Our team will perform an in-depth inspection of your Web application (e.g. e-shops, portals, custom applications, S.a.a.s applications, gaming apps and so on) for common and rare misconfigurations and vulnerabilities. It doesn’t matter if your application is based on proprietary or open source software.
Manual/ A.I Agent (agentic) or Automatic testing by a human? what to choose?
We perform both manual and automatic testing. We use the top open source tools as well as proprietary tools. Each client and each test are examined by us, then we match the right arsenal of tools to the test and client. If needed, we will write specific tools and exploit for the client, doing everything it takes in order to reach our goal, penetrate the clients’ systems and get their data. Our experience has taught us that vulnerabilities and misconfigurations occur even when proprietary software is used.
Your application, attacked the way real attackers attack it.
Since 2009, Tyr has performed manual, expert-driven penetration testing of web applications — not automated scan-and-paste reports, but deep adversarial testing against the risks that actually breach companies today.
These are some of the issues we test for:
Injection & Input Handling
- SQL Injection (including NoSQL, ORM, and second-order variants)
- Cross-Site Scripting (XSS) — reflected, stored, and DOM-based
- OS command injection, template injection (SSTI), XXE
- Prompt injection in AI/LLM-integrated features
Access Control & Authentication
- Broken access control (horizontal/vertical privilege escalation, IDOR)
- CSRF and cross-origin request abuse
- Session management flaws — fixation, hijacking, puzzling
- Authentication weaknesses — MFA bypass, credential stuffing exposure, JWT & OAuth/OIDC token flaws
- Rate limiting & brute-force resilience
API Security (OWASP API Top 10:2023)
- Broken Object Level Authorization (BOLA) and Function Level Authorization (BFLA)
- Excessive data exposure & mass assignment
- SSRF — server-side request forgery
- Unsafe consumption of third-party APIs, inventory & shadow endpoints
- GraphQL-specific authorization and introspection weaknesses
Configuration & Infrastructure
- Security misconfiguration (OWASP’s #2 risk in 2025) — cloud storage, IAM policies, exposed admin panels, default credentials
- TLS/SSL implementation — protocol versions, certificate validation, HSTS, cipher strength
- Security headers (CSP, etc.), CORS policy flaws
- Web server & framework-specific hardening gaps
Business Logic & Design
- Business logic flaws and abuse of legitimate workflows (OWASP’s “Unrestricted Access to Sensitive Business Flows”)
- Race conditions, replay attacks, and fail-open behavior under exceptional conditions (new in OWASP 2025)
- Insecure design patterns identified through threat modeling review
Supply Chain & Integrity (new OWASP 2025 category)
- Vulnerable and outdated dependencies, CI/CD pipeline weaknesses
- Insecure deserialization, unsigned or unverified updates
- Secrets exposure in code, logs, and configuration
Testing is performed against the full OWASP Top 10:2025 — the current industry standard — with methodology aligned to PTES and OSSTMM. Every engagement concludes with a written report: findings ranked by real-world exploitability, proof of concept, and concrete remediation guidance your developers can act on.
