Web and API pentesting
Assessment of authentication, authorization, sessions, inputs and business logic across agreed assets.
Offensive security / CAIM
C.A.I.M.Reveal exposure.Inform decisions.
CAIM is the identity of EWQS’s offensive practice. Technical assessments to understand attack paths, verify controls and turn evidence into remediation priorities.
CAIM / RED TEAM
What the engagement covers
Depth matched to your environment, with useful priorities for decision-makers and implementers.
Scoped Red Team exercises
Objective-led scenarios with defined rules of engagement, operational boundaries and authorization.
Exposure and configuration
Review of reachable surfaces, configurations and dependencies, distinguishing signals from verified vulnerabilities.
Evidence triage
Technical review of signals, controlled reproduction where permitted and documentation of uncertainty and limitations.
Executive and technical reporting
Contextual impact, handled evidence, practical recommendations and priorities discussed with your team.
Remediation retesting
Verification of scoped fixes within the contracted engagement, recording results and residual risk.
From hypothesis to validated control
A context handover between offensive assessment and defensive improvement, with technical review and human accountability.
Define
Agree on scope, rules of engagement and business objectives.
Assess
Test hypotheses and review evidence with explicit limitations.
Remediate
Prioritize controls, owners and acceptance criteria.
Retest
Verify scoped fixes and record residual risk.
The offensive perspective
From scenario to recommendation
Offensive findings inform defensive improvements. Defensive evidence refines the next assessment.
TEACHING EXAMPLES · NO REAL DATA
Examples of how deliverables can be structured, using fictional information and no customer data. Findings for each engagement depend on the assessed environment and contracted scope.
Critical, High, Medium and Low are illustrative classifications for these scenarios. CVSS v4.0 requires an evidence-based vector and technical, threat and environmental context; business priority must also be assessed. No scores are calculated in these examples.
CriticalCAIM / EX-01 / CWE-862
Administrative operation without authorization
TEACHING EXAMPLES · NO REAL DATA
- Precondition
- Authenticated standard account; an administrative API operation is reachable; the server does not verify privileges.
- Synthetic evidence — simulation
SIMULATION · test account: operator POST /api/demo/admin/roles → 200 Fictional result: administrative privilege granted.
- Business scenario
- In this scenario, a low-privilege account could take over administrative functions and change controls protecting business operations.
- Recommendation
- Enforce server-side authorization for every sensitive operation, deny by default and validate role, resource and action. Audit privilege changes.
HighCAIM / EX-02 / CWE-639
Access to another account’s object
TEACHING EXAMPLES · NO REAL DATA
- Precondition
- Two test accounts with separate resources; the API accepts an object identifier without checking ownership or organization.
- Synthetic evidence — simulation
SIMULATION · session: account A GET /api/demo/documents/doc-B → 200 Fictional body: a document belonging to account B.
- Business scenario
- Account isolation would fail, allowing unauthorized document access and disclosure of business information in the proposed scenario.
- Recommendation
- Enforce object-level authorization on the server and scope queries to the user and organization. Unpredictable identifiers do not replace authorization.
MediumCAIM / EX-03 / CWE-614
Session cookie missing the Secure attribute
TEACHING EXAMPLES · NO REAL DATA
- Precondition
- Active session; cookie without Secure; HTTP access to the same host is possible before a secure redirect, without effective HSTS protection.
- Synthetic evidence — simulation
SIMULATION · fictional header Set-Cookie: demo_session=REDACTED; HttpOnly; SameSite=Lax Observation: Secure attribute missing.
- Business scenario
- On an adversarial network, sending a session over HTTP could compromise an account. Feasibility depends on transport and effective protections.
- Recommendation
- Set Secure on session cookies, retain HttpOnly and choose SameSite for the workflow. Review HTTPS, proxy settings and HSTS adoption after assessing subdomains.
LowCAIM / EX-04 / CWE-200
Detailed version in a public response
TEACHING EXAMPLES · NO REAL DATA
- Precondition
- A public response header discloses the product and exact version; no exploitable vulnerability is demonstrated in this example.
- Synthetic evidence — simulation
SIMULATION · fictional response GET /demo → 200 Server: DemoServer/1.2.3 (example only)
- Business scenario
- This information would assist technology reconnaissance. By itself, it does not demonstrate compromise or justify a higher severity.
- Recommendation
- Reduce production banners and detailed messages. Maintain a private inventory and update process; hiding versions does not fix vulnerable dependencies.
EWQS / DELIVERABLES
A deliverable for decisions. Another for implementation.
The executive summary explains exposure and impact. Technical material records scope, evidence, limitations, recommendations and validation conditions.
- Executive summary and contextual prioritization
- Technical record with handled evidence and limitations
- Remediation plan with owners to be agreed
- Retest and residual-risk record, when contracted
Start with the right scope.
Tell us which applications, controls or objectives need assessment. The proposal defines depth, deliverables and execution conditions.