - -- Does this vulnerability meet the risk threshold we have agreed upon internally? -- What is the actual (business) impact of a possible vulnerability exploitation, considering factors that may not be known to the penetration tester? -- Who will be responsible for remediating each finding? - -## Remediate - -Before taking any further actions, it’s crucial to verify that the vulnerability is reproducible. This not only enhances your understanding of the issue but also helps identify the systems at risk and different intrusion techniques. - -To initiate the remediation phase, it’s essential to comprehend the scope of what needs to be fixed. While technical fixes may be necessary, there could also be underlying causes, such as: - -- Management practices that require improvements; -- Alternative approaches; -- Ineffective or overly permissive security policies; -- Communication issues within or between departments. - -Nevertheless, in most cases, a technical fix must be implemented. We advise remediating the findings as soon as possible, as the chances of the penetration tester still being intimately familiar with the vulnerability are higher, and the probability of an exploitation is lower. - -## Retest - -At Oneleet, we are committed to safeguarding your company. We provide free retesting for a year after the penetration test is delivered, giving you ample time to address vulnerabilities and improve your company’s security posture. However, it’s crucial to adhere to your internal policy regarding vulnerability remediation, particularly in light of compliance requirements such as SOC 2, PCI, or ISO 27001. - -## Accepting the risk - -Marking vulnerabilities as `Accepted Risk` on our platform is entirely at your discretion. We recognize that each client may have a higher or lower internal risk threshold for remediation, and we respect your decision if the analyzed impact is deemed too low to warrant action. - -However, we advise against accepting vulnerabilities with a `Medium` or higher risk. As these vulnerabilities pose a growing business risk, they are not a matter of if but when they will impact your organization. Therefore, ensure that you allocate sufficient time and effort to remediate these risks effectively. - -Our recommendation is to always provide a clear reason for accepting a risk. This rationale will be included in the penetration test report, allowing you to offer additional context to internal and external stakeholders regarding the acceptability of the risk. - ---- - # PCI DSS Penetration Test If you hired Oneleet for a PCI-DSS penetration test, there will be a few minor differences compared to our regular penetration testing process. The primary objectives of the PCI-DSS penetration test are to: @@ -82,10 +41,10 @@ According to **PCI DSS Requirements 11.3.1 and 11.3.2**, penetration testing is The definition of a **“significant change”** fluctuates based on an **organization’s risk assessment** process and the specific configuration of its environment. Since PCI DSS doesn’t provide a rigid definition of a significant change, it’s up to each entity to assess whether a change could potentially compromise network security or expose cardholder data. If a modification could potentially affect security or access to cardholder data, it’s generally regarded as significant and should prompt a penetration test. -### Example of a Significant Change: +### Example of a Significant Change **Migration to a New Firewall System**: Upgrading or replacing the firewall safeguarding the CDE is a substantial change because it directly affects network security. This transition could introduce novel configurations, alter network paths, and influence data flow, potentially compromising cardholder data. Given the critical role firewalls play in security, a penetration test is essential to validate that security controls are functioning as intended. -### Example of a Non Significant Change: +### Example of a Non Significant Change **Patch for a Non-CDE System**: Applying a minor software patch to a system outside the CDE that doesn’t interact with or impact cardholder data would be considered a non-significant change. This maintenance doesn’t alter security controls in the CDE or affect access to sensitive data, so a penetration test under PCI DSS is not necessary. diff --git a/pages/penetration-testing/documents.mdx b/pages/penetration-testing/documents.mdx new file mode 100644 index 0000000..2f2e566 --- /dev/null +++ b/pages/penetration-testing/documents.mdx @@ -0,0 +1,9 @@ +# Penetration Test Documents + +At Oneleet, we offer several types of documents during the penetration testing process. + +| Name | Description | Target +|-----|-----|----- +| **Full Report** | Generated at the conclusion of the engagement. This report presents all the findings, accompanied by a **Description**, **Business impact**, **Reproduction steps**, and **Remediation steps** section. It includes an executive summary that highlights positive findings and recommendations. The results section provides a high-level overview, a table listing vulnerabilities, and an overview of the scope of the engagement. After remediation, the report will be updated to reflect the current state of each identified finding. | Internal Usage or

External Stakeholders +| **Letter of Attestation** | Verifies the successful completion of a penetration test, offering a succinct summary of the scope, methodologies employed, and the tester's proficiency. Offers a comprehensive evaluation of the application's security, identifying the number of vulnerabilities discovered. | External Stakeholders +| **Letter of Engagement** | Notifies that you are undergoing a penetration test. Offers a comprehensive overview of the test's objectives, scope, methodologies, and the dates of the assessment. Assures you that any vulnerabilities discovered will be promptly reported for remediation. | External Stakeholders | diff --git a/pages/penetration-testing/faq.mdx b/pages/penetration-testing/faq.mdx index 6ee6c34..53ccafb 100644 --- a/pages/penetration-testing/faq.mdx +++ b/pages/penetration-testing/faq.mdx @@ -4,15 +4,15 @@ No. At Oneleet, we recognize that such attacks increase the probability of operational disruptions or the risk of collateral damage. We firmly believe that there is no genuine advantage to conducting such tests when doing a penetration test. -### Is the source code assessed? Between a Black, Gray or White-box Penetration Test, what should I choose? +### Between a Black, Gray or White-box Penetration Test, what should I pick? -Opt for a **White-box Pentration Test** if you are prepared to provide the source code and configuration files to the penetration tester, or if the application is open-source, as it effectively simulates threats that have or had access to the source code. Select a **Gray-box Penetration Test** for a best-of-both-worlds approach, as it allows the penetration tester to uncover most vulnerabilities accessible to bot an out- and insider. Choose a **Black-box Penetration Test** if you are main concern is about external threat actors. +Opt for a **White-box Pentration Test** if you are prepared to provide the source code and configuration files to the penetration tester, or if the application is open-source, as it effectively simulates threats that have or had access to the source code. Select a **Gray-box Penetration Test** for a best-of-both-worlds approach, as it allows the penetration tester to uncover most vulnerabilities accessible to both an out- and insider. Choose a **Black-box Penetration Test** if you are main concern is about external threat actors. ### Do I need to set up a staging environment, and where do you test? We usually conduct tests in the staging environment and advise against testing in the production environment to minimize the risk of operational disruptions or collateral damage. Having said that, testing in staging is discouraged if it doesn’t accurately reflect the production environment or lacks representative data, as this will provide less value from a security perspective. -### Can we implement significant system changes during the penetration test? +### Can major system changes be made during the penetration test? We advise against implementing significant system changes during the penetration test. While pushing small changes is acceptable, we recommend maintaining a stable environment throughout the engagement to ensure the accuracy and reliability of the testing process. @@ -26,12 +26,12 @@ Technical background, certifications, communication skills. Evaluate a penetrati ### What are the lead times for a penetration test? -The average time from contract signing to the start of the penetration test is a few days if you are rush, extending up to 1 week during busier periods. +The time from when we sign the contract to the start of the penetration test is usually a few days if there’s a rush, but it can be up to a week during peak times. -### What happens if no vulnerabilities were discovered during the engagement? +### What are the consequences of 0 discovered vulnerabilities? Although such engagements are highly unlikely, the outcome depends on the engagement scope and business size. For a startup with over 10 employees and a Gray-box penetration test, vulnerabilities are typically found, especially if it’s the first test. If the scope is limited or the application security is strong, there can be no vulnerabilities, but the tester should explain their methods, failures, and challenges. ### Do I share the penetration test report with customers? -You may share the penetration test report if you choose, but we provide a document designed specifically for this purpose. At Oneleet, we offer a Letter of Attestation, which provides a high-level overview of the penetration test, including the tester’s profile and the overall risk score or number of findings. We recommend the Letter of Attestation to be shared with stakeholders. +You may share the penetration test report if you will, but we provide a document designed specifically for this purpose. At Oneleet, we offer a Letter of Attestation, which provides a high-level overview of the penetration test, including the tester’s profile and the overall risk score or number of findings. We recommend the Letter of Attestation to be shared with stakeholders. diff --git a/pages/penetration-testing/test-report.mdx b/pages/penetration-testing/final-report.mdx similarity index 63% rename from pages/penetration-testing/test-report.mdx rename to pages/penetration-testing/final-report.mdx index 149ccfc..2ee1798 100644 --- a/pages/penetration-testing/test-report.mdx +++ b/pages/penetration-testing/final-report.mdx @@ -1,6 +1,6 @@ import { Callout } from "nextra/components"; -# The Penetration Test Report +# Penetration Test Final Report First of all, the report includes the findings from the penetration test. Among other data, key points of our penetration test report include: @@ -10,33 +10,33 @@ First of all, the report includes the findings from the penetration test. Among - **Steps to Reproduce:** Detailed instructions for engineers on how to replicate the vulnerability, including the use of publicly available tools whenever feasible. - **Recommendations:** Specific guidance on how to address the vulnerability, varying in detail depending on the type of finding. These recommendations can range from granular to high-level. -Before comprehending the remediation process for the vulnerabilities discovered during the penetration test, it's crucial to grasp concepts like Finding States, Characteristics, or Overall Risk. +Before comprehending the remediation process for the vulnerabilities discovered during the penetration test, it's crucial to grasp concepts like **Finding States**, **Characteristics**, or **Overall Risk**. ## Finding States | Finding State | Description | | ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| Open | - The initial state of every vulnerability once it becomes visible to you.`
`- While it's open, you can transition to one of the other states. | -| Ready for Review | - You mitigated the vulnerability that was ready for retesting.`
`- If the penetration tester couldn't reproduce the steps that led to the initial vulnerability, the finding is marked as resolved.`
`- However, if the penetration tester managed to reproduce the steps or discovered a similar way to find the vulnerability, the finding is marked as open. | -| Risk Accepted | - You are prepared to accept the risk that comes with the vulnerability. | -| Rejected/Closed | - If you deem it appropriate for any reason, the finding will be closed, and further discussions will be held. | +| **Open** | The initial state of every vulnerability once it becomes visible to you. While it's open, you can transition to one of the other states. | +| **Ready for Review** | You mitigated the vulnerability that was ready for retesting. If the penetration tester couldn't reproduce the steps that led to the initial vulnerability, the finding is marked as resolved. However, if the penetration tester managed to reproduce the steps or discovered a similar way to find the vulnerability, the finding is marked as open. | +| **Risk Accepted** | You are prepared to accept the risk that comes with the vulnerability. | +| **Rejected/Closed** | If you deem it appropriate for any reason, the finding will be closed, and further discussions will be held. | ## Finding Characteristics | Characteristic | Description | | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -| Probability | - The probability of the vulnerability being exploited.`
`- Three levels of probability: Low, Medium, or High, based on:`
` - Ease of vulnerability exploitation;`
` - Attack vectors;`
` - Business criticality of the affected asset;`
` - System and network complexity. | -| Impact | - The severity of the vulnerability's effect.`
`- The impact of a vulnerability can range from little to no damage to system compromise.`
`- The impact can be at 3 levels - Low, Medium or High. | +| **Probability** | The probability of the vulnerability being exploited. Three levels of probability: Low, Medium, or High, based on: Ease of vulnerability exploitation; Attack vectors; Business criticality of the affected asset; System and network complexity. | +| **Impact** | The severity of the vulnerability's effect. The impact of a vulnerability can range from little to no damage to system compromise. The impact can be at 3 levels Low, Medium or High. | ## Risk Levels | Risk Level | Description | | ------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| Informational | The discovery doesn't directly impact security. However, it could present an opportunity to enhance security, deviate from best practices, or make a security-relevant observation that may lead to exploitable vulnerabilities in the future. For instance, it could involve missing HTTP security headers or documentation that encourages poor security practices. | -| Low | Low-risk vulnerabilities are more of a nuisance than a genuine threat. These vulnerabilities are usually those where exploitation wouldn't cause substantial damage, or where the likelihood of exploitation is very low. | -| Medium | Medium-risk vulnerabilities are those that could potentially lead to damage if exploited, or where the likelihood of exploitation is moderate. | -| High | High-risk vulnerabilities are those that pose a significant risk of causing substantial damage if exploited, or where the likelihood of exploitation is high. | -| Critical | Critical risk vulnerabilities are vulnerabilities that have a high potential for exploitation and could lead to data loss or total system compromise. | +| **Informational** | The discovery doesn't directly impact security. However, it could present an opportunity to enhance security, deviate from best practices, or make a security-relevant observation that may lead to exploitable vulnerabilities in the future. For instance, it could involve missing HTTP security headers or documentation that encourages poor security practices. | +| **Low** | Low-risk vulnerabilities are more of a nuisance than a genuine threat. These vulnerabilities are usually those where exploitation wouldn't cause substantial damage, or where the likelihood of exploitation is very low. | +| **Medium** | Medium-risk vulnerabilities are those that could potentially lead to damage if exploited, or where the likelihood of exploitation is moderate. | +| **High** | High-risk vulnerabilities are those that pose a significant risk of causing substantial damage if exploited, or where the likelihood of exploitation is high. | +| **Critical** | Critical risk vulnerabilities are vulnerabilities that have a high potential for exploitation and could lead to data loss or total system compromise. | > **Note:** Once all remediation efforts have been completed or risks have been deemed acceptable for certain findings, a second report will be generated to reflect the updated status of each individual finding. diff --git a/pages/penetration-testing/findings-decisions.mdx b/pages/penetration-testing/findings-decisions.mdx new file mode 100644 index 0000000..4781fd2 --- /dev/null +++ b/pages/penetration-testing/findings-decisions.mdx @@ -0,0 +1,40 @@ +# Decisions on Findings + +After receiving the penetration test report, there are several steps you can take, such as remediation, accepting the risk, or rejecting the findings. + +Here’s a brief overview of actions you can take once the penetration test report is ready. + +## Analyze + +When deciding to address a vulnerability, the first and most crucial step is to allocate sufficient time to analyze and interpret the report. Your employees responsible for the penetration test should consider the following questions: + +- Does this vulnerability meet the risk threshold we have agreed upon internally? +- What is the actual (business) impact of a possible vulnerability exploitation, considering factors that may not be known to the penetration tester? +- Who will be responsible for remediating each finding? + +## Remediate + +Before taking any further actions, it’s crucial to verify that the vulnerability is reproducible. This not only enhances your understanding of the issue but also helps identify the systems at risk and different intrusion techniques. + +To initiate the remediation phase, it’s essential to comprehend the scope of what needs to be fixed. While technical fixes may be necessary, there could also be underlying causes, such as: + +- Management practices that require improvements; +- Alternative approaches; +- Ineffective or overly permissive security policies; +- Communication issues within or between departments. + +Nevertheless, in most cases, a technical fix must be implemented. We advise remediating the findings as soon as possible, as the chances of the penetration tester still being intimately familiar with the vulnerability are higher, and the probability of an exploitation is lower. + +## Retest + +At Oneleet, we are committed to safeguarding your company. We provide free retesting for a year after the penetration test is delivered, giving you ample time to address vulnerabilities and improve your company’s security posture. However, it’s crucial to adhere to your internal policy regarding vulnerability remediation, particularly in light of compliance requirements such as SOC 2, PCI, or ISO 27001. + +## Accepting the risk + +Marking vulnerabilities as `Accepted Risk` on our platform is entirely at your discretion. We recognize that each client may have a higher or lower internal risk threshold for remediation, and we respect your decision if the analyzed impact is deemed too low to warrant action. + +However, we advise against accepting vulnerabilities with a `Medium` or higher risk. As these vulnerabilities pose a growing business risk, they are not a matter of if but when they will impact your organization. Therefore, ensure that you allocate sufficient time and effort to remediate these risks effectively. + +Our recommendation is to always provide a clear reason for accepting a risk. This rationale will be included in the penetration test report, allowing you to offer additional context to internal and external stakeholders regarding the acceptability of the risk. + +--- \ No newline at end of file diff --git a/pages/penetration-testing/offerings.mdx b/pages/penetration-testing/offerings.mdx new file mode 100644 index 0000000..2e0e24e --- /dev/null +++ b/pages/penetration-testing/offerings.mdx @@ -0,0 +1,33 @@ +# Penetration Test Offerings + +Multiple types of Penetration Tests/Engagements fall within the expertise of Oneleet’s penetration testing team, some of them being: + +- Network Pentesting; +- Mobile App Pentesting; +- Web App Pentesting; +- Wireless Network Pentesting; +- Social Engineering Pentesting; +- Pentest Program Management; +- IoT Ecosystem Testing; +- Red Team Assessment; +- Digital Risk Assessment; +- Secure Code Review. + +At Oneleet, we offer **3** different types of Penetration Test packages. + +| Feature | Compliance | Comprehensive | Custom +|-----|-----|-----|----- +| **Description** | A high-level assessment of your product, evaluating the effectiveness of your security measures in mitigating potential breaches for compliance purposes. | A thorough penetration test that examines all aspects of your application's attack surface to identify vulnerabilities across all categories. | A thorough penetration test that examines all aspects of your application's attack surface to identify vulnerabilities across all categories. +| **Target** |Web Applications

Mobile Applications

APIs

| Web Applications

Mobile Applications

APIs

Networks

Cloud Assessmentss

Secure Code Reviews

Social Engineering

| Web Applications

Mobile Applications

APIs

Networks

Cloud Assessmentss

Secure Code Reviews

Social Engineering

Red Teaming

IoT Devices

+| **Use cases** | Vulnerability testing of existing & new features. Often sufficient for early-stage companies going through SOC 2 | Vulnerability testing of existing & new features. Microservices testing. Testing based on several OWASP frameworks | Companies with multiple applications, red teaming, etc. +| **Testers** | Manual test with a penetration tester that is at minimum OSCP & OSCE/OSWE certified | Manual test with a penetration tester that is at minimum OSCP & OSCE/OSWE certified | Manual test with a penetration tester that is at minimum OSCE/OSWE certified +| **Customizable Report** | Not Included | Included | Included +| **Support** | Answer within 48H | Dedicated point of contact that answers within 24H | Dedicated point of contact that answers within 24H +| **Free Retesting** | 12 months | 12 months | 12 months +| **Rush delivery** | Optional | Optional | Included +| **Letter of Engagement** | Included | Included | Included +| **Letter of Attestation** | Included | Included | Included +| **Customized Letters** | Not included | Included | Included +| **Onboarding Support** | Slack | Slack & Live | Slack & Live +| **Dedicated Customer Success Manager** | Not included | Included | Included +| **Used Standards** | Pentest conducted in accordance with industry-standard methodologies such as OWASP Top-10 | Pentest conducted in accordance with industry-standard methodologies such as OWASP WSTG, OWASP ASVS, etc. | Pentest conducted in accordance with industry-standard methodologies such as OWASP WSTG, OWASP ASVS, etc. | diff --git a/pages/penetration-testing/process-overview.mdx b/pages/penetration-testing/process-overview.mdx index c285119..dc01335 100644 --- a/pages/penetration-testing/process-overview.mdx +++ b/pages/penetration-testing/process-overview.mdx @@ -1,4 +1,4 @@ -# High-level overview of the Process +# Penetration Testing High-level Overview ![](/penetration-testing/process.png) diff --git a/pages/penetration-testing/ptaas.mdx b/pages/penetration-testing/ptaas.mdx index e7d66d2..f3fbb89 100644 --- a/pages/penetration-testing/ptaas.mdx +++ b/pages/penetration-testing/ptaas.mdx @@ -1,4 +1,4 @@ -# Penetration Testing as a Service (PtaaS) at Oneleet +# Penetration Testing as a Service (PtaaS) ## About Us @@ -13,7 +13,7 @@ The primary objective of a penetration testing at Oneleet is to identify vulnera ## Services -Oneleet offers expertly conducted Penetration Testing services by our team of highly qualified professionals from NATO countries. They hold advanced certifications like OSCP and OSCE or OSWE. Our team’s expertise encompasses network penetration (wired and wireless), web and mobile application security, social engineering, and code reviews. This extensive skill set enables them to identify vulnerabilities across various systems and technologies. +Oneleet offers expertly conducted Penetration Testing services by our team of highly qualified professionals from NATO countries. They hold advanced certifications like OSCE. Our team’s expertise encompasses network penetration (wired and wireless), web and mobile application security, social engineering, and code reviews. This extensive skill set enables them to identify vulnerabilities across various systems and technologies. We provide flexible retesting options as part of our standard penetration testing package and offer a comprehensive platform for managing vulnerabilities. diff --git a/pages/penetration-testing/reports-documents.mdx b/pages/penetration-testing/reports-documents.mdx deleted file mode 100644 index 9176940..0000000 --- a/pages/penetration-testing/reports-documents.mdx +++ /dev/null @@ -1,9 +0,0 @@ -# Penetration Test Reports / Documents - -At Oneleet, we offer several types of documents - -| Name | Description | Target -|-----|-----|----- -| Full Report | - Generated at the conclusion of the engagement.`
`- This report presents all the findings, accompanied by a *Description*, *Business impact*, *Reproduction steps*, and *Remediation steps* section.`
`- It includes an executive summary that highlights positive findings and recommendations.`
`- The results section provides a high-level overview, a table listing vulnerabilities, and an overview of the scope of the engagement.`
`- After remediation, the report will be updated to reflect the current state of each identified finding. | Internal Usage / External Stakeholders -| Letter of Attestation | - Verifies the successful completion of a penetration test, offering a succinct summary of the scope, methodologies employed, and the tester's proficiency.`
`- Offers a comprehensive evaluation of the application's security, identifying the number of vulnerabilities discovered. | External Stakeholders -| Letter of Engagement | - Notifies that you are undergoing a penetration test.`
`- Offers a comprehensive overview of the test's objectives, scope, methodologies, and the dates of the assessment.`
`- Assures you that any vulnerabilities discovered will be promptly reported for remediation. | External Stakeholders | diff --git a/pages/penetration-testing/types.mdx b/pages/penetration-testing/types.mdx deleted file mode 100644 index 9137168..0000000 --- a/pages/penetration-testing/types.mdx +++ /dev/null @@ -1,61 +0,0 @@ -import { Callout } from "nextra/components"; - -# Penetration Testing Types - -At Oneleet, we tailor our approach to meet each client’s needs. We recognize that businesses vary in size, goals, and requirements, so we develop customized strategies for success. - -Generally, there are three types of penetration testing scenarios. Sometimes, there’s also a distinction made between internal and external penetration testing. Let’s break it down: - -## White Box Penetration Testing - -The tester possesses complete knowledge of the system’s source code, architecture, and network details. This scenario resembles an attacker with in-depth understanding of the system’s inner workings. Such an attacker could be a disgruntled employee, a contractor, or someone who has gained unauthorized access to sensitive internal information. - -## Gray Box penetration Testing - -The tester may have limited access to internal documentation or user credentials, which could be exploited by an attacker with some inside information or limited access to the system. - - - This is the type of penetration testing we most often recommend to our - clients, as it provides a balanced approach in terms breadth, and depth. - However, depending on the company's nature, product, and likely attack - vectors, other types of penetration testing might be more relevant. - - -## Black Box Penetration Testing - -The tester, lacking prior knowledge of the system, adopts an external hacker’s perspective. The simulated attacker embodies a hacker attempting to breach the system from the outside. They employ techniques such as reconnaissance, social engineering, and vulnerability scanning to identify potential weaknesses. - -## External vs Internal Penetration Testing - -**External Penetration Testing** simulates an attack originating from outside the organization, specifically targeting internet-facing assets such as web applications, firewalls, and public servers. The primary objective is to uncover vulnerabilities that an external attacker could potentially exploit. Common targets include websites, virtual private networks (VPNs), and cloud resources. These tests encompass a range of scenarios, including misconfigurations, compromised passwords, and outdated software. - -**Internal Penetration Testing** simulates an attacker who has already gained access to the internal network. It focuses on internal security controls, access permissions, and lateral movement capabilities, targeting internal systems, applications, and sensitive data. - ---- - -Multiple types of Penetration Tests/Engagements fall within the expertise of Oneleet’s penetration testing team, some of them being: - -| **Network Pentesting** | **Mobile App Pentesting** | **Web App Pentesting** | **Wireless Network Pentesting** | **Social Engineering Pentesting** | -| ------------------------------ | ------------------------- | ----------------------- | ------------------------------- | --------------------------------- | -| **Pentest Program Management** | **IoT Ecosystem Testing** | **Red Team Assessment** | **Digital Risk Assessment** | **Secure Code Review** | - ---- - -At Oneleet, we offer **3** different types of Penetration Test Packages. - -| Feature | Compliance | Comprehensive | Custom -|-----|-----|-----|----- -| Description | A high-level assessment of your product, evaluating the effectiveness of your security measures in mitigating potential breaches for compliance purposes. | A thorough penetration test that examines all aspects of your application's attack surface to identify vulnerabilities across all categories. | A thorough penetration test that examines all aspects of your application's attack surface to identify vulnerabilities across all categories. -| Target | - Web Apps`
`- Mobile Apps`
`- APIs | - Web Apps`
`- Mobile Apps`
`- APIs`
`- Networks`
`- Cloud Assessment`
`- Secure Code Reviews`
`- Social Engineering | - Web Apps`
`- Mobile Apps`
`- Networks`
`- APIs`
`- Cloud Assessment`
`- Secure Code Reviews`
`- Social Engineering`
`- Red Teaming`
`- IoT Devices -| Use cases | - Vulnerability testing of existing & new features`
`- Often sufficient for early-stage companies going through SOC 2. | - Vulnerability testing of existing & new features`
`- Microservices testing`
`- Testing based on several OWASP frameworks | Companies with multiple applications, red teaming, etc. -| Testers | Manual test with a penetration tester that is at minimum OSCP & OSCE/OSWE certified | Manual test with a penetration tester that is at minimum OSCP & OSCE/OSWE certified | Manual test with a penetration tester that is at minimum OSCE/OSWE certified -| Customizable Report | Not Included | Included | Included -| Support | - Answer within 48H | - Dedicated point of contact`
`- Answer within 24H | - Dedicated point of contact`
`- Answer within 24H -| Free Retesting | 12 months | 12 months | 12 months -| Rush delivery | Optional | Optional | Included -| Letter of Engagement | Included | Included | Included -| Letter of Attestation | Included | Included | Included -| Customized Letters | Not included | Included | Included -| Onboarding Support | Slack | Slack & Live | Slack & Live -| Dedicated Customer Success Manager | Not included | Included | Included -| Used Standards | Pentest conducted in accordance with industry-standard methodologies such as OWASP Top-10 | Pentest conducted in accordance with industry-standard methodologies such as OWASP WSTG, OWASP ASVS, etc. | Pentest conducted in accordance with industry-standard methodologies such as OWASP WSTG, OWASP ASVS, etc. | From bb40070f4ea9ae091a73e8411806629bc0eabc0a Mon Sep 17 00:00:00 2001 From: Mohammed Nafees Date: Thu, 5 Dec 2024 00:03:46 +0530 Subject: [PATCH 4/8] resolve all PR comments --- pages/_meta.ts | 2 +- pages/penetration-testing/classification/pci-dss.mdx | 6 +++--- pages/penetration-testing/documents.mdx | 2 +- pages/penetration-testing/faq.mdx | 6 +++--- pages/penetration-testing/final-report.mdx | 2 +- pages/penetration-testing/findings-decisions.mdx | 6 +++--- pages/penetration-testing/offerings.mdx | 2 +- pages/penetration-testing/process-overview.mdx | 6 +++--- pages/penetration-testing/ptaas.mdx | 10 +++++----- 9 files changed, 21 insertions(+), 21 deletions(-) diff --git a/pages/_meta.ts b/pages/_meta.ts index 8e3666f..5fd2e31 100644 --- a/pages/_meta.ts +++ b/pages/_meta.ts @@ -1,9 +1,9 @@ export default { "index": "Introduction", - "penetration-testing": "Penetration Testing", "integrations": "Integrations", "oneleet-agent": "Oneleet Agent", "guides": "Guides", + "penetration-testing": "Penetration Testing", "support": { "title": "Support", "type": "page", diff --git a/pages/penetration-testing/classification/pci-dss.mdx b/pages/penetration-testing/classification/pci-dss.mdx index c10adac..fcfd4bb 100644 --- a/pages/penetration-testing/classification/pci-dss.mdx +++ b/pages/penetration-testing/classification/pci-dss.mdx @@ -1,10 +1,10 @@ # PCI DSS Penetration Test -If you hired Oneleet for a PCI-DSS penetration test, there will be a few minor differences compared to our regular penetration testing process. The primary objectives of the PCI-DSS penetration test are to: +If you hired Oneleet for a PCI DSS penetration test, there will be a few minor differences compared to our regular penetration testing process. The primary objectives of the PCI DSS penetration test are to: - Validate that the cardholder data environment (CDE) is isolated, secure, and compliant with PCI DSS standards. -- Ensure that the CHD is protected from unauthorized access. -- Identify and remediate vulnerabilities that could compromise the CHD. +- Ensure that cardholder data (CHD) is protected from unauthorized access. +- Identify and remediate vulnerabilities that could compromise cardholder data. As a result, the following processes will be slightly different: diff --git a/pages/penetration-testing/documents.mdx b/pages/penetration-testing/documents.mdx index 2f2e566..ad679d8 100644 --- a/pages/penetration-testing/documents.mdx +++ b/pages/penetration-testing/documents.mdx @@ -4,6 +4,6 @@ At Oneleet, we offer several types of documents during the penetration testing p | Name | Description | Target |-----|-----|----- -| **Full Report** | Generated at the conclusion of the engagement. This report presents all the findings, accompanied by a **Description**, **Business impact**, **Reproduction steps**, and **Remediation steps** section. It includes an executive summary that highlights positive findings and recommendations. The results section provides a high-level overview, a table listing vulnerabilities, and an overview of the scope of the engagement. After remediation, the report will be updated to reflect the current state of each identified finding. | Internal Usage or

External Stakeholders +| **Full Report** | Generated at the conclusion of the engagement. This report presents all the findings, accompanied by a **Description**, **Business impact**, **Reproduction steps**, and **Remediation steps** section. It includes an executive summary that highlights positive findings and recommendations. The results section provides a high-level overview, a table listing vulnerabilities, and an overview of the scope of the engagement. After remediation, the report will be updated to reflect the current state of each identified finding. | Internal Usage or External Stakeholders | **Letter of Attestation** | Verifies the successful completion of a penetration test, offering a succinct summary of the scope, methodologies employed, and the tester's proficiency. Offers a comprehensive evaluation of the application's security, identifying the number of vulnerabilities discovered. | External Stakeholders | **Letter of Engagement** | Notifies that you are undergoing a penetration test. Offers a comprehensive overview of the test's objectives, scope, methodologies, and the dates of the assessment. Assures you that any vulnerabilities discovered will be promptly reported for remediation. | External Stakeholders | diff --git a/pages/penetration-testing/faq.mdx b/pages/penetration-testing/faq.mdx index 53ccafb..04eff79 100644 --- a/pages/penetration-testing/faq.mdx +++ b/pages/penetration-testing/faq.mdx @@ -2,11 +2,11 @@ ### Does a Penetration Test at Oneleet include DDoS? -No. At Oneleet, we recognize that such attacks increase the probability of operational disruptions or the risk of collateral damage. We firmly believe that there is no genuine advantage to conducting such tests when doing a penetration test. +No. At Oneleet, we recognize that such attacks increase the probability of operational disruptions or the risk of collateral damage. We firmly believe that there is no genuine advantage to conducting such tests during a penetration test. ### Between a Black, Gray or White-box Penetration Test, what should I pick? -Opt for a **White-box Pentration Test** if you are prepared to provide the source code and configuration files to the penetration tester, or if the application is open-source, as it effectively simulates threats that have or had access to the source code. Select a **Gray-box Penetration Test** for a best-of-both-worlds approach, as it allows the penetration tester to uncover most vulnerabilities accessible to both an out- and insider. Choose a **Black-box Penetration Test** if you are main concern is about external threat actors. +Opt for a **White-box Pentration Test** if you're prepared to provide the source code and configuration files to the penetration tester, or if the application is open-source, as it effectively simulates threats that have or had access to the source code. Select a **Gray-box Penetration Test** for a best-of-both-worlds approach, as it allows the penetration tester to uncover most vulnerabilities accessible to both external and internal attackers. Choose a **Black-box Penetration Test** if your main concern is about external threat actors. ### Do I need to set up a staging environment, and where do you test? @@ -16,7 +16,7 @@ We usually conduct tests in the staging environment and advise against testing i We advise against implementing significant system changes during the penetration test. While pushing small changes is acceptable, we recommend maintaining a stable environment throughout the engagement to ensure the accuracy and reliability of the testing process. -### What to expect on the penetration testing scoping call? Should I prepare something? +### What should I expect on the penetration testing scoping call? Should I prepare something? See [this](/penetration-testing/process-overview) section. diff --git a/pages/penetration-testing/final-report.mdx b/pages/penetration-testing/final-report.mdx index 2ee1798..fabc461 100644 --- a/pages/penetration-testing/final-report.mdx +++ b/pages/penetration-testing/final-report.mdx @@ -2,7 +2,7 @@ import { Callout } from "nextra/components"; # Penetration Test Final Report -First of all, the report includes the findings from the penetration test. Among other data, key points of our penetration test report include: +The findings from our penetration test form the core of the report. Key elements include: - **Risk Assessment:** The overall risk of the vulnerability, categorized from Low to Critical based on its impact and probability. - **Vulnerability Description:** A comprehensive overview of each identified vulnerability, written in a clear and accessible manner for a broad audience. diff --git a/pages/penetration-testing/findings-decisions.mdx b/pages/penetration-testing/findings-decisions.mdx index 4781fd2..abd7bb5 100644 --- a/pages/penetration-testing/findings-decisions.mdx +++ b/pages/penetration-testing/findings-decisions.mdx @@ -8,8 +8,8 @@ Here’s a brief overview of actions you can take once the penetration test repo When deciding to address a vulnerability, the first and most crucial step is to allocate sufficient time to analyze and interpret the report. Your employees responsible for the penetration test should consider the following questions: -- Does this vulnerability meet the risk threshold we have agreed upon internally? -- What is the actual (business) impact of a possible vulnerability exploitation, considering factors that may not be known to the penetration tester? +- Does this vulnerability meet the risk threshold we've agreed upon internally? +- What's the actual (business) impact of a possible vulnerability exploitation, considering factors that may not be known to the penetration tester? - Who will be responsible for remediating each finding? ## Remediate @@ -27,7 +27,7 @@ Nevertheless, in most cases, a technical fix must be implemented. We advise reme ## Retest -At Oneleet, we are committed to safeguarding your company. We provide free retesting for a year after the penetration test is delivered, giving you ample time to address vulnerabilities and improve your company’s security posture. However, it’s crucial to adhere to your internal policy regarding vulnerability remediation, particularly in light of compliance requirements such as SOC 2, PCI, or ISO 27001. +As part of our commitment to protecting your organization, we offer free retesting for up to a year after delivering the penetration test, allowing ample time to address vulnerabilities and strengthen your security posture. Remember to align remediation efforts with your internal policies, especially to meet compliance standards like SOC 2, PCI DSS, or ISO 27001. ## Accepting the risk diff --git a/pages/penetration-testing/offerings.mdx b/pages/penetration-testing/offerings.mdx index 2e0e24e..eb920e4 100644 --- a/pages/penetration-testing/offerings.mdx +++ b/pages/penetration-testing/offerings.mdx @@ -18,7 +18,7 @@ At Oneleet, we offer **3** different types of Penetration Test packages. | Feature | Compliance | Comprehensive | Custom |-----|-----|-----|----- | **Description** | A high-level assessment of your product, evaluating the effectiveness of your security measures in mitigating potential breaches for compliance purposes. | A thorough penetration test that examines all aspects of your application's attack surface to identify vulnerabilities across all categories. | A thorough penetration test that examines all aspects of your application's attack surface to identify vulnerabilities across all categories. -| **Target** |Web Applications

Mobile Applications

APIs

| Web Applications

Mobile Applications

APIs

Networks

Cloud Assessmentss

Secure Code Reviews

Social Engineering

| Web Applications

Mobile Applications

APIs

Networks

Cloud Assessmentss

Secure Code Reviews

Social Engineering

Red Teaming

IoT Devices

+| **Target** |Web Applications Mobile Applications APIs | Web Applications Mobile Applications APIs Networks Cloud Assessmentss Secure Code Reviews Social Engineering | Web Applications Mobile Applications APIs Networks Cloud Assessmentss Secure Code Reviews Social Engineering Red Teaming IoT Devices | **Use cases** | Vulnerability testing of existing & new features. Often sufficient for early-stage companies going through SOC 2 | Vulnerability testing of existing & new features. Microservices testing. Testing based on several OWASP frameworks | Companies with multiple applications, red teaming, etc. | **Testers** | Manual test with a penetration tester that is at minimum OSCP & OSCE/OSWE certified | Manual test with a penetration tester that is at minimum OSCP & OSCE/OSWE certified | Manual test with a penetration tester that is at minimum OSCE/OSWE certified | **Customizable Report** | Not Included | Included | Included diff --git a/pages/penetration-testing/process-overview.mdx b/pages/penetration-testing/process-overview.mdx index dc01335..822658b 100644 --- a/pages/penetration-testing/process-overview.mdx +++ b/pages/penetration-testing/process-overview.mdx @@ -23,15 +23,15 @@ 4. **Report** -- The discovered vulnerabilities will be uploaded on Oneleet’s platform. -- Once the engagement finishes, an internal team will revise the Penetration Test Report which shall be available within 2 to 3 business days. +- All discovered vulnerabilities will be uploaded on Oneleet’s platform. +- After the engagement concludes, our internal team will revise the Penetration Test Report, which will be made available within 2 to 3 business days. - The final Penetration Test Report will include an executive summary, risk ratings, detailed findings, and recommendations. 5. **Remediate** - If necessary, you can remediate the vulnerabilities, and our penetration tester will retest the system within a couple of days. - At this stage, you also have the option to accept the risk or reject the vulnerability. -- Once all the findings have been addressed, an updated report will reflect the new state of each finding. +- Once all findings have been addressed, an updated report will reflect the new state of each finding. 6. **Evaluate** diff --git a/pages/penetration-testing/ptaas.mdx b/pages/penetration-testing/ptaas.mdx index f3fbb89..b9cde87 100644 --- a/pages/penetration-testing/ptaas.mdx +++ b/pages/penetration-testing/ptaas.mdx @@ -2,19 +2,19 @@ ## About Us -Oneleet is a United States-based cybersecurity company, established and ran by experienced penetration testers. The company offers flexible penetration testing options and a comprehensive platform for managing and addressing security vulnerabilities. Its interface facilitates the tracking and remediation of security findings, ensuring that organizations maintain robust and current defenses. Oneleet provides both expert testing services and a management system to facilitate the maintenance and enhancement of security posture. The company has received backing from venture capital firms such as Y Combinator positioning itself as a key competitor that prioritizes support, effectiveness, and communication. Oneleet serves a diverse clientele, ranging from enterprises to early-stage startups. +Oneleet is a U.S.-based cybersecurity company founded and run by experienced penetration testers. We offer flexible penetration testing options and a comprehensive platform to manage and address security vulnerabilities, helping your organization build and maintain a strong security posture. Backed by venture capital firms like Y Combinator, Oneleet combines expert testing services with an intuitive management system, serving clients ranging from enterprises to early-stage startups. With a focus on support, effectiveness, and communication, Oneleet has established itself as a leading provider in the cybersecurity and compliance space. ## Our Penetration Testing Goal > Identifying vulnerabilities to reduce risk. Simulating real world attacks on your applications, systems and networks. > -The primary objective of a penetration testing at Oneleet is to identify vulnerabilities before malicious actors exploit them, thereby fortifying your security program. We are excited to collaborate with you in your commitment to uncovering vulnerabilities and implementing robust protection measures. +The primary goal of penetration testing at Oneleet is to uncover vulnerabilities before they can be exploited by malicious actors. We look forward to partnering with you to identify risks and implement effective protection measures. ## Services -Oneleet offers expertly conducted Penetration Testing services by our team of highly qualified professionals from NATO countries. They hold advanced certifications like OSCE. Our team’s expertise encompasses network penetration (wired and wireless), web and mobile application security, social engineering, and code reviews. This extensive skill set enables them to identify vulnerabilities across various systems and technologies. +Oneleet provides expertly conducted penetration testing services, delivered by a team of highly qualified professionals from NATO countries. Our experts hold advanced certifications such as OSCP, OSCE, and OSWE, attesting to their high level of technical competance. Their expertise spans network penetration (wired and wireless), web and mobile application security, social engineering, and code reviews. This diverse skill set allows them to identify vulnerabilities across a wide range of systems and technologies. -We provide flexible retesting options as part of our standard penetration testing package and offer a comprehensive platform for managing vulnerabilities. +We offer flexible retesting options as part of our standard penetration testing package, along with a comprehensive platform for managing vulnerabilities. -At Oneleet, we frequently conduct penetration tests to meet compliance requirements for frameworks like SOC 2, ISO 27001, PCI, HIPAA and more. +At Oneleet, we frequently conduct penetration tests to help organizations meet compliance requirements for frameworks like SOC 2, ISO 27001, PCI DSS, HIPAA, and more. From ef4a035da38c425fb0b0c20581c4cba04a48ef6d Mon Sep 17 00:00:00 2001 From: AlexCulda Date: Thu, 5 Dec 2024 13:30:40 +0200 Subject: [PATCH 5/8] Final Changes Went over the docs once again with Erik and made some final, FINAL changes. Should be good to go. --- pages/penetration-testing/_meta.ts | 9 +++++---- .../penetration-testing/classification/_meta.ts | 5 ----- pages/penetration-testing/faq.mdx | 4 ++-- pages/penetration-testing/final-report.mdx | 6 +++--- .../penetration-testing/findings-decisions.mdx | 10 +++++----- .../{classification => }/pci-dss.mdx | 2 +- .../pentesting-classification/_meta.ts | 4 ++++ .../access-level.mdx | 2 +- .../attack-vector.mdx | 2 +- pages/penetration-testing/services/_meta.ts | 4 ++++ pages/penetration-testing/services/areas.mdx | 13 +++++++++++++ .../{offerings.mdx => services/packages.mdx} | 17 ++--------------- 12 files changed, 41 insertions(+), 37 deletions(-) delete mode 100644 pages/penetration-testing/classification/_meta.ts rename pages/penetration-testing/{classification => }/pci-dss.mdx (95%) create mode 100644 pages/penetration-testing/pentesting-classification/_meta.ts rename pages/penetration-testing/{classification => pentesting-classification}/access-level.mdx (97%) rename pages/penetration-testing/{classification => pentesting-classification}/attack-vector.mdx (95%) create mode 100644 pages/penetration-testing/services/_meta.ts create mode 100644 pages/penetration-testing/services/areas.mdx rename pages/penetration-testing/{offerings.mdx => services/packages.mdx} (70%) diff --git a/pages/penetration-testing/_meta.ts b/pages/penetration-testing/_meta.ts index 3e9abb6..2e54a73 100644 --- a/pages/penetration-testing/_meta.ts +++ b/pages/penetration-testing/_meta.ts @@ -1,10 +1,11 @@ export default { ptaas: "Penetration Testing as a Service (PtaaS)", + "services": "Pentesting Services", + "pentesting-classification": "Types of Pentests", "process-overview": "Process Overview", - "classification": "Classification", "documents": "Documents", - "final-report": "Final Report", - "offerings": "Offerings", - "findings-decisions": "Decisions on Findings", + "final-report": "Penetration Test Report", + "findings-decisions": "Remediation", + "pci-dss": "PCI DSS", "faq": "Frequently Asked Questions" }; diff --git a/pages/penetration-testing/classification/_meta.ts b/pages/penetration-testing/classification/_meta.ts deleted file mode 100644 index 56e4786..0000000 --- a/pages/penetration-testing/classification/_meta.ts +++ /dev/null @@ -1,5 +0,0 @@ -export default { - "access-level": "Access Level", - "attack-vector": "Attack Vector", - "pci-dss": "PCI DSS", - } \ No newline at end of file diff --git a/pages/penetration-testing/faq.mdx b/pages/penetration-testing/faq.mdx index 53ccafb..8142f1f 100644 --- a/pages/penetration-testing/faq.mdx +++ b/pages/penetration-testing/faq.mdx @@ -1,10 +1,10 @@ -# FAQ +# Frequently Asked Questions ### Does a Penetration Test at Oneleet include DDoS? No. At Oneleet, we recognize that such attacks increase the probability of operational disruptions or the risk of collateral damage. We firmly believe that there is no genuine advantage to conducting such tests when doing a penetration test. -### Between a Black, Gray or White-box Penetration Test, what should I pick? +### Which Penetration Test Should I Choose: Black, Gray, or White Box? Opt for a **White-box Pentration Test** if you are prepared to provide the source code and configuration files to the penetration tester, or if the application is open-source, as it effectively simulates threats that have or had access to the source code. Select a **Gray-box Penetration Test** for a best-of-both-worlds approach, as it allows the penetration tester to uncover most vulnerabilities accessible to both an out- and insider. Choose a **Black-box Penetration Test** if you are main concern is about external threat actors. diff --git a/pages/penetration-testing/final-report.mdx b/pages/penetration-testing/final-report.mdx index 2ee1798..17c8719 100644 --- a/pages/penetration-testing/final-report.mdx +++ b/pages/penetration-testing/final-report.mdx @@ -1,6 +1,6 @@ import { Callout } from "nextra/components"; -# Penetration Test Final Report +# Penetration Test Report First of all, the report includes the findings from the penetration test. Among other data, key points of our penetration test report include: @@ -10,7 +10,7 @@ First of all, the report includes the findings from the penetration test. Among - **Steps to Reproduce:** Detailed instructions for engineers on how to replicate the vulnerability, including the use of publicly available tools whenever feasible. - **Recommendations:** Specific guidance on how to address the vulnerability, varying in detail depending on the type of finding. These recommendations can range from granular to high-level. -Before comprehending the remediation process for the vulnerabilities discovered during the penetration test, it's crucial to grasp concepts like **Finding States**, **Characteristics**, or **Overall Risk**. +Before comprehending the remediation process for the vulnerabilities discovered during the penetration test, it's important to grasp concepts like **Finding States**, **Characteristics**, or **Overall Risk**. ## Finding States @@ -42,7 +42,7 @@ Before comprehending the remediation process for the vulnerabilities discovered For clients conducting a penetration test for compliance purposes, it's - crucial to address vulnerabilities in line with your organization's + important to address vulnerabilities in line with your organization's vulnerability management policy. Failure to do so may lead to concerns raised by auditors. diff --git a/pages/penetration-testing/findings-decisions.mdx b/pages/penetration-testing/findings-decisions.mdx index 4781fd2..1a5f9f9 100644 --- a/pages/penetration-testing/findings-decisions.mdx +++ b/pages/penetration-testing/findings-decisions.mdx @@ -1,4 +1,4 @@ -# Decisions on Findings +# Remediation After receiving the penetration test report, there are several steps you can take, such as remediation, accepting the risk, or rejecting the findings. @@ -6,7 +6,7 @@ Here’s a brief overview of actions you can take once the penetration test repo ## Analyze -When deciding to address a vulnerability, the first and most crucial step is to allocate sufficient time to analyze and interpret the report. Your employees responsible for the penetration test should consider the following questions: +When deciding to address a vulnerability, the first step is to allocate sufficient time to analyze and interpret the report. Your employees responsible for the penetration test should consider the following questions: - Does this vulnerability meet the risk threshold we have agreed upon internally? - What is the actual (business) impact of a possible vulnerability exploitation, considering factors that may not be known to the penetration tester? @@ -14,9 +14,9 @@ When deciding to address a vulnerability, the first and most crucial step is to ## Remediate -Before taking any further actions, it’s crucial to verify that the vulnerability is reproducible. This not only enhances your understanding of the issue but also helps identify the systems at risk and different intrusion techniques. +Before taking any further actions, you should verify that the vulnerability is reproducible. This not only enhances your understanding of the issue but also helps identify the systems at risk and different intrusion techniques. -To initiate the remediation phase, it’s essential to comprehend the scope of what needs to be fixed. While technical fixes may be necessary, there could also be underlying causes, such as: +To initiate the remediation phase, you should comprehend the scope of what needs to be fixed. While technical fixes may be necessary, there could also be underlying causes, such as: - Management practices that require improvements; - Alternative approaches; @@ -27,7 +27,7 @@ Nevertheless, in most cases, a technical fix must be implemented. We advise reme ## Retest -At Oneleet, we are committed to safeguarding your company. We provide free retesting for a year after the penetration test is delivered, giving you ample time to address vulnerabilities and improve your company’s security posture. However, it’s crucial to adhere to your internal policy regarding vulnerability remediation, particularly in light of compliance requirements such as SOC 2, PCI, or ISO 27001. +At Oneleet, we are committed to safeguarding your company. We provide free retesting for a year after the penetration test is delivered, giving you ample time to address vulnerabilities and improve your company’s security posture. However, it’s important to adhere to your internal policy regarding vulnerability remediation, particularly in light of compliance requirements such as SOC 2, PCI, or ISO 27001. ## Accepting the risk diff --git a/pages/penetration-testing/classification/pci-dss.mdx b/pages/penetration-testing/pci-dss.mdx similarity index 95% rename from pages/penetration-testing/classification/pci-dss.mdx rename to pages/penetration-testing/pci-dss.mdx index c10adac..b356e33 100644 --- a/pages/penetration-testing/classification/pci-dss.mdx +++ b/pages/penetration-testing/pci-dss.mdx @@ -1,6 +1,6 @@ # PCI DSS Penetration Test -If you hired Oneleet for a PCI-DSS penetration test, there will be a few minor differences compared to our regular penetration testing process. The primary objectives of the PCI-DSS penetration test are to: +If you engaged Oneleet for a PCI-DSS penetration test, there will be a few minor differences compared to our regular penetration testing process. The primary objectives of the PCI-DSS penetration test are to: - Validate that the cardholder data environment (CDE) is isolated, secure, and compliant with PCI DSS standards. - Ensure that the CHD is protected from unauthorized access. diff --git a/pages/penetration-testing/pentesting-classification/_meta.ts b/pages/penetration-testing/pentesting-classification/_meta.ts new file mode 100644 index 0000000..10b958f --- /dev/null +++ b/pages/penetration-testing/pentesting-classification/_meta.ts @@ -0,0 +1,4 @@ +export default { + "access-level": "Black, Grey and White-box", + "attack-vector": "Internal and External" + } \ No newline at end of file diff --git a/pages/penetration-testing/classification/access-level.mdx b/pages/penetration-testing/pentesting-classification/access-level.mdx similarity index 97% rename from pages/penetration-testing/classification/access-level.mdx rename to pages/penetration-testing/pentesting-classification/access-level.mdx index 54afc2c..1581e9f 100644 --- a/pages/penetration-testing/classification/access-level.mdx +++ b/pages/penetration-testing/pentesting-classification/access-level.mdx @@ -1,6 +1,6 @@ import { Callout } from "nextra/components"; -# Classification based on Access Level +# Black, Grey and White-box Penetration Testing At Oneleet, we tailor our approach to meet each client’s needs. We recognize that businesses vary in size, goals, and requirements, so we develop customized strategies for success. diff --git a/pages/penetration-testing/classification/attack-vector.mdx b/pages/penetration-testing/pentesting-classification/attack-vector.mdx similarity index 95% rename from pages/penetration-testing/classification/attack-vector.mdx rename to pages/penetration-testing/pentesting-classification/attack-vector.mdx index e91fbbd..96053f7 100644 --- a/pages/penetration-testing/classification/attack-vector.mdx +++ b/pages/penetration-testing/pentesting-classification/attack-vector.mdx @@ -1,4 +1,4 @@ -# Classification based on Attack Vector +# Internal and External Penetration Testing Sometimes, there’s also a distinction made between internal and external penetration testing. If the previous Black/Grey/White categorizes tests by what the tester knows/can access, the Internal/External one categorizes tests by where the testing originates. diff --git a/pages/penetration-testing/services/_meta.ts b/pages/penetration-testing/services/_meta.ts new file mode 100644 index 0000000..e966d3e --- /dev/null +++ b/pages/penetration-testing/services/_meta.ts @@ -0,0 +1,4 @@ +export default { + "areas": "Pentesting Areas", + "packages": "Pentesting Packages" +} \ No newline at end of file diff --git a/pages/penetration-testing/services/areas.mdx b/pages/penetration-testing/services/areas.mdx new file mode 100644 index 0000000..a89ee2e --- /dev/null +++ b/pages/penetration-testing/services/areas.mdx @@ -0,0 +1,13 @@ +# Penetration Testing Areas + +Multiple types of Penetration Tests/Engagements fall within the expertise of Oneleet’s penetration testing team, some of them being: +- Network Pentesting; +- Mobile App Pentesting; +- Web App Pentesting; +- Wireless Network Pentesting; +- Social Engineering Pentesting; +- Pentest Program Management; +- IoT Ecosystem Testing; +- Red Team Assessment; +- Digital Risk Assessment; +- Source Code Review. \ No newline at end of file diff --git a/pages/penetration-testing/offerings.mdx b/pages/penetration-testing/services/packages.mdx similarity index 70% rename from pages/penetration-testing/offerings.mdx rename to pages/penetration-testing/services/packages.mdx index 2e0e24e..dfa4bae 100644 --- a/pages/penetration-testing/offerings.mdx +++ b/pages/penetration-testing/services/packages.mdx @@ -1,23 +1,10 @@ -# Penetration Test Offerings - -Multiple types of Penetration Tests/Engagements fall within the expertise of Oneleet’s penetration testing team, some of them being: - -- Network Pentesting; -- Mobile App Pentesting; -- Web App Pentesting; -- Wireless Network Pentesting; -- Social Engineering Pentesting; -- Pentest Program Management; -- IoT Ecosystem Testing; -- Red Team Assessment; -- Digital Risk Assessment; -- Secure Code Review. +# Penetration Test Services At Oneleet, we offer **3** different types of Penetration Test packages. | Feature | Compliance | Comprehensive | Custom |-----|-----|-----|----- -| **Description** | A high-level assessment of your product, evaluating the effectiveness of your security measures in mitigating potential breaches for compliance purposes. | A thorough penetration test that examines all aspects of your application's attack surface to identify vulnerabilities across all categories. | A thorough penetration test that examines all aspects of your application's attack surface to identify vulnerabilities across all categories. +| **Description** | A high-level assessment of your application, evaluating the effectiveness of your security measures. | A penetration test that examines all aspects of your application's attack surface to identify vulnerabilities across all categories. | A penetration test that examines all aspects of your application's attack surface to identify vulnerabilities across all categories. | **Target** |Web Applications

Mobile Applications

APIs

| Web Applications

Mobile Applications

APIs

Networks

Cloud Assessmentss

Secure Code Reviews

Social Engineering

| Web Applications

Mobile Applications

APIs

Networks

Cloud Assessmentss

Secure Code Reviews

Social Engineering

Red Teaming

IoT Devices

| **Use cases** | Vulnerability testing of existing & new features. Often sufficient for early-stage companies going through SOC 2 | Vulnerability testing of existing & new features. Microservices testing. Testing based on several OWASP frameworks | Companies with multiple applications, red teaming, etc. | **Testers** | Manual test with a penetration tester that is at minimum OSCP & OSCE/OSWE certified | Manual test with a penetration tester that is at minimum OSCP & OSCE/OSWE certified | Manual test with a penetration tester that is at minimum OSCE/OSWE certified From 0560f5205a0f36543f5f9469350566757b4612fd Mon Sep 17 00:00:00 2001 From: AlexCulda Date: Thu, 5 Dec 2024 15:26:16 +0200 Subject: [PATCH 6/8] Pentesting areas transitioned to a table Together with Erik, we decided that the table looks better than the existing list, despite MD's annoying header-row formatting. --- pages/penetration-testing/services/areas.mdx | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-) diff --git a/pages/penetration-testing/services/areas.mdx b/pages/penetration-testing/services/areas.mdx index a89ee2e..5fcf74b 100644 --- a/pages/penetration-testing/services/areas.mdx +++ b/pages/penetration-testing/services/areas.mdx @@ -1,13 +1,7 @@ # Penetration Testing Areas -Multiple types of Penetration Tests/Engagements fall within the expertise of Oneleet’s penetration testing team, some of them being: -- Network Pentesting; -- Mobile App Pentesting; -- Web App Pentesting; -- Wireless Network Pentesting; -- Social Engineering Pentesting; -- Pentest Program Management; -- IoT Ecosystem Testing; -- Red Team Assessment; -- Digital Risk Assessment; -- Source Code Review. \ No newline at end of file +Multiple types of Penetration Tests/Engagements fall within the expertise of Oneleet’s penetration testing team. + +| Network Pentesting | Mobile App Pentesting | Web App Pentesting | Wireless Network Pentesting | Social Engineering Pentesting | +|---------------------------|-----------------------|--------------------------|-----------------------------|-------------------------------| +| Pentest Program Management | IoT Ecosystem Testing | Red Team Assessment | Digital Risk Assessment | Secure Code Review | \ No newline at end of file From 2f5ee5f51298a6a7a767efe0c731c69750131996 Mon Sep 17 00:00:00 2001 From: AlexCulda Date: Thu, 5 Dec 2024 17:08:30 +0200 Subject: [PATCH 7/8] Minor text adjustments Me & Erik talked about those. --- pages/penetration-testing/faq.mdx | 2 +- pages/penetration-testing/services/_meta.ts | 2 +- pages/penetration-testing/services/areas.mdx | 4 ++-- pages/penetration-testing/services/packages.mdx | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/pages/penetration-testing/faq.mdx b/pages/penetration-testing/faq.mdx index 93185ca..4ac1d37 100644 --- a/pages/penetration-testing/faq.mdx +++ b/pages/penetration-testing/faq.mdx @@ -8,7 +8,7 @@ No. At Oneleet, we recognize that such attacks increase the probability of opera Opt for a **White-box Pentration Test** if you're prepared to provide the source code and configuration files to the penetration tester, or if the application is open-source, as it effectively simulates threats that have or had access to the source code. Select a **Gray-box Penetration Test** for a best-of-both-worlds approach, as it allows the penetration tester to uncover most vulnerabilities accessible to both external and internal attackers. Choose a **Black-box Penetration Test** if your main concern is about external threat actors. -### Do I need to set up a staging environment, and where do you test? +### Do I need to set up a staging environment? We usually conduct tests in the staging environment and advise against testing in the production environment to minimize the risk of operational disruptions or collateral damage. Having said that, testing in staging is discouraged if it doesn’t accurately reflect the production environment or lacks representative data, as this will provide less value from a security perspective. diff --git a/pages/penetration-testing/services/_meta.ts b/pages/penetration-testing/services/_meta.ts index e966d3e..96fb541 100644 --- a/pages/penetration-testing/services/_meta.ts +++ b/pages/penetration-testing/services/_meta.ts @@ -1,4 +1,4 @@ export default { - "areas": "Pentesting Areas", + "areas": "Pentesting Engagements", "packages": "Pentesting Packages" } \ No newline at end of file diff --git a/pages/penetration-testing/services/areas.mdx b/pages/penetration-testing/services/areas.mdx index 5fcf74b..fcf63e4 100644 --- a/pages/penetration-testing/services/areas.mdx +++ b/pages/penetration-testing/services/areas.mdx @@ -1,6 +1,6 @@ -# Penetration Testing Areas +# Penetration Test Engagements -Multiple types of Penetration Tests/Engagements fall within the expertise of Oneleet’s penetration testing team. +Multiple types of Penetration Test engagements fall within the expertise of Oneleet’s penetration testing team. | Network Pentesting | Mobile App Pentesting | Web App Pentesting | Wireless Network Pentesting | Social Engineering Pentesting | |---------------------------|-----------------------|--------------------------|-----------------------------|-------------------------------| diff --git a/pages/penetration-testing/services/packages.mdx b/pages/penetration-testing/services/packages.mdx index dfa4bae..482f3a6 100644 --- a/pages/penetration-testing/services/packages.mdx +++ b/pages/penetration-testing/services/packages.mdx @@ -1,4 +1,4 @@ -# Penetration Test Services +# Penetration Test Packages At Oneleet, we offer **3** different types of Penetration Test packages. From 311d9e5d6954e6467e8e3b90a7372859b4868a06 Mon Sep 17 00:00:00 2001 From: Roman Scher Date: Fri, 6 Dec 2024 12:36:58 -0600 Subject: [PATCH 8/8] Improve phrasing and formatting --- pages/penetration-testing/final-report.mdx | 26 +++++++------- pages/penetration-testing/services/areas.mdx | 8 ++--- .../penetration-testing/services/packages.mdx | 34 +++++++++---------- 3 files changed, 34 insertions(+), 34 deletions(-) diff --git a/pages/penetration-testing/final-report.mdx b/pages/penetration-testing/final-report.mdx index 57f6146..3c05182 100644 --- a/pages/penetration-testing/final-report.mdx +++ b/pages/penetration-testing/final-report.mdx @@ -2,7 +2,7 @@ import { Callout } from "nextra/components"; # Penetration Test Report -The findings from our penetration test form the core of the report. Key elements include: +The findings from our penetration test form the core of the report you'll receive. Key elements include: - **Risk Assessment:** The overall risk of the vulnerability, categorized from Low to Critical based on its impact and probability. - **Vulnerability Description:** A comprehensive overview of each identified vulnerability, written in a clear and accessible manner for a broad audience. @@ -14,24 +14,24 @@ Before comprehending the remediation process for the vulnerabilities discovered ## Finding States -| Finding State | Description | -| ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| **Open** | The initial state of every vulnerability once it becomes visible to you. While it's open, you can transition to one of the other states. | -| **Ready for Review** | You mitigated the vulnerability that was ready for retesting. If the penetration tester couldn't reproduce the steps that led to the initial vulnerability, the finding is marked as resolved. However, if the penetration tester managed to reproduce the steps or discovered a similar way to find the vulnerability, the finding is marked as open. | -| **Risk Accepted** | You are prepared to accept the risk that comes with the vulnerability. | -| **Rejected/Closed** | If you deem it appropriate for any reason, the finding will be closed, and further discussions will be held. | +| Finding State | Description | +| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | +| **Open** | The initial state of every vulnerability once it becomes visible to you. While it's open, you can transition to one of the other states. | +| **Ready for Review** | You mitigated the vulnerability that was ready for retesting. If the penetration tester couldn't reproduce the steps that led to the initial vulnerability, the finding is marked as resolved. However, if the penetration tester managed to reproduce the steps or discovered a similar way to find the vulnerability, the finding is marked as open. | +| **Risk Accepted** | You are prepared to accept the risk that comes with the vulnerability. | +| **Rejected/Closed** | If you deem it appropriate for any reason, the finding will be closed, and further discussions will be held. | ## Finding Characteristics -| Characteristic | Description | -| -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -| **Probability** | The probability of the vulnerability being exploited. Three levels of probability: Low, Medium, or High, based on: Ease of vulnerability exploitation; Attack vectors; Business criticality of the affected asset; System and network complexity. | -| **Impact** | The severity of the vulnerability's effect. The impact of a vulnerability can range from little to no damage to system compromise. The impact can be at 3 levels Low, Medium or High. | +| Characteristic | Description | +| --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| **Probability** | The probability of the vulnerability being exploited. Three levels of probability: Low, Medium, or High, based on: Ease of vulnerability exploitation; Attack vectors; Business criticality of the affected asset; System and network complexity. | +| **Impact** | The severity of the vulnerability's effect. The impact of a vulnerability can range from little to no damage to system compromise. The impact can be at 3 levels Low, Medium or High. | ## Risk Levels -| Risk Level | Description | -| ------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| Risk Level | Description | +| ----------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Informational** | The discovery doesn't directly impact security. However, it could present an opportunity to enhance security, deviate from best practices, or make a security-relevant observation that may lead to exploitable vulnerabilities in the future. For instance, it could involve missing HTTP security headers or documentation that encourages poor security practices. | | **Low** | Low-risk vulnerabilities are more of a nuisance than a genuine threat. These vulnerabilities are usually those where exploitation wouldn't cause substantial damage, or where the likelihood of exploitation is very low. | | **Medium** | Medium-risk vulnerabilities are those that could potentially lead to damage if exploited, or where the likelihood of exploitation is moderate. | diff --git a/pages/penetration-testing/services/areas.mdx b/pages/penetration-testing/services/areas.mdx index fcf63e4..dd88563 100644 --- a/pages/penetration-testing/services/areas.mdx +++ b/pages/penetration-testing/services/areas.mdx @@ -1,7 +1,7 @@ # Penetration Test Engagements -Multiple types of Penetration Test engagements fall within the expertise of Oneleet’s penetration testing team. +Oneleet’s penetration testing team specializes in several types of engagements, including: -| Network Pentesting | Mobile App Pentesting | Web App Pentesting | Wireless Network Pentesting | Social Engineering Pentesting | -|---------------------------|-----------------------|--------------------------|-----------------------------|-------------------------------| -| Pentest Program Management | IoT Ecosystem Testing | Red Team Assessment | Digital Risk Assessment | Secure Code Review | \ No newline at end of file +| Network Pentesting | Mobile App Pentesting | Web App Pentesting | Wireless Network Pentesting | Social Engineering Pentesting | +| :-----------------------------------------------------------------: | :------------------------------------------------------------: | :----------------------------------------------------------: | :--------------------------------------------------------------: | :---------------------------------------------------------: | +| Pentest Program Management | IoT Ecosystem Testing | Red Team Assessment | Digital Risk Assessment | Secure Code Review | diff --git a/pages/penetration-testing/services/packages.mdx b/pages/penetration-testing/services/packages.mdx index 482f3a6..7793e29 100644 --- a/pages/penetration-testing/services/packages.mdx +++ b/pages/penetration-testing/services/packages.mdx @@ -1,20 +1,20 @@ # Penetration Test Packages -At Oneleet, we offer **3** different types of Penetration Test packages. +At Oneleet, we offer **3** different types of penetration test packages. -| Feature | Compliance | Comprehensive | Custom -|-----|-----|-----|----- -| **Description** | A high-level assessment of your application, evaluating the effectiveness of your security measures. | A penetration test that examines all aspects of your application's attack surface to identify vulnerabilities across all categories. | A penetration test that examines all aspects of your application's attack surface to identify vulnerabilities across all categories. -| **Target** |Web Applications

Mobile Applications

APIs

| Web Applications

Mobile Applications

APIs

Networks

Cloud Assessmentss

Secure Code Reviews

Social Engineering

| Web Applications

Mobile Applications

APIs

Networks

Cloud Assessmentss

Secure Code Reviews

Social Engineering

Red Teaming

IoT Devices

-| **Use cases** | Vulnerability testing of existing & new features. Often sufficient for early-stage companies going through SOC 2 | Vulnerability testing of existing & new features. Microservices testing. Testing based on several OWASP frameworks | Companies with multiple applications, red teaming, etc. -| **Testers** | Manual test with a penetration tester that is at minimum OSCP & OSCE/OSWE certified | Manual test with a penetration tester that is at minimum OSCP & OSCE/OSWE certified | Manual test with a penetration tester that is at minimum OSCE/OSWE certified -| **Customizable Report** | Not Included | Included | Included -| **Support** | Answer within 48H | Dedicated point of contact that answers within 24H | Dedicated point of contact that answers within 24H -| **Free Retesting** | 12 months | 12 months | 12 months -| **Rush delivery** | Optional | Optional | Included -| **Letter of Engagement** | Included | Included | Included -| **Letter of Attestation** | Included | Included | Included -| **Customized Letters** | Not included | Included | Included -| **Onboarding Support** | Slack | Slack & Live | Slack & Live -| **Dedicated Customer Success Manager** | Not included | Included | Included -| **Used Standards** | Pentest conducted in accordance with industry-standard methodologies such as OWASP Top-10 | Pentest conducted in accordance with industry-standard methodologies such as OWASP WSTG, OWASP ASVS, etc. | Pentest conducted in accordance with industry-standard methodologies such as OWASP WSTG, OWASP ASVS, etc. | +| Feature | Compliance | Comprehensive | Custom | +| -------------------------------------- | ---------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| **Description** | A high-level assessment of your application, evaluating the effectiveness of your security measures. | A penetration test that examines all aspects of your application's attack surface to identify vulnerabilities across all categories. | A penetration test that examines all aspects of your application's attack surface to identify vulnerabilities across all categories. | +| **Target** | Web Applications

Mobile Applications

APIs

| Web Applications

Mobile Applications

APIs

Networks

Cloud Assessmentss

Secure Code Reviews

Social Engineering

| Web Applications

Mobile Applications

APIs

Networks

Cloud Assessmentss

Secure Code Reviews

Social Engineering

Red Teaming

IoT Devices

| +| **Use cases** | Vulnerability testing of existing & new features. Often sufficient for early-stage companies going through SOC 2 | Vulnerability testing of existing & new features. Microservices testing. Testing based on several OWASP frameworks | Companies with multiple applications, red teaming, etc. | +| **Testers** | Manual test with a penetration tester that is at minimum OSCP & OSCE/OSWE certified | Manual test with a penetration tester that is at minimum OSCP & OSCE/OSWE certified | Manual test with a penetration tester that is at minimum OSCE/OSWE certified | +| **Customizable Report** | Not Included | Included | Included | +| **Support** | Answer within 48H | Dedicated point of contact that answers within 24H | Dedicated point of contact that answers within 24H | +| **Free Retesting** | 12 months | 12 months | 12 months | +| **Rush delivery** | Optional | Optional | Included | +| **Letter of Engagement** | Included | Included | Included | +| **Letter of Attestation** | Included | Included | Included | +| **Customized Letters** | Not included | Included | Included | +| **Onboarding Support** | Slack | Slack & Live | Slack & Live | +| **Dedicated Customer Success Manager** | Not included | Included | Included | +| **Used Standards** | Pentest conducted in accordance with industry-standard methodologies such as OWASP Top-10 | Pentest conducted in accordance with industry-standard methodologies such as OWASP WSTG, OWASP ASVS, etc. | Pentest conducted in accordance with industry-standard methodologies such as OWASP WSTG, OWASP ASVS, etc. |