Under construction

Website under construction. Some content may still change; the contact form is already working.

Offensive security

We anticipate threats so your business keeps growing without interruption.

Penetration testing and vulnerability analysis, run traditionally or AI-powered, for teams that would rather uncover the problem than read about it in an incident report.

recon.sh
$ nmap -sV -p- --min-rate 5000 argusrk.com.mx. 22/tcp open ssh OpenSSH 8.9p1 Ubuntu. 443/tcp open https nginx 1.24.0. 8081/tcp open http Werkzeug/2.3 (Python 3.11). 5432/tcp open postgresql PostgreSQL 15.4. scan done · 4 open ports · 1 filtered. $ whatweb https://argusrk.com.mx. [200] nginx, Python, JWT, Bootstrap. missing headers: CSP, HSTS, X-Frame-Options. $ ffuf -u https://argusrk.com.mx/FUZZ -w common.txt. /api/v1 [200]. /admin [403]. /.git/config [200] <- source code exposure. /backup.sql [200] <- 42 MB, public. $ sqlmap -u https://argusrk.com.mx/api/v1/search?q=1 --batch. parameter 'q' is vulnerable (boolean-based blind). back-end DBMS: PostgreSQL 15.4. technique: boolean-based blind, error-based, time-based. current user: app_rw is DBA: False. $ sqlmap ... -D argusrk_prod --tables. Database: argusrk_prod. +-----------------+ | clients | | engagements | | findings | | credentials | | users | +-----------------+. 5 tables enumerated. $ sqlmap ... -T users -C email,password_hash --dump. +------------------+-----------------------+ | email | password_hash | +------------------+-----------------------+ | admin@argusrk.io | $2b$12$Ar9.. (bcrypt) | | ops@argusrk.io | $2b$12$9fA.. (bcrypt) | +------------------+-----------------------+. $ hashcat -m 3200 hashes.txt rockyou.txt. recovered 0/2 · bcrypt cost 12 holding strong. $ cat findings.md. [CRIT] Blind SQLi in 'q' CWE-89 CVSS 9.1. -> unauth read of full app database. [HIGH] Exposed .git dir CWE-538 CVSS 7.5. -> source recovered via git-dumper. [HIGH] Public backup.sql CWE-530 CVSS 7.5. -> creds bcrypt cost12, no plaintext. [LOW] Missing CSP / HSTS CWE-693 CVSS 3.7. 4 findings · PoC per issue · report in 48h

Mission

Expose the real impact of vulnerabilities in critical systems before an attacker does, with clear technical evidence and remediation steps an engineering team can actually execute.

Vision

To be the team organizations turn to when they treat offensive security as a serious technical practice, not a compliance box ticked once a year.

A system isn't secure until someone tries to break it.

How we work

Four phases, one goal: evidence you can act on.

Based on the OWASP Testing Guide, NIST SP 800-115, OSSTMM and PTES, adapted to each project's real scope instead of applied as a template.

01

Reconnaissance and vulnerability analysis

Attack-surface mapping, OSINT and enumeration of exposed assets, internal or external.

02

Exploitation

Manual validation of exploitable vulnerabilities, without compromising the stability of the environment.

03

Post-exploitation

We assess real impact: what an attacker can reach once inside, and what gets put at risk.

04

Report and retest

Prioritized findings with reproducible evidence, plus a verification round after remediation.

Why choose us

What makes us different from an automated, surface-level scan.

Offensive security that turns into concrete fixes.

Manual exploitation, not a scanner

An attacker doesn't run a tool and leave. We chain flaws by hand until we prove real impact, not a context-free list of alerts.

Reproducible evidence

Every finding ships with its proof of concept and the exact steps to reproduce it. Your team verifies the issue, it doesn't take our word for it.

AI-powered pentesting

Where authorized, alongside traditional testing we can run pentests against internet-facing assets powered by AI models in a local cloud environment, guaranteeing that no data is sent to third parties. Covering one of the most recent attack vectors out there.

Retest and early alerts included

We report critical findings immediately and, after remediation, verify at no extra cost that the flaw is genuinely closed. The work ends when the risk drops.

Recognized methodology

OWASP, NIST SP 800-115, OSSTMM and PTES as a baseline, adapted to each project's scope instead of applied as a template.

Direct communication

Full transparency: the same technical team is with you from start to finish.

Certified team

We are not another consultancy.
We prove it with certifications.

Five active credentials across the team. The exploitation ones —eWPT, eCPPT and CEH Practical— are earned by solving a real lab, not by answering a test.

  • eWPT — INE / eLearnSecurityINE / eLearnSecurity
  • eCPPT — INE / eLearnSecurityINE / eLearnSecurity
  • CEH — EC-CouncilEC-Council
  • CEH Practical — EC-CouncilEC-Council
  • CEH Master — EC-CouncilEC-Council

Organizational standards

At firm level, not individual. We do not hold these yet, and we do not present them as if we did.

ISO/IEC 27001

In progress

Information security management at the organizational level.

PCI DSS

In progress

Security standard for environments that process payment card data.

Frequently asked

What people usually ask before the first call.

Do I need authorization for you to audit my systems?

Yes, and it's non-negotiable. We don't start without a signed authorization defining the scope, test windows and included assets. Running security tests without permission is illegal; the contract protects us both.

Is my operation affected during the audit?

No. We prioritize non-destructive techniques and agree with you on what can be touched. We don't run denial-of-service attacks or high-risk tests against production without an explicit agreement and an agreed window.

Do we sign a non-disclosure agreement (NDA)?

Always. Everything we find —findings, data, architecture— stays confidential. We can sign your NDA or propose ours before receiving any sensitive information.

How long does an audit take?

It depends on scope, but a typical web application pentest runs one to three weeks of effective work. After reviewing your scope we give a concrete estimate in the proposal, in under 48 hours.

What do you deliver at the end?
  1. A technical report detailing every finding, a reproducible proof of concept and/or evidence, severity (CWE + CVSS), mitigation recommendations and any applicable compensating controls.
  2. An executive report for leadership summarising the results of the test and its impact on the organisation.

Additionally, if required:

  1. Early warning reports: where high-impact risks exist, we issue as many early warning reports as needed.
  2. Retest report: once remediations are validated, we produce a new technical report with the results of this second review, focused on the initial findings.
Do you do social engineering or phishing?

Only if it's within the agreed scope and with clear rules of engagement in writing. We don't perform any action against people or accounts unless it is explicitly authorized.

Next step

Tell us which systems you want to protect.

A three-step form: who you are, what is in scope and when you need it. We send back a technical proposal in under 48 hours.