Web
We test business logic: prices, coupons, permissions and sessions. The things a scanner doesn’t understand.
See serviceWe hack you before they do.
Web, API and mobile pentesting under written authorisation. Every finding comes with the full path: how we got in, what we reached and what to fix first.
Hackers picked for your system
We build the team around what needs testing: web, mobile or infrastructure. A person confirms every finding before it reaches your report.
Certifications
- CPTS
- OSCP
- OSED
Methodology
OWASP ASVS · PTES · NIST SP 800-115
Included
- Fix retesting
- NDA before data
- Quote within 48h
For your audit
A report and attestation letter your auditors and customers accept for SOC 2, ISO 27001 and vendor security reviews.
How someone would get in, step by step
Breach Path links findings into routes: where someone gets in, what they reach and which step breaks the chain. Try the demo.
PATH 01
OPEN PATHExposed panel
STEP 01 / 04
Forgotten subdomain
staging.acme.example, no owner.
STEP 02 / 04
Exposed admin panel
reachable without VPN.
STEP 03 / 04
Default credentials
never changed after deploy.
STEP 04 / 04
Customer data access
full export possible.
WHAT TO FIX FIRST
Take staging.acme.example off the internet and rotate the default credentials.
PATH 02
OPEN PATHLeaked token
STEP 01 / 03
Employee public repo
linked from their profile.
STEP 02 / 03
API token in git history
old commit, never rotated.
STEP 03 / 03
Cloud storage access
backup bucket.
WHAT TO FIX FIRST
Revoke the leaked token and purge the secret from the repo history.
PATH 03
OPEN PATHReused credentials
STEP 01 / 03
Credentials in a third-party breach
from an unrelated service.
STEP 02 / 03
Reused on remote access
same password, no second factor.
STEP 03 / 03
Foothold on the internal network
from outside, as an employee.
WHAT TO FIX FIRST
Force a reset on the reused passwords and require a second factor on remote access.
Explore the steps. See where to break the chain.acme.example
Open full demo Short film · Fictional scenario and data.
Watch a 3-minute scenario
What we test
We set the scope with you. Every finding is reproducible, and once you fix it we test it again.
APIs
We change one number in the request and see whether the API hands over another customer’s data.
EnquireMobile apps
We intercept your Android and iOS app traffic, bypass pinning and check what it stores on the device.
See serviceWindows desktop apps
Thick clients: DLLs loaded from the wrong place, passwords inside the installer and unencrypted traffic.
EnquireBinary exploitation
From a crash to control of the program: overflows, ROP and how DEP and ASLR get bypassed in your software.
EnquireAI and LLMs
Prompt injection, data leaks and agents that do more than they should.
EnquireActive Directory
From an unprivileged user to Domain Admin, with every step of the path documented.
EnquireCloud
Open buckets, keys left in repositories and roles with more permissions than they need.
EnquireContinuous 30 / 60 / 90
Your perimeter changes every week. We watch it and tell you what’s new before someone else finds it.
See the modeOur research
We publish browser and mobile security research, with the methodology and evidence so anyone can check it.
Explore researchContinuous Offensive Assessment
A 30, 60 or 90-day window: we watch what changes on your perimeter and tell you before someone else takes advantage of it.
- 30 days
Baseline
We map your external surface and set the starting point. You know exactly what you expose today.
- 60 days
What changed
We compare against the baseline and show you what is new, what reopened and what is already fixed.
- 90 days
Continuous validation
We retest earlier findings and only close the ones we confirm are fixed.
What we watch in the window
- New subdomains
- Patch diffs
- Exposed services
- Leaked credentials
- Repos
- Apps
- APIs
With or without AI, your call
In both modes, a person validates every finding.
Hybrid AI
AI to correlate information and prioritise review. Our hackers test and validate every finding.
Data and models agreed before the project starts.
AI-less
Reconnaissance, testing and analysis without AI models. For projects that need to exclude AI throughout the engagement.
Conventional tools. No AI models.
Based in Mexico, working across four regions
All remote: Mexico, the United States, Europe and India.
- Mexico
- United States
- Europe
- India / Bengaluru
Remote coverage · Illustrative routes
Tell us what you want tested
We reply with a proposed scope and working mode.
Or write to us directlysales@knullcorp.com
We reply with a proposed scope and working mode.
sales@knullcorp.comWhat do I receive?
Findings with evidence, impact, reproduction steps and prioritised fixes. Includes retesting and a session with your team.
How does the project start?
We agree on assets, testing windows, data handling and a technical contact. Testing starts with written authorisation.
Can we sign an NDA?
Yes. We sign a confidentiality agreement before exchanging sensitive technical information.