Vulnerability Assessment Service "Site-Audit"

basic information

【Diagnosis Menu】 ■ Platform Diagnosis - Vulnerabilities in OS/middleware, validity of certificates, presence of guessable passwords, possibility of eavesdropping on communications (encryption suite evaluation), careless exposure of databases and samples, etc. ■ Application Diagnosis - SQL injection, cross-site scripting (XSS), CSRF, path traversal/directory traversal, code/XSLT injection, buffer overflow, etc. 【Provision Conditions】 - Target: Websites, public servers, etc. (Note: In principle, diagnosis on shared servers is not allowed) - The package fee includes an initial diagnosis and a "re-diagnosis" after countermeasures, totaling two times. - Options: Vulnerability response support, diagnosis result reporting session.

Price range

Delivery Time

Applications/Examples of results

【Purpose】 - Preliminary inspection of websites that handle customer personal information and credit card information, such as e-commerce sites and reservation sites. - Security checks before the launch and regular security checks of corporate websites and web services. - Obtaining diagnostic evidence when requested for security audit reports by business partners or industry organizations.

Detailed information

• 

  Provision of a detailed vulnerability investigation report. We will create and submit a diagnostic report that clearly organizes the risk levels of detected vulnerabilities and specific issues.

• 

  [Vulnerabilities of the OS] We diagnose vulnerabilities and configuration deficiencies in older versions of server OS to proactively identify risks that could be exploited by attackers.

• 

  [Validity of Certificates] We check for improper SSL/TLS certificates and configuration errors to prevent misuse for phishing sites and eavesdropping on communications.

• 

  Easily guessable passwords for management screens and services are detected. This prevents unauthorized logins and intrusions.

• 

  [Vulnerabilities in Middleware] Investigate the improper version settings of web servers and middleware to block attackers' entry points.

• 

  [Presence of Sample Scripts] Detects and removes sample code and test scripts that are left publicly accessible by default, preventing misuse.

• 

  [Verification of Communication Encryption] Detection of the use of weak cipher suites. Prevents the risk of eavesdropping and tampering by third parties.

• 

  【Database Vulnerabilities】 We thoroughly diagnose risks such as SQL injection and the careless external exposure of DB management tools.

• 

  Third-Party Relay (SPAM) Check for risks of spam relay due to improper email server configuration, protecting the company's credibility.