Web application penetration testing
Your frontend and its backend decide who is authenticated, what they may authorize, and whether a withdrawal proceeds. Guardian attacks those decisions directly, in the flows where being wrong costs money.
Offchain · WebApp Pentest
The interface between a user and their funds.
- Authentication Login and recovery flows, session lifetime and invalidation, token handling, and whether 2FA is enforced server-side on the actions that matter.
- Authorization Horizontal and vertical access control, object-level checks, and whether a request forged by one user reaches another user's resources.
- Value-moving flows Withdrawal, transfer, and settings changes: step ordering, replay, race conditions, and the confirmations guarding each.
- Client-side surface XSS and injection paths, CSRF protections, supply-chain exposure in the bundle, and what the frontend trusts from the API.
- Business logic Steps that can be skipped or reordered, workflows that can be run twice, and limits enforced in the interface but not behind it.
- Input handling Every parameter the application accepts, manipulated by hand and fuzzed at scale, to find injection, unsafe parsing, and what breaks on malformed input.
Guardian maps the application function by function, covering every form, background request, socket, and wallet interaction a user can reach, at every privilege level, then tests each one. Working from the source repository is strongly recommended: it is the only way to be certain nothing user-reachable was missed. Frontend-only and backend-only scopes are available.
Withdrawals were approved while two-factor authentication was bypassed. The control existed and did not hold. Crypto.com · $34M (read the incident write-up)
Scoped by what a user can actually do in the app.
Audits & Pentests
Other engagements
Start now