Araval Technologies | VAPT, infrastructure & cloud security audits

Sample engagement · hover a node· tap a node

F-01 · Broken access controlHigh 8.1

[authz] GET /api/v1/invoices/7731 as customer_b → 200 OK owner: customer_a[fix] check ownership server-side

F-02 · SQL injectionCritical 9.8

[inject] GET /search?q='||pg_sleep(5)-- → response in 5.02 s no login required[fix] parameterised queries

F-03 · Public storage bucketHigh 7.5

[cloud] s3://acme-backups public-read db-2026-09-01.sql.gz listable without credentials[fix] block public access

F-04 · Database exposedMedium 5.3

[infra] 5432/tcp open to 0.0.0.0/0 postgres 13 (end of life) TLS disabled[fix] restrict to app subnet

F-01 · Broken access controlHigh 8.1

[authz] GET /api/v1/invoices/7731 as customer_b → 200 OK owner: customer_a[fix] check ownership server-side

F-02 · SQL injectionCritical 9.8

[inject] GET /search?q='||pg_sleep(5)-- → response in 5.02 s no login required[fix] parameterised queries

F-03 · Public storage bucketHigh 7.5

[cloud] s3://acme-backups public-read db-2026-09-01.sql.gz listable without credentials[fix] block public access

F-04 · Database exposedMedium 5.3

[infra] 5432/tcp open to 0.0.0.0/0 postgres 13 (end of life) TLS disabled[fix] restrict to app subnet

Hands-on penetration testing, infrastructure audits and cloud security reviews. Every finding proven, rated and written up so your engineers can fix it.

Discuss your scope

Methodology aligned to

OWASP
PTES
NIST SP 800-115
CIS Benchmarks
CVSS
ISO/IEC 27001
OWASP MASVS
OWASP API Top 10

Why Araval

Most breaches don't need a zero-day. They use a forgotten admin panel, an API that trusts the wrong user, a storage bucket left open. We find those gaps the way an attacker would, prove each one, and show your engineers exactly how to close it.

Reproduced · Rated · Retested

What we find

Key risks we uncover.

Exploitable application flaws

Scanners miss broken access control and logic flaws, so customer data can sit one changed ID away from the wrong user.

See how we test this

Unhardened infrastructure

Open management ports, stale SSH keys and unpatched servers are the easy way in, and they pile up quietly as systems grow.

See how we test this

Cloud misconfiguration

A public bucket, an over-privileged role or a forgotten access key can expose everything without a single line of vulnerable code.

See how we test this

Services

What an engagement covers.

VAPT

Expose vulnerabilities before they become breaches.

01 / 03

repeater — invoices

GET /api/v1/invoices/7731 HTTP/1.1Host: app.example.testAuthorization: Bearer ‹customer_b› HTTP/1.1 200 OK{ "id": 7731, "owner": "customer_a", "total": 48200 } ✕ another customer's invoice · IDOR · High 8.1

Web applications & APIs
Mobile apps
External & internal networks
Role and tenant access control

Learn more

Infrastructure security audit

Harden the servers everything runs on.

02 / 03

sshd_config.diff — prod-db-01

# /etc/ssh/sshd_config- PermitRootLogin yes- PasswordAuthentication yes+ PermitRootLogin no+ PasswordAuthentication no+ AllowGroups ops-admins ✕ 5432/tcp open to 0.0.0.0/0 · restrict to app subnet

Server hardening (CIS)
Access & privileged accounts
Firewall & segmentation
Patching, logging & backups

Learn more

Cloud security review

Close the gaps in your cloud accounts.

03 / 03

iam — ci-deploy

$ aws iam get-policy-version …/ci-deploy{  "Effect": "Allow",  "Action": "*",  "Resource": "*"} ✕ CI user is full admin · access key 912 days old

AWS, Azure & Google Cloud
IAM & least privilege
Public exposure
Logging & detection

Learn more

Beyond the report

Security that doesn't stop at the report.

A part-time security lead to own it month to month, and web development that is built secure and kept that way.

Security without an owner

Questionnaires, audit requests and incidents land on whoever is free, and nobody tracks the risks in between.

See what's included

Software nobody maintains

Sites and apps launched and left behind: outdated dependencies, expired certificates and admin panels nobody remembers.

See what's included

The report

Every finding comes with proof and a fix.

01
Executive summary
Overall risk in plain language, for leadership and for your customers.
02
Severity you can check
A CVSS score and vector for every finding, adjusted for your context.
03
Proof for every finding
Steps to reproduce and request/response evidence.
04
A specific fix
What to change and where, written for the engineer who will change it.
05
Retest status
We verify each fix and reissue the report.

Araval · TechnologiesConfidential

Sample report · illustrative

Security assessment report

Example Corp · Web application & API · Grey-box

Findings by severity

Critical1
High3
Medium4
Low5
Info2

F-01High · 8.1

Broken object-level authorisation on the invoice API

Impact: Any customer can read and edit other customers' invoices
Fix: Check ownership on the server for every read and write
Status: Fixed · verified on retest

Engagement

From first call to verified fix.

01
Scope
Agree what is in and out, the environment, testing windows and constraints.
02
Authorise
Signed authorisation and NDA before a single request is sent.
03
Test
Hands-on testing, with critical issues raised the same day.
04
Report
A report your leadership can read and your engineers can fix from.
05
Retest
We verify each fix and issue an updated report.

Our full approach

How we work

~~Scanner dumps~~Proven findings.
~~Inflated severity~~Honest ratings.
~~Generic advice~~Specific fixes.
~~Surprises~~Written scope, signed authorisation.

Let's strengthen your security — get in touch.

Araval · Technologies

Sample engagement · hover a node· tap a node

F-01 · Broken access controlHigh 8.1

[authz] GET /api/v1/invoices/7731 as customer_b → 200 OK owner: customer_a[fix] check ownership server-side

F-02 · SQL injectionCritical 9.8

[inject] GET /search?q='||pg_sleep(5)-- → response in 5.02 s no login required[fix] parameterised queries

F-03 · Public storage bucketHigh 7.5

[cloud] s3://acme-backups public-read db-2026-09-01.sql.gz listable without credentials[fix] block public access

F-04 · Database exposedMedium 5.3

[infra] 5432/tcp open to 0.0.0.0/0 postgres 13 (end of life) TLS disabled[fix] restrict to app subnet

F-01 · Broken access controlHigh 8.1

[authz] GET /api/v1/invoices/7731 as customer_b → 200 OK owner: customer_a[fix] check ownership server-side

F-02 · SQL injectionCritical 9.8

[inject] GET /search?q='||pg_sleep(5)-- → response in 5.02 s no login required[fix] parameterised queries

F-03 · Public storage bucketHigh 7.5

[cloud] s3://acme-backups public-read db-2026-09-01.sql.gz listable without credentials[fix] block public access

F-04 · Database exposedMedium 5.3

[infra] 5432/tcp open to 0.0.0.0/0 postgres 13 (end of life) TLS disabled[fix] restrict to app subnet

Email uscontact@araval.in

01Tell us what you need and by when
02We reply with questions or a written scope
03You get a fixed quote before any work starts

Discuss your scope

We find the way in before attackers do.

Key risks we uncover.

Exploitable application flaws

Unhardened infrastructure

Cloud misconfiguration

What an engagement covers.

Expose vulnerabilities before they become breaches.

Harden the servers everything runs on.

Close the gaps in your cloud accounts.

Security that doesn't stop at the report.

Security without an owner

Software nobody maintains

Every finding comes with proof and a fix.

Executive summary

Severity you can check

Proof for every finding

A specific fix

Retest status

Security assessment report

From first call to verified fix.

Scope

Authorise

Test

Report

Retest

Let's strengthen your security — get in touch.