Real World Testing

We look at your business like your real adversaries would. They won't go easy and we won't either.

Penetration Testing

Our specialist offensive testing services include an extensive range of penetration testing capabilities at the application, network, and physical level.

  • Red Team Engagements
  • Web Application and API
  • External, Internal, and Wireless Networks
  • Host and SOE
  • Cloud Environments
  • Mobile Applications
  • Bespoke Systems and Applications

Security Review

Complementing our Penetration Testing we also perform network architecture and application review services. Helping your business achieve best practice design and secure-by-default approaches to your infrastructure.

  • Network Architecture Review
  • Application Architecture Review
  • Source Code Review

Security Incidents

For when things go wrong, our experienced and qualified team will help with getting you back on track. The time immediately after a security incident is make or break, and the right choices are critical.

  • Incident Response
  • Forensic Investigations (GIAC Certified Forensic Analysts)

Featured Releases

Article

Application Security Automation - Three Dev Cycle Quick Wins

by Denis Andzakovic • May 15 2019

I recently had the chance to set up a few security automation bits and pieces, and figured I’d go ahead and detail some of my thoughts on a few quick wins. We’ll look at assigning code owners for security sensitive source code, extending linters to keep bugs from re-appearing in the future and automating alerting on third party library vulnerabilities. These techniques give a low-false-positive rate, and provide a simpler way to get started with security automation rather than attempting to cobble together full-fat static and dynamic security analysis right off the bat.

Advisory

atftpd - Multiple Memory Corruption Vulnerabilities (CVE-2019-11365, CVE-2019-11366)

by Denis Andzakovic • Apr 17 2019

atftpd contained multiple vulnerabilities, including stack buffer overflow, concurrency issues and heap-based read overflow.

read more
Article

Extracting BitLocker keys from a TPM

by Denis Andzakovic • Mar 13 2019

By default, Microsoft BitLocker protected OS drives can be accessed by sniffing the LPC bus, retrieving the volume master key when it’s returned by the TPM, and using the retrieved VMK to decrypt the protected drive. This post will look at extracting the clear-text key from a TPM chip by sniffing the LPC bus, either with a logic analyzer or a cheap FPGA board. This post demonstrates the attack against an HP laptop logic board using a TPM1.2 chip and a Surface Pro 3 using a TPM2.0 chip. From bus wiring through to volume decryption. Source code included.

Get in touch

Interested in working with us?

+64 4 889 4756