Manual pentests with evidence of impact.
We test applications, APIs and infrastructure to identify real security flaws. You receive clear evidence, the impact explained and guidance to fix them.
Scope authorized in writing before the first test.
- RequestGET /v1/invoices/48213Authenticated as client A
- Response200 · "owner": "client B"Invoice 48213 belongs to client B
- Validated finding
Client A's account reads client B's invoices.
What does your company need assessed?
Choose by type of environment. Every assessment is manual and ends with a report of evidence and fixes. If unsure, we help define the scope.
- 01Websites and systems
Web App Pentest
We assess web applications, such as customer portals and logged-in areas: authentication, permissions and features, looking for exploitable flaws.
- Access control
- Sessions
- Business rules
- Injection and XSS
- 02APIs and integrations
API Pentest
We test the APIs used by apps, partners and integrated systems, looking for access, authentication and business logic flaws.
- Object-level authorization
- Data exposure
- Flow abuse
- 03Networks and servers
Infrastructure Pentest
We analyze servers, internet-facing services, internal networks and cloud environments to identify security risks.
- External exposure
- Segmentation
- Cloud and identities
Not sure which assessment your company needs? We can help define the scope.Ask for guidance
Other security services
- Code reviewA review of the source code for security flaws.
- Design reviewAn assessment of the architecture, before or during development.
- Threat modelingA map of a system's threats, to decide what to protect first.
- Security consultingTechnical guidance to plan and prioritize security.
Why LoPrestiSec
Tools point to possibilities. A specialist confirms what is exploitable.
- Manual assessmentEach system is tested in its own context: rules, roles and integrations.
- Confirmed flawsOnly what was verified, with evidence, goes into the report.
- Impact explainedWhat each flaw allows, in plain language.
- Guided remediationWhat to change and how to confirm it was fixed.
- Direct conversationYou talk to the people who ran the tests.
LoPrestiSec is led by Lucca Lo Presti, an offensive security specialist with hands-on experience in web application, API and cloud pentests, code review, threat modeling and design review. The person technically responsible follows the project from scoping to the presentation of results.
How hiring works
No test starts before the scope is defined and authorized in writing. You know what will be tested, when and within which limits.
- 01
We talk
We learn about your system, your goals and what needs to be assessed.
- 02
We define the scope
We agree on environments, limits and testing windows, and formalize the authorization in writing.
- 03
We run the tests
We test manually and validate every vulnerability found.
Starts only afterThe scope is authorized in writing
- 04
We deliver the results
We present the evidence, the impact and the recommended fixes to your team.
What do you receive after the pentest?
Two reports: one to decide, one to fix. Below, a page of the technical report, with fictional data.
Executive report
The main risks, the possible business impact and the priority of each fix, in plain language.
Technical report
Validated vulnerabilities, reproducible evidence and the recommended fix for each finding.
Password reset token can be reused
- Asset
- app.exemplo.com.br
- Account used
- qa.a (test)
- Reference
- CWE-640 · WSTG-ATHN-09
Evidence
The same token changed the password twice, 40 minutes apart. Logging in with the second password confirms the change took place.
See the test's 3 requests
- 14:02POST /auth/reset{"token":"7f3a…","password":"Teste#1"}200 {"status":"password_changed"}
- 14:42POST /auth/reset{"token":"7f3a…","password":"Teste#2"}200 {"status":"password_changed"}
- 14:43POST /auth/login{"user":"qa.a","password":"Teste#2"}200 {"session":"…"}
Anyone with access to a reset link that was already used, for example through the browser history or a forwarded email, can change the account password. The test was limited to the qa.a test account.
Severity: medium
The outcome is account takeover, but it requires prior access to a link sent to the user.
Recommendation
Invalidate the token on first use and limit its validity to 15–30 minutes.
To verify, repeat the 14:42 request with a token that was already used: the expected response is 400 and the password does not change.
How severity is defined
- Critical
- Simple to exploit, with broad impact on data or operations.
- High
- Significant impact, with some condition to exploit.
- Medium
- Limited impact, or exploitation that depends on a specific scenario.
- Low
- Strengthens the defense; little effect on its own.
Define the scope with the people who will test.
You do not need every technical detail: tell us what your company needs assessed and we help define the scope. Then we send a proposal with effort and timeline.
Sending this form neither starts any testing nor authorizes it: testing begins only after the scope is defined and authorized in writing.
- [email protected]
- Phone
- +55 (15) 99745-2589
- Chat on WhatsApp
- Hours
- Monday to Friday, 9am to 6pm
- Confidentiality
- NDA before any sensitive information
Frequently asked questions
Didn't find your question? Tell us about your case.
Talk to a specialistWhat is the difference between a pentest and a vulnerability scan?
A scan is automated and points to possible flaws. In a pentest, a specialist manually exploits what they find to confirm whether the flaw is real and what its impact is, including logic issues that tools do not detect.
Can a pentest affect production systems?
Testing is planned to minimize that risk: techniques, windows and limits are agreed with your team beforehand, and tests that could cause impact are only run with explicit authorization. Where possible, we recommend an equivalent staging environment.
What do you need to send a proposal?
A description of what should be assessed (applications, APIs, IP ranges or cloud environments) and the goal of the test. From that we define scope, effort and timeline.
How long does a pentest take?
It depends on the size and complexity of the scope. The timeline is estimated in the proposal, before you sign.
Do you sign a confidentiality agreement?
Yes. We can sign an NDA before receiving any sensitive information about your environment.
Technical reading
- Web Pentest
How a Web Application Pentest Works in Practice
· 15 min read - API Security
API Security in 2026: The Mistakes Exposing Companies Without Them Noticing
· 18 min read - Pentest
Pentest vs. Vulnerability Scan: What Actually Protects Your Company?
· 13 min read