What we test

Fifteen ways in.
We check all of them.

Every engagement — regardless of tier — is tested against the same fifteen categories. Grouped below by what they let an attacker actually do.

Injection & execution

Attacks that get the target system to run code or logic it never should have.

  • Remote code executionOP-01
  • Local code executionOP-02
  • Local file inclusionOP-03
  • Cross-site scripting (XSS)OP-04
  • SQL injection & other injection attacksOP-05

Identity & access

Attacks that let someone act as a user they aren't, or do more than their role allows.

  • Broken authenticationOP-06
  • Cross-account accessibilityOP-07
  • Privilege escalationOP-08
  • Cross-site request forgery (CSRF)OP-09

Infrastructure & exposure

Weaknesses in what's exposed at the edge of your infrastructure, not just inside your application.

  • Server-side request forgery (SSRF)OP-10
  • Exposed secretsOP-11
  • Dangling DNSOP-12
  • Subdomain / domain takeoverOP-13
  • Unrestricted file upload → reverse shellOP-14

Data exposure

Whether personal data is reachable by anyone who shouldn't have it.

  • Leaked personal information & PIIOP-15

A finding isn't a finding until we've proven it

Automated tools flag matches, not vulnerabilities — and a raw match list is full of noise: paths that don't actually exist, logins that don't actually work, patterns that look dangerous but aren't reachable.

Every category above is checked by a person, not just a scanner. Where Hiraya surfaces a candidate, a tester confirms it's real — reproduces it, checks the impact, and only then writes it into your report. If we can't prove it, it doesn't ship as a finding; it goes in a separate notes section marked as unconfirmed, so you can see exactly what we did and didn't verify.

Why we built it this way

See this run against your own systems

Pick a tier, tell us your scope, and we'll schedule the engagement.

See pricing