NeoBit/ Pen Testing
Offensive security

Penetration testing

Advanced penetration tests find vulnerabilities in your systems and applications before hackers do - and enable timely fixes and changes so that attackers cannot bring down your business. After the test you get a clear picture of the risk and concrete steps toward greater security.

Web applications Mobile applications Infrastructure Internal network APIs and services
Penetration testing (pentest) for companies in BiH | NeoBit offensive team Ethical, controlled attack
Black · Grey · White
All types of testing
2 reports
Executive and technical
OWASP
Recognized methodologies
Re-test
Verification after fixes
How we work

From agreement to re-verification

A structured, transparent process following recognized methodologies (OWASP, PTES) - no surprises and no risk to your business.

01 · Scope and agreement

We define the targets, type of access and rules - written authorization and clear boundaries for the test.

02 · Reconnaissance and mapping

We gather information and map the attack surface - all entry points and weaknesses.

03 · Exploitation

We exploit vulnerabilities in a controlled and safe way to prove the real impact on your business.

04 · Report and re-test

We deliver a report with priorities and fixes, then re-verify that everything has been resolved.

What we check

We cover the entire attack surface

From web applications following the OWASP methodology to infrastructure, access rights and the cloud - these are the areas included in the test, depending on the agreed scope.

Web applications (OWASP Top 10)

  • Injection - SQL, NoSQL, command, LDAP
  • Broken access control and privileges (IDOR)
  • Authentication and session management
  • Cross-Site Scripting (XSS) and CSRF
  • Security misconfiguration
  • Cryptographic failures and sensitive data
  • SSRF and vulnerable components
  • Business logic flaws

API testing

  • REST and GraphQL endpoints
  • Authorization (BOLA / object-level privileges)
  • Excessive data exposure
  • Mass assignment and input validation
  • Rate limiting and resource abuse
  • Token security (JWT, OAuth)

Infrastructure and network

  • External and internal perimeter
  • Open ports and exposed services
  • Unpatched vulnerabilities (patch level)
  • Segmentation and lateral movement
  • VPN, RDP and remote access
  • Default and weak passwords

Active Directory and access rights

  • Privilege escalation
  • Principle of least privilege
  • Poor ACLs and Kerberos attacks
  • Segregation of duties
  • Review of administrator accounts and groups

Cloud and configuration

  • Microsoft 365, Azure and AWS settings
  • IAM, roles and access rights
  • Publicly exposed storage (buckets)
  • Security groups and firewall rules
  • Hardening per CIS recommendations
  • Logging, monitoring and backups

Mobile applications

  • Secure data storage on the device
  • Communication protection (TLS, pinning)
  • Resistance to reverse engineering
  • Backend API security
  • Permissions and data leakage
Types of testing

A penetration test tailored to your industry and business

Black box

Without any information or access - we look at your system through the eyes of an external attacker.

Grey box

With a user account and partial information - simulating an attack from the inside or from a compromised user.

White box / Internal

Full insight and access from the internal network - the most thorough check of all layers.

Reports

Clear for management, precise for the team

Every test ends with two reports - one for decision-makers, the other for those who do the fixing.

Executive summary

An overview of the risk in business language - risk level, potential impact and recommendations, without technical jargon. Ideal for management and decisions about investing in security.

Detailed technical report

Every vulnerability with proof (PoC), reproduction steps, a severity rating (CVSS) and concrete remediation guidance - everything your team needs to resolve the issue quickly.

Request a pen test

Tell us what we are testing

Fill in the basic details about the scope - we will get back to you with a proposal, timeline and quote. Simple and with no obligation.

We respond within 24 hours · No obligation · Your data remains confidential