Application security audit
Review of your web applications against the OWASP ASVS: authentication, sessions, access control, injection.
Security audits and penetration testing in Tunisia Precise findings and fixes, not alarms.
We test your applications, your ERP and your servers the way an attacker would, then help you fix what we find. Every finding names the affected asset, its severity and the fix to apply.
- services
- 04
- steps
- 04
- technologies
- 08
Why us
Why an audit by developers is more useful
A security report is only worth something if it gets fixed. Many audits deliver a long list of generic alerts that a development team struggles to prioritise. We write and maintain web applications, Odoo modules and WordPress sites ourselves: we know where to look and how to fix.
Each finding names the affected asset, explains the concrete risk for your business, gives a CVSS severity and proposes a fix you can apply. We stay available during remediation, then check that the issues are actually closed. Everything stays confidential and is governed by signed rules of engagement.
What we do
Web and API penetration test
Black-box or grey-box testing on a defined scope, with proof of exploitation and CVSS scores.
Hardening
Secure configuration of Odoo, WordPress, your Linux servers and your HTTP headers.
Code review and coaching
Secure code review, dependency analysis and awareness sessions for your developers.
Who it is for
Software vendors and product teams
You are launching an application and want an outside review before launch or a funding round.
Companies running Odoo or WordPress
Your ERP or website holds customer data and you want to know whether it is exposed.
Organisations with requirements
A customer, a partner or a standard asks you for proof of a recent penetration test.
How a project runs
Scoping and authorisation
Scope, environments, test accounts, time windows and allowed techniques, agreed in writing.
Testing
Reconnaissance, manual and tool-assisted testing following OWASP, controlled exploitation of the issues found.
Report and debrief
Executive summary, technical detail per finding, and a debrief meeting with your team.
Fixes and retest
Support while you fix, then a new test of the findings to confirm they are closed.
What you receive
- A signed scope and rules of engagement
- A report with every finding, its severity and its fix
- An executive summary for management
- Support while you remediate
- A retest once fixes are in place
Technologies
- OWASP ASVS
- OWASP Top 10
- CVSS 3.1
- Burp Suite
- Nmap
- Semgrep
- Linux
- Cloudflare
Frequently asked questions
Can testing disrupt our production?
Scope, time windows and allowed techniques are agreed in writing before we start. Risky tests run on a staging environment.
What does the report contain?
An executive summary, then every finding with the affected asset, its severity, the evidence and the recommended fix.
How long does a penetration test take?
It depends on the scope: number of applications, user roles and APIs. A test on a standard web application is usually planned over a few days of testing, plus report writing.
What is the difference between a security audit and a penetration test?
An audit reviews configuration, code and practices against a standard such as the OWASP ASVS. A penetration test simulates a real attack to prove what an attacker could obtain. The two are often combined.
Does our information stay confidential?
Yes. A non-disclosure agreement can be signed before scoping, evidence is stored encrypted and deleted at the end of the engagement according to the agreed rules.
Contact
Let's talk about your project.
A new product, an Odoo to take over or an application to audit: describe what you need and we come back with a first analysis.
- A reply from an engineer, not a salesperson
- First conversation and estimate free of commitment
- Your information stays confidential, NDA available
Direct contact
contact@shararahconsulting.com+216 25 163 280Tunis, Tunisia