The same five phases every time, so you always know where we are and what we are touching.
We demonstrate a vulnerability to the minimum degree that proves it exists, then stop. We do not delete data, we do not exfiltrate records, we do not pivot beyond the agreed scope, and we do not leave anything behind. Every action is logged and appears in your report.
PHASE 01 Day 0–1We map what the internet can see of you without touching anything an ordinary visitor would not: DNS, certificates, subdomains, public code, technology fingerprints, third-party embeds. This is where the scope gets real, because it is usually larger than expected.
Tools and technique: Passive DNS and certificate transparency, public source search, HTTP fingerprinting. No authentication, no writes, no repeated fetches.
PHASE 02 Day 1–2Now inside the agreed scope, we build the full map of the application: every route, parameter, role, file upload, redirect and state transition. Automated crawling plus a human clicking through the product the way a user does.
Tools and technique: Authenticated crawling, request interception, wordlist discovery tuned to your stack, JavaScript bundle analysis for hidden endpoints.
PHASE 03 Day 2–4We attempt the attacks the map suggests, and we chain them: a low-severity information leak plus a missing check is often a critical. We stop the moment a vulnerability is proven. Nothing is deleted, nothing is exfiltrated, nothing persists.
Tools and technique: Manual testing with intercepting proxies, benign markers instead of live payloads, isolated test accounts we create and remove.
PHASE 04 Day 4–5Every finding gets a severity, the request that proves it, the impact in business terms, and a specific fix. Written twice: an executive summary someone non-technical can act on, and a technical body a developer can work from without asking us questions.
Tools and technique: CVSS for severity, OWASP references, reproduction steps you can paste into curl.
PHASE 05 Day 5 onwardA call to walk your developer through the findings, then a re-test once you have shipped. Each fix is either confirmed closed with a date, or sent back with what still works. That closure record is what your customers ask for.
Tools and technique: Same proofs re-run, dated closure statement, one re-test in Starter, two in Pro, unlimited on Retainer.
Phase one touches nothing an ordinary visitor wouldn't. This is what it prints.
earthshaker recon — passive Replay $ earthshaker recon --target example.com --passiveNothing above writes, authenticates, or fetches the same resource twice. The active phases only begin once you have signed the scope.
The document that makes testing lawful. Read it before you talk to us — it names the assets, the window, the escalation contact and the limits we hold ourselves to.
Download the template (.docx) or plain text Earthshaker SecurityWe find the cracks before they do. Automated and human-verified security testing for web applications.
earthshakersecurity.com · contact@earthshakersecurity.com
Earthshaker Security