• View Cart
  • Blog
  • Lei / Euro
What we do

What we test, and how

Web application penetration testing

Authentication and sessions, what one account can reach of another, how input is handled, file uploads, and the API behind the page. Tested by hand with the usual toolchain, not a scanner report handed over as it came.

Red teaming on an agreed scenario

We work towards a goal you set, inside the scope you set. At the end you also learn what your own logs and alerts caught, and what they missed.

Security assessment of the server and its configuration

Versions and patch level, PHP and web server settings, TLS and security headers, what listens on the network, who can read the logs, and how far a single compromised account would get.

Report, fixes, retest

Every finding with the steps that led to it, what it allows, how serious it is and what to change. We can apply the fixes with you, and we test the same things again afterwards.

How it runs

Nothing is touched before the paperwork

Scope and written authorisation first

Before anything runs we agree in writing what may be tested, from which addresses, in what window, and what stays out. If the system is not yours, we need authorisation from whoever owns it. Without that we do not start.

We keep a record of what we ran and when, from known addresses. Anything odd in your own logs during that window can be matched against ours, and one phone call stops the work.

You get the findings ranked by what they actually allow, with the steps to reproduce them and what to change, plus a short summary for people who do not read code. After you fix them, we test the same things again.

Security testing: penetration testing, red teaming, security assessment - Scope and written authorisation first
Security testing: penetration testing, red teaming, security assessment - Work you can trace back to us
Security testing: penetration testing, red teaming, security assessment - A report, then a retest
Our own tools

We build the monitoring we use

audit.crocky.host, a public automated audit

A free audit of any public site: performance, SEO, security headers and TLS, hosting, accessibility and more. No signup, and the method behind every check is written out on its own page.

Open the audit
Request logging and detection on our own network

Every request to the sites we run passes through our own logger, which recognises probing and shuts it out. We watch it the way we would watch a client network, because it is where our clients live.

Configuration that is checked, not assumed

The settings that matter are verified on a schedule on every site we run, and we are told when one disappears after a panel update. A setting nobody checks is not a control.

Vulnerability response

When something is published that affects what we run, we measure our own exposure first, apply the mitigation the vendor documents, and keep it under watch until the real fix is in place.

Questions

Before you ask for a test

Do you work on systems you do not host?

Yes. Most of what we look at is somewhere else. We need written authorisation from whoever owns the system, and from the hosting provider where their terms ask for it.

Tell us what you want tested.

Write to us with what the system does and who owns it. We come back with a scope, a window and a price.

Write to us Run a free audit

CROCKY S.R.L., VAT RO50515950, Trade Register J2024020698007
Str. Drăgaica nr. 5, Balasan, Băilești, Dolj county, 205101, Romania

ANPC – Alternative dispute resolution

Supported payment methods

Copyright © 2026 CrockyHost. All Rights Reserved.
  • English
    English
    Română
    No Records Found
  • Terms and conditions
  • Privacy policy
We only use cookies strictly necessary for the website and client area to work. We do not use advertising or tracking cookies. More in our Cookie Policy