Pentest dedicado a fintech, neobancos, wallets y trading apps. APIs financieras (REST, GraphQL, WebSocket), flujos OAuth 2.0 / SAML / OIDC, lógica de negocio (overdraft, fees, KYC bypass, race conditions en transferencias), exposición de Open Banking. Cada hallazgo viene con PoC reproducible y mapping a PCI DSS 4.0, ISO 27001 y la ley local de protección de datos que aplique. Pentest dedicated to fintech, neobanks, wallets and trading apps. Financial APIs (REST, GraphQL, WebSocket), OAuth 2.0 / SAML / OIDC flows, business logic (overdraft, fees, KYC bypass, race conditions in transfers), Open Banking exposure. Every finding ships with reproducible PoC and explicit mapping to PCI DSS 4.0, ISO 27001 and the local data-protection law that applies.
No son las del Top 10 del 2010. Son las que un atacante con conocimiento del flujo financiero explota en producción. Not the 2010 Top 10. The ones an attacker who understands the financial flow exploits in production.
GET /api/accounts/{id}/balance sin re-checkeo de ownership. Token válido del usuario A consulta saldo del usuario B. Crítico cuando el response incluye CBU/CVU/IBAN. GET /api/accounts/{id}/balance with no ownership recheck. User A's valid token reads user B's balance. Critical when the response includes CBU/CVU/IBAN.
Dos requests POST /transfer en paralelo con el mismo saldo idempotency-key, ambos pasan el balance check, ambos descuentan: doble gasto. Bug recurrente cuando el lock no es a nivel DB. Two parallel POST /transfer requests with the same balance-check idempotency-key, both pass, both debit: double spend. Recurring bug when the lock isn't DB-level.
Whitelist por startswith en vez de match exacto + state validable. Cadena: account takeover vía OAuth callback hijack → admin móvil → wire-out a cuenta del atacante. Whitelist by startswith instead of exact match + guessable state. Chain: account takeover via OAuth callback hijack → mobile admin → wire-out to attacker account.
El endpoint de re-verificación no marca el liveness-check como consumido. Reutilizar el mismo blob de video para enrolar 10 cuentas mula con DNI sintéticos. Money mule scale-out. The re-verification endpoint doesn't mark the liveness-check as consumed. Reuse the same video blob to enroll 10 mule accounts with synthetic IDs. Money mule scale-out.
Endpoint de avatar upload pulea http://169.254.169.254. Token del rol EC2 con permisos sobre s3:GetObject en el bucket de KYC documents. Exfil de DNI + selfie de toda la base. Avatar upload endpoint pulls http://169.254.169.254. Token from the EC2 role with s3:GetObject on the KYC bucket. Exfil of every ID + selfie on file.
Webhooks de payment processors aceptan alg: none o no validan timestamp → replay de notificaciones de "pago confirmado" → emisión gratuita de saldo cripto / fiat. Payment-processor webhooks accept alg: none or skip timestamp validation → replay of "payment confirmed" notifications → free crypto/fiat balance issuance.
Pentest end-to-end de la app + API. OAuth, lógica de negocio, race conditions, multi-hop chains. Punto de entrada estándar. End-to-end app + API pentest. OAuth, business logic, race conditions, multi-hop chains. Standard entry point.
★ POPULAR S/04 · desdefrom $2.490Para wallets / neobancos con app móvil. MASVS v2, bypass de defensas cliente (root/jailbreak detection, SSL pinning), backend que la app consume. For wallets / neobanks with a mobile app. MASVS v2, client-side defense bypass (root/jailbreak detection, SSL pinning), backend the app consumes.
S/07 · desdefrom $5.990Red interna, Active Directory, cloud (AWS/Azure/GCP). Path desde internet hasta Domain Admin como lo haría ransomware. Internal network, Active Directory, cloud (AWS/Azure/GCP). Path from internet to Domain Admin like ransomware would.
S/08 · desdefrom $9.990Simulación adversarial completa MITRE ATT&CK. Phishing dirigido a empleados, EDR evasion, persistencia, exfil. Para post-ronda donde el riesgo regulatorio escala. Full MITRE ATT&CK adversarial simulation. Targeted employee phishing, EDR evasion, persistence, exfil. For post-round scenarios where regulatory risk scales.
◆ FLAGSHIPCada hallazgo viene mapeado al artículo, requisito o control específico que toca. Tu CISO recibe el reporte; tu Compliance Officer recibe el mismo reporte con el mapping ya hecho. Every finding is mapped to the specific article, requirement or control it touches. Your CISO gets the report; your Compliance Officer gets the same report with the mapping already done.
Engagement con SLA de 48h para Starter y Professional. NDA mutuo en paralelo. Reporte cumple con todos los frameworks de arriba. Retest a 30 días incluido. 48h SLA engagement for Starter and Professional. Mutual NDA in parallel. Report satisfies every framework above. 30-day retest included.