EK Securitiesby Ek Ra Sunya Inc

Find the weak point before someone else does.

Penetration testing, QA and network care. Written authorization before we start, a retest after you fix.

Request a scoping call See how we work

EK SecuritiesPenetration test report v1.1

Invoicing app: web application and API

Target
app.invoicing.test, /api/*
Authorization
Signed before any test traffic

3. Findings

  • F-01Org A user can edit Org B invoices (IDOR)HighRetest: Closed
  • F-02No attempt limit on the login endpointMediumRetest: Closed
  • F-03Session cookie sent without the Secure flagMediumRetest: Closed
  • F-04Server version shown in response headersLowRetest: Accepted risk
Page 1 of our sample report. The target and findings are made up, written by us to show the format. Read all of it

Who we have worked with

Networks we set up and look after.

Two internet lines, one firewall, a VLAN for each kind of device, and on-site servers we patch and back up.

Managed network and server care
Map of a managed networkTwo internet providers connect to the MikroTik router, so the site stays online if one line drops. Traffic from outside is blocked at the router's firewall, and an administrator reaches it only over a VPN. Inside, a Cisco managed switch puts each kind of device on its own isolated VLAN: staff Wi-Fi and guest Wi-Fi on Cambium access points, the on-site servers, and backups.VPNISP 1main lineISP 2failoverYour adminMikroTik routerfirewall, NAT, VPNCisco switchVLANs, isolatedStaff Wi-FiVLAN 10Guest Wi-FiVLAN 20ServersVLAN 30BackupsVLAN 40blockedallowedblockedadmin, VPN only

Stock photos of the kind of hardware we support, not photos of client sites.

What does EK Securities do?

EK Securities is the security testing and QA wing of EK Ra Sunya Inc. It is not a securities or investment business. We test web apps, APIs, mobile apps, networks and servers for the weak points an attacker would use, with evidence, a fix and a retest for each. We also set up and maintain networks, servers and deployment pipelines.

Services

All services

Run and maintain

Findings map to public standards.

From scope to retest, in writing.

How each step works

  1. Scope

    We agree what is in and out: hosts, apps, roles, test accounts, environments and the hours testing may run.

    out: written scope

  2. Authorize

    The system owner signs a written authorization before any test traffic is sent. No signature, no testing.

    out: signed authorization

  3. Test

    Manual testing backed by tools. Every finding is confirmed by hand. A critical issue is raised as soon as it is confirmed, not saved for the report.

    out: findings confirmed by hand

  4. Report

    Each finding with severity, where it is, the evidence, the impact and a fix your developers can apply.

    out: report with evidence and a fix each

  5. Retest

    Once you have fixed the findings, we test them again and update the report to show what was closed.

    out: report updated: closed or still open

What does the report look like?

Same six parts every time: a developer can reproduce it, a manager can rank it.

Read the sample report
Sample format, fictional target
Severity
High
Where
PATCH /api/invoices/{id}
Issue
Any signed-in user can edit another organisation's invoice by changing the id (IDOR).
Evidence
The request and response showing user A's session changing an invoice owned by user B.
Fix
Load the invoice scoped to the caller's organisation and return 404 when it does not match.
Retest
Same request repeated after the fix, result recorded in the report.

We test our own software first.

Ek Ra Sunya builds and runs these. We test them the way we test yours.

Questions

Do you test production systems?

Only when production is in the signed scope. We prefer a staging copy. On production we agree a test window, use dedicated test accounts, and never run denial-of-service or destructive tests.

Do you need our source code?

No. We can test from the running application and test accounts. Read access to the code helps us trace a behaviour to the exact line and usually finds more in the same time, so we ask for it when you can share it.

Is EK Securities a securities or investment company?

No. EK Securities is the security testing and QA wing of EK Ra Sunya Inc. It is not a securities or investment business. It does not deal in shares, bonds or any financial product.

Who is behind EK Securities?

EK Securities is a brand of Ek Ra Sunya Inc Pvt. Ltd., a software company in Lalitpur, Nepal, that builds and runs EK ERP, EK SMS and EK Cloud.

Tell us what you want tested.

A short call, then a signed scope. No testing before that.

Request a scoping call