Get a quote
Menu

Internet, mobile and AI penetration testing, San Diego

Need a pentest? We test by hand, explain in plain English and help you fix what we find.

For companies without a security team. The report is written so your customer and your developers can both read it, and once you've fixed what we found, the retest is free. Small jobs welcome.

Get a quote →Download the sample report

Rob Pope · founder

You don't have to be a security guru

Leave the technical side to us. We'll work out with you what needs testing, then make sure the report answers the questions your customer or auditor actually asked.

What we test

How it works

  1. Scoping call

    A short, free call about what you've built and who's asking for the test.

  2. Quote & schedule

    We tell you how many days the test needs, so you know the exact price before anything starts. Then we pick dates together.

  3. Test, report, retest

    We test, write the report and walk your team through it. Once you've fixed the issues, the retest is free.

What you get

A report your developers can act on and your customer can read.

Section 3.2High

SQL injection in the video search

The q parameter on /share/search is passed to the database unescaped. A crafted search returns direct download links for content the signed-in user is not allowed to see.

Evidence
GET /share/search?q=' UNION SELECT id,path FROM assets--
200 OK   48 rows   (user is permitted to view 6)
Recommendation

Switch the search query to a parameterised statement. Until then, reject quotes and SQL keywords in q at the application layer. Retest once deployed.

Escaped · Sample report10 / 14
  1. 1
    Severity you can defend. Each finding is rated High, Medium or Low with the reason spelled out, so you can answer a customer's "how bad is this?" without calling us.
  2. 2
    Evidence, not opinion. The exact request that proves the issue, so your developer can reproduce it in minutes.
  3. 3
    A fix, and a stop-gap. What to change properly, and what to do today if the proper fix takes a sprint.

$1,200 per day. Most small jobs take between one and five days. See pricing

Who you'll work with

Escaped is run by Rob Pope, who has broken into systems for a living for most of his career. Before Escaped he founded two security firms, SecureTest and Vigilante Bespoke, and co-founded Dogtown Media, a mobile app studio. You'll deal with Rob directly, from the first call to the retest.

More about Rob

Ready when your customer is

Download the full sample report, or tell us what you need tested and you'll have a quote after a short call.

Get a quote →Download the sample report