Penetration Testing Services
We test your web apps, mobile apps and networks the way an attacker would, report prioritised fixes and retest once issues are closed.
Penetration testing is an authorised, scoped exercise in which security specialists use real attacker techniques to find vulnerabilities in your systems, prove whether they can actually be exploited and report them with clear remediation steps. Unlike an automated scan, findings are verified by a human, chained together to show real impact and include business logic flaws. Pedante Bilişim, Racoun’s technology arm, delivers penetration testing under the Racurity brand, with expert solution partners and one point of contact.
What we test
- Web applications and APIs, referencing OWASP Top 10 and ASVS: injection, authentication, access control (IDOR), misconfiguration and business logic.
- Mobile apps on iOS and Android, following the OWASP MASVS approach, including their back-end APIs.
- External networks: everything visible from the internet, including VPN gateways and remote access services.
- Internal networks: privilege escalation, lateral movement, Active Directory and whether segmentation really works.
- Optional wireless and controlled phishing simulations.
Black, grey or white box
Black box gives a realistic outsider view, grey box (a standard user account and basic architecture details) is usually the most efficient balance, and white box with source code access delivers the deepest results for critical applications.
How we work
Scope, exclusions, contacts and a stop procedure are agreed in writing. Disruptive tests are scheduled outside peak hours and only with your approval. Findings are verified, rated with standard scoring such as CVSS and reported with an executive summary, reproduction steps and concrete fixes. Once you have remediated, we retest. Because our network, server, cloud and software teams work under the same roof, we can also help you implement the fixes.
Frequently asked questions
Will testing disrupt production?
No unplanned disruption: scope and timing are agreed in advance, risky tests need your approval and a stop procedure is defined before we begin.
Do you retest after fixes?
Yes. Once issues are remediated we retest the affected findings and update their status in the report.
Contact
Head office: Ataşehir, Istanbul. We work in person across Istanbul and online with clients all over Türkiye and abroad. Message us on WhatsApp (+90 551 044 08 69) or email ekip@racoun.com.
