# Penetration Testing — geearr

> A penetration test is a time-boxed, hands-on attack on your systems by a human tester, with permission, to find and prove exploitable weaknesses before a real attacker does. geearr tests web apps, APIs, external perimeter and cloud, and every finding ships with evidence, a fix and a retest.

**Penetration testing that finds what scanners miss.**

Automated scanners find the obvious. Real attackers chain small weaknesses — a verbose error, a predictable ID, a forgotten staging host — into a breach. A geearr penetration test is hands-on: map the real attack surface, think like an adversary, and prove impact with safe, controlled exploitation so you fix what actually matters.

## What gets tested

### Web applications

- Authentication, session & MFA bypass
- Broken access control / IDOR
- Injection: SQL, NoSQL, command, template
- XSS, CSRF, SSRF & request smuggling
- Business-logic abuse & race conditions

### APIs & mobile backends

- REST, GraphQL & gRPC
- OWASP API Top 10: BOLA, BFLA, mass assignment
- OAuth 2.0 / OIDC & JWT handling
- Rate limiting & resource exhaustion
- Webhook & integration trust boundaries

### External perimeter & cloud

- Attack-surface & subdomain discovery
- Exposed services, admin panels & storage
- TLS, DNS & subdomain takeover
- Cloud metadata & IAM escalation paths
- Secrets in repos, builds and buckets

## What you get

1. Executive summary written for leadership, auditors and insurers
2. Technical findings with CVSS scoring, evidence and reproduction steps
3. Prioritized remediation guidance mapped to your stack
4. Live readout with your engineering team
5. Retest of fixed findings and an updated attestation letter

## Standards

OWASP WSTG · OWASP ASVS · OWASP API Security Top 10 · PTES · NIST SP 800-115 · CVSS v4.0

## FAQ

### What is the difference between a vulnerability scan and a penetration test?

A vulnerability scan is automated: it matches software versions and configurations against known issues and produces a long, noisy list. A penetration test is performed by a human who validates findings, chains weaknesses together, tests business logic, and demonstrates real impact. Scans are useful hygiene; a pen test tells you what an attacker could actually do.

### How long does a penetration test take?

Most web application or API penetration tests take one to three weeks of testing depending on the number of user roles, endpoints and integrations in scope, followed by reporting and a readout. A focused external perimeter test can be shorter. Scope and timeline are agreed during a free scoping call.

### Is penetration testing safe to run against production?

Yes, when it is scoped properly. Testing follows agreed rules of engagement, avoids destructive payloads and denial-of-service, uses dedicated test accounts, and coordinates timing with your team. A production-equivalent staging environment is an equally valid target.

## Related

- Guide: [Penetration test vs. vulnerability scan: what’s the difference?](https://geearr.com/guides/pentest-vs-vulnerability-scan)
- Glossary: [Attack surface](https://geearr.com/glossary#attack-surface)
- Glossary: [Penetration test](https://geearr.com/glossary#penetration-test)
- Glossary: [Vulnerability scan](https://geearr.com/glossary#vulnerability-scan)
- Glossary: [CVSS](https://geearr.com/glossary#cvss)
- Glossary: [BOLA / IDOR](https://geearr.com/glossary#bola)
- Glossary: [SSRF](https://geearr.com/glossary#ssrf)

## Contact

- Email: george@georgerios.com
- Book a free 30-minute scoping call: https://cal.com/georgerios/30min
- LinkedIn: https://linkedin.georgerios.com
- X: https://x.com/riosgeorge

---
Canonical: https://geearr.com/services/penetration-testing · Updated: 2026-10-12 · Site index for LLMs: https://geearr.com/llms.txt