Porão Security

Porão Security / Pentest

It doesn't flag the flaw.
It proves what it
does to you.

We simulate real attacks against your systems and demonstrate, with evidence, what an adversary could actually do — access, data, money. Impact, not a list of CVEs.

Request a pentest What we test
Surfaces Web API Mobile Internal network

Example findingTechnical report

PS-EX-014 Critical CVSS 9.1

Unvalidated upload leads to RCE

Asset
app.example.com — /perfil/avatar
Impact
Remote code execution on the application server; access to the database and to other services' credentials.
Fix
Validate the real file type, serve outside the webroot and remove execute permission.
# sends a webshell disguised as an image
POST /perfil/avatar HTTP/2
Content-Type: image/png; name="x.php"

HTTP/2 200 OK
# and then, on the server:
GET /uploads/x.php?cmd=id → uid=33(www-data)
Severity 9.1 / 10
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HRetest: fixed ✓

Illustrative example. All testing runs against authorized scope.

01 / Why a pentest

Automation finds the obvious. The rest takes a human.

Scanners cover volume, but they don't understand your business. The flaws that actually take companies down live exactly where automation can't reach.

Scanner misses it

Business logic

Buying at a negative price, skipping the payment step, approving your own order. No signature catches this.

Scanner misses it

Chaining flaws

Three isolated "mediums" that, together, become full compromise. The impact only shows when someone connects the dots.

Scanner misses it

Authorization bypass

Reaching another customer's resource by changing an ID (IDOR/BOLA). To the tool, it's just a 200 OK.

02 / What we test

Every surface, in depth.

Manual exploitation on every layer — the operator proves what matters, not just what shows up.

01

Web Pentest

OWASP Top 10, logic flaws and access-control bypass in web applications.

02

API Pentest

REST and GraphQL focused on authentication, authorization (BOLA/IDOR) and function abuse.

03

Mobile Pentest

Dynamic and static analysis of Android and iOS apps and their backing APIs.

04

Internal Pentest

Internal networks, Active Directory, privilege escalation and lateral movement.

03 / Methodology

Recognized references, not improvisation.

Established standards as the baseline, adapted to each client's context — and a retest always included.

Standard

OWASP Testing Guide

Standard

PTES

Standard

NIST SP 800-115

Reference

MITRE ATT&CK

04 / Team

The people who run the tests.

Offensive operators with real-world experience — the same people who sign the report.

Bruno Imperador

Bruno Imperador

Pentester & Red Team Operator

WebAPIMobileCloudInternal Network
Diogo Scrivano

Diogo Scrivano

Pentester & Red Team Tool Developer

WebAPICloudInternal NetworkBusiness Logic

05 / FAQ

Frequently asked questions

Have a specific question? Our team is ready to help.

Entre em contato
It depends on scope. A web pentest of a mid-sized application takes 5 to 10 business days. Internal networks or broader projects can take 2 to 4 weeks. The timeline is agreed during initial scoping.
Not necessarily. We work with a controlled approach and a non-destructive guard; when needed, we agree on maintenance windows. Production testing is carried out carefully to avoid impacting services.
Both. The technical report details each vulnerability with evidence, CVSS and reproduction steps. The executive report presents risk clearly for managers and leadership.
With proof discipline. Every confirmation requires a signal only the target could produce; what we cannot confirm is recorded as inconclusive, never as a finding. Payload reflection is not evidence.
Yes. Retesting of critical and high findings is included in scope to validate fixes before we close the engagement.

Next step

See what an
attacker already sees.

Most breaches don't start with malware, but with a neglected vulnerability. Tell us your scenario and we'll reply within 1 business day.

Talk to a specialist