VPT-01
Web Application & Portal Penetration Testing
Testing against OWASP Top-10, SQLi, XSS, SSRF, broken access control, and multi-step financial transaction manipulation.
Request Specification
CYB-01 // OFFENSIVE VAPT & RED TEAM
CREST & OSCP-Aligned Vulnerability Assessment and Penetration Testing
Our offensive security engineers simulate real-world cyber adversaries to uncover, safely exploit, and help you remediate critical vulnerabilities across your external/internal networks, web applications, mobile apps, APIs, cloud accounts, and staff awareness.
OSCP, CREST & CISSP Red Team
Web, Mobile, API & Network VAPT
Zero False-Positive Manual Exploits
Free Remediation Re-Test Included
OFFENSIVE VAPT // RED-TEAM EXPLOITATION
100%
Manual Exploitation Verification
Zero
False-Positive Scanner Dumps
60-Day
Complimentary Remediation Retest
100%
CBK, PCI-DSS & ISO Audit Acceptance
BEYOND AUTOMATED SCANNERS
Real-World Human-Led Penetration Testing That Uncovers Business-Logic Flaws
Many low-cost providers run an automated vulnerability scanner, export a 300-page PDF full of false positives, and call it a penetration test—leaving critical authentication bypasses and business-logic flaws completely undetected.
At Dulo Tech Limited, automated scanning is only the first 15% of our methodology. Our OSCP, CREST, and OSWE-certified ethical hackers perform deep manual exploitation—chaining subtle API, Active Directory, and privilege-escalation flaws just like a real threat actor—and deliver clear, developer-ready remediation code.
Deep Business-Logic, API & Authentication Bypass Exploitation
Active Directory, Cloud IAM & Internal Lateral Movement Simulation
Executive Risk Scoring + Developer Remediation Walkthrough & Free Retest
MANUAL RED-TEAM VAPT // ZERO FALSE POSITIVES
SLA: 99.999%
SIX SPECIALIZED VAPT TRACKS
Comprehensive Offensive Security Testing Scope
We conduct black-box, grey-box, and white-box penetration testing across six critical attack surfaces.
VPT-01
VPT-02
REST, GraphQL & ISO 20022 API Security
Auditing mobile banking, B2B payment, and ERP APIs against OWASP API Security Top-10 (BOLA, broken auth, mass assignment).
Request Specification
VPT-03
Mobile App VAPT (iOS & Android)
Static and dynamic binary analysis (SAST/DAST), certificate pinning bypass, local keychain inspection, and reverse engineering.
Request Specification
VPT-04
External & Internal Network / AD VAPT
Perimeter firewall testing, VPN exploitation, internal VLAN pivoting, Kerberoasting, and Active Directory domain dominance.
Request Specification
VPT-05
Cloud & Kubernetes Penetration Testing
Auditing AWS, Azure, GCP, and Kubernetes clusters for IAM privilege escalation, exposed S3/Blob storage, and container escape.
Request Specification
VPT-06
Red-Team Social Engineering & Phishing
Simulated spear-phishing, vishing, rogue Wi-Fi evil-twin attacks, and physical badge-cloning exercises to test human and physical defenses.
Request Specification
VAPT EXECUTION LIFECYCLE
Six-Phase Penetration Testing Protocol
Controlled, non-disruptive offensive testing governed by strict Rules of Engagement (RoE).
VLC-01
Scoping & Rules of Engagement (RoE)
Defining target IP ranges, URLs, testing windows, emergency stop contacts, and legal authorization letters.
LEGAL ROE
VLC-02
OSINT & Attack Surface Reconnaissance
Mapping exposed subdomains, leaked credentials on dark-web repositories, API endpoints, and technology fingerprints.
OSINT MAPPING
VLC-03
Vulnerability Discovery & Triage
Combining commercial/custom scanners with manual code and protocol inspection to map candidate weaknesses.
DEEP TRIAGE
VLC-04
Controlled Manual Exploitation
Safely exploiting vulnerabilities to prove real impact (privilege escalation, data access) without causing denial-of-service.
SAFE EXPLOIT
VLC-05
Dual-Audience Reporting & Debrief
Delivering a C-suite Executive Summary alongside a CVSS v4.0 Technical Report with step-by-step reproduction and patch code.
CVSS V4.0 REPORT
VLC-06
Remediation Verification & Clearance Cert
Re-testing all patched vulnerabilities and issuing an official VAPT Attestation Certificate for regulators and clients.
CLEARANCE CERT
VAPT DELIVERABLES MATRIX
Testing Methodologies, Standards & Turnaround Times
Standardized VAPT tracks engineered for regulatory and enterprise assurance.
| Track Code | Penetration Test Type | Testing Approach | Standard Duration | Included Deliverables |
|---|---|---|---|---|
| VAP-01 | External & Internal Network VAPT | Black-Box & Grey-Box (PTES / NIST) | 5 – 10 Business Days | Technical Report, AD Path Graph & Retest |
| VAP-02 | Web Application & API VAPT | Authenticated Grey-Box (OWASP WSTG) | 5 – 10 Business Days | PoC Screenshots, Code Fixes & Clearance Cert |
| VAP-03 | Android & iOS Mobile App VAPT | Binary Reverse Eng. (OWASP MASVS) | 5 – 8 Business Days | Decompiled Code Audit, API Trace & Retest |
| VAP-04 | Cloud & Container Security Audit | White-Box IAM/Config + Black-Box | 4 – 7 Business Days | CIS Benchmark Map, Attack Paths & IaC Fixes |
| VAP-05 | Full Adversary Red-Team Exercise | Covert Objective-Based (MITRE ATT&CK) | 2 – 4 Weeks | Purple-Team Debrief, Detection Gaps & Executive Brief |
TECHNICAL KNOWLEDGE BASE
Frequently Asked Engineering & Procurement Questions
Direct answers from Dulo Tech Limited's Principal Systems Architects, CSOC Directors, and Institutional Procurement Officers at Mirage Towers, Nairobi.
No. Our engineers follow strict Rules of Engagement (RoE), avoid destructive denial-of-service payloads on production systems, and can perform intrusive tests against staging environments or during off-peak maintenance windows.
Black-Box simulates an external unauthenticated hacker with zero prior knowledge. Grey-Box simulates a logged-in user or compromised employee workstation—uncovering deeper privilege-escalation flaws. White-Box includes full source-code and architecture review.
We do not wait until the final report. Any Critical or actively exploitable vulnerability is escalated via encrypted channel to your CISO/IT Director within 1 hour of discovery so you can patch it immediately.
Yes. Alongside the confidential technical report, we issue a formal Letter of Attestation / VAPT Clearance Certificate suitable for sharing with regulators (CBK, ODPC), auditors, and enterprise B2B clients.
Yes. Every VAPT engagement includes a live technical workshop with your developers and network engineers to walk through exact code patches and firewall configurations.
Regulators and ISO 27001/PCI-DSS standards mandate formal VAPT at least annually, as well as after any major application release or network architecture change.
Provide the number of web/mobile apps, API endpoints, or IP addresses in the form below for a same-day fixed-price proposal.
Need direct architectural clarification?
Call +254 799 000 595
DIRECT DISPATCH DESK
Request Technical Briefing or Tender BOQ Quote
Routed directly to our Senior Engineering Board at 12th Floor, Mirage Towers, Westlands, Nairobi.