1. The preliminary audit automatically analyzes the following aspects of your service:
- Timing and performance: network latency, processing time, and total time.
- Domain Name System (DNS): DNSSEC, DMARC, SPF, and CAA.
- Connectivity and network versions: version 4 (IPv4) and version 6 (IPv6).
- Encryption protocols: SSL 3.0, TLS 1.0, TLS 1.1, TLS 1.2, and TLS 1.3.
- Web protocols: HTTP/1.1, HTTP/2, and HTTP/3.
- Browser security policies: HSTS Preload List and HSTS (HTTP Strict Transport Security).
2. Types of penetration tests (
pentests):
- Black-box: performed without prior information, simulating the behavior of a real external attacker.
- Grey-box: carried out with partial system information (e.g., limited documentation), allowing for deeper analysis.
- White-box: performed with complete system knowledge (such as architecture, source code, or configurations), offering the most comprehensive analysis possible.
3. The Penetration Testing Execution Standard (PTES) is a widely adopted framework for planning, executing, and reporting intrusion tests on computer infrastructures.
4. The Open Web Application Security Project (OWASP) is the world's leading reference for best practices and security standards for web applications.