Skip to content
ZeroDayLabs

Services

Pentests, scoped to what you need.

Choose what needs testing. Each engagement is scoped individually, tested by hand, and closed with a retest.

Service

Web application

Manual testing of the logic, roles and data flows behind your application, where automated scanners stop being useful.

View scope
Service

API

REST and GraphQL testing focused on authorization, the most common place for an API to give away more than it should.

View scope

Included

What every engagement includes.

  1. 01

    Executive summary

    Overall risk and priorities in plain language, for people who will not read the technical detail.

  2. 02

    Technical findings

    Severity, affected component, business impact, evidence, steps to reproduce and a specific fix for each issue.

  3. 03

    Early notice

    Critical issues are shared as soon as they are confirmed, without waiting for the final report.

  4. 04

    One round of retesting

    After your fixes, each finding is tested again and its status is updated in the report.

  5. 05

    Attestation letter

    A short letter stating what was tested and when, which you can share with customers or auditors.

Process

Five steps, agreed in advance.

Full process
  1. 1ScopeYou describe what to test. Targets, roles and timing are agreed, and you receive a written quote.
  2. 2AuthorizeThe system’s owner signs written authorization and rules of engagement. Testing does not begin without them.
  3. 3TestHands-on testing inside the agreed window. A critical issue is reported as soon as it is confirmed.
  4. 4ReportEvery finding comes with severity, business impact, evidence and a specific fix.
  5. 5RetestOnce you have fixed the issues, they are tested again and the report is updated with the results.

Find it before someone else does.

Tell ZeroDay Labs what you need tested. You will get a clear scope and a written quote before any work begins.

Request a pentest