Skip to content
HackIT
Talk to a tester

Senior-Only Web and Mobile Penetration Testing.

We don't sell you hours. We find what actually breaks.

Talk to a tester
>_ finding HK-07Report
CriticalCVSS 9.1CWE-640

Account takeover via reusable password-reset token

app.example.com

>_ evidenceHTTP
POST /api/auth/reset HTTP/1.1Host: app.example.com{"token":"7f3c9a0e…e21b","password":"********"}HTTP/1.1 200 OK{"status":"password_updated"}# same token, first used 9 days earlier
Impact
Reset links never expire and stay valid after use. Anyone who later sees one, in a forwarded email or a proxy log, can take over the account.
Fix
Make reset tokens single-use with a short expiry, and revoke open tokens and sessions when the password changes.
StatusClosed on retest
Every finding in your report is written up like this, with evidence attached, and retested once your fix ships.

What We Do

Web and mobile penetration testing against the OWASP standard built for each, as a compliance audit or a real-world attack simulation, plus training and advice from the same senior team.

>_ webOWASP ASVS 5.0

Web Application Penetration Testing

Why test
Scans miss flaws in how your app behaves.
When
Before launch, after big changes, and at least yearly.

Your web application and its APIs, tested by hand against OWASP ASVS 5.0.

17 chapters · ~350 requirements

See the full scope
>_ mobileOWASP MASVS 2.1

Mobile Application Penetration Testing

Why test
Anyone can unpack your app and read what’s inside.
When
Before launch, after big changes, and at least yearly.

Your mobile application, from on-device storage to network traffic, tested by hand against OWASP MASVS 2.1.

8 control groups · 24 controls

See the full scope
>_ consulting4 offerings

Security Consulting and Training

AwarenessSecure CodingPhishingAdvisory

Training, exercises and advice from the same senior team that tests your applications.

Training · exercises · advice

See what we offer

How an Engagement Runs

The same five steps for both engagements, and you deal with the tester at every one.

  1. 01

    Inquiry

    You send a message, by the form or by email. It goes straight to the tester, not to a sales team.

  2. 02

    Scope Call

    A call with the tester to agree targets, timelines and rules of engagement.

  3. 03

    Test

    Manual, senior-only testing: full ASVS and MASVS coverage, or real attack paths.

  4. 04

    Report and Debrief

    Evidence, reproduction steps, severity and fixes per finding. We walk you through every one.

  5. 05

    Retest

    Included, not upsold. Once fixes ship, we verify each finding is actually closed.

Why HackIT

  • Senior-Only

    Founders do the work. No work is handed to juniors. Ever. GIAC GWAPT, GCFA and GCLD, and TCM Security PMPA certified.

  • No Sales Layer

    You speak directly to the tester. No account managers, no upsell pressure, no padding.

  • Proven Track Record

    Years of hands-on offensive security work behind every engagement: real, repeatable results, not theory or a template report.

  • Manual, Not Scanned

    Real attack patterns and manual exploitation. You will never receive an automated scan dump.

  • OWASP ASVS and MASVS

    Web testing mapped to OWASP ASVS 5.0 and mobile testing to OWASP MASVS 2.1, the current versions. Transparent and recognised.

  • Straight Talk

    No inflated findings. No minor items dressed up as critical. Honest risk ratings only.

  • Retest Included

    Once fixes ship, we verify each finding is actually closed. Included in every engagement, never a paid add-on.

  • ~40% Below Market Price

    No sales team, no account managers, no overhead layers to fund. Senior testing at nearly 40% below market price, scoped to exactly what you need: nothing padded.

  • Retainer Discounts

    Repeat clients get better rates. Security is ongoing, and we price accordingly.

Industries Served

  • Banking
  • Insurance
  • Healthcare
  • Telecommunications
  • Retail
  • Data centers
  • Public sector
  • Digital identity
  • Crypto-asset marketplaces
  • B2B negotiation software
  • Gambling

The Experience Behind Every Test

Founders do the work, with years of hands-on offensive security behind every engagement.

Years of experience
6+
Hours of offensive security
5,000+
Projects completed
~100

Certified

  • GIAC

    GWAPT

    Web Application Penetration Tester

  • GIAC

    GCFA

    Certified Forensic Analyst

  • GIAC

    GCLD

    Cloud Security Essentials

  • TCM Security

    PMPA

    Practical Mobile Pentest Associate

Common Questions

Something else? Ask the tester directly at contact@hackit.ee.

Which engagement should we choose?

If you need a penetration test as evidence for SOC 2, ISO 27001 or PCI DSS, or a complete baseline, choose the compliance audit. If you want to know what an attacker could actually do, choose the attack simulation. Not sure? Tell us why you are testing and we will say which fits.

Who actually does the testing?

The founders. HackIT is senior-only: no work is handed to juniors. Our certifications include GIAC GWAPT, GCFA and GCLD, and TCM Security PMPA.

Do you just run automated scanners?

No. Testing is manual and led by a senior tester. You will not receive an automated scan dump.

What do we get at the end?

A PDF report with an executive summary and technical detail for every finding: evidence, reproduction steps, severity rating and fix guidance. We then walk you through it in a debrief.

Is a retest included?

Yes, in every engagement. Once your fixes ship, we verify each finding is actually closed.

Can the report be used as audit evidence?

The compliance audit is built for it: findings are mapped to OWASP ASVS and MASVS, and the report is ready to present to auditors for SOC 2, ISO 27001 and PCI DSS.

Ready to Test What Actually Matters?

Tell us what you want tested. No sales call: your message goes to the tester, who replies to scope the work with you.

Prefer email?
contact@hackit.ee
Engagement (optional)

How we handle this: privacy policy