We put your security to the test. Before an attacker does.
Penetration testing, security audits, cleanup of compromised websites and hardening. We find the holes, explain how much they matter and, if you want, close them ourselves.
- check_circleTesting only with written authorization
- check_circleA readable report, ranked by severity
- check_circleFixes made by developers
In short
Shellonback is a software house based in Turin, Italy, offering cybersecurity services to companies, e-commerce businesses and agencies: penetration testing of web applications, APIs, mobile apps and cloud infrastructure, vulnerability assessments, security audits of code and configuration, cleanup of compromised websites (WordPress included) and hardening. Every engagement starts from an agreed scope and written authorization, and ends with a report that ranks issues by severity. Being developers, we can fix the vulnerabilities as well as find them.
Has your website been compromised?
Odd redirects, pages you never wrote, warnings from Google or your hosting provider: message us now and we start from the cleanup.
Does any of this sound familiar?
Your website or back office has been online for years and nobody has ever checked its security
A customer, a tender or an insurer asks you for a recent penetration test or audit
Your site was hacked: spam, redirects, a “dangerous site” warning or a hosting suspension
Plugins, libraries and servers have not been updated in a long time and nobody knows what is exposed
What we do
From testing to fixing, under one roof.
Penetration testing
We simulate a real attack on web applications, APIs, mobile apps and cloud infrastructure, with manual testing on top of automated tools.
- checkOWASP references
- checkDocumented proof of exploitation
- checkRetest after the fixes
Vulnerability assessment
A map of what is exposed and what is vulnerable: services, versions, weak configuration, dependencies with known flaws.
- checkExposed surface
- checkKnown vulnerabilities
- checkFix priorities
Security audit
We review code, cloud configuration, access management, backups and procedures, and tell you where you are exposed.
- checkCode review
- checkAWS and server configuration
- checkAccess, backups and logs
Cleanup of compromised websites
We remove the malware, work out how they got in and close the entry point, so it does not come back a week later.
- checkWordPress and other CMSs
- checkBlacklist removal
- checkRecovery and securing
Hardening
We bring servers, cloud and applications to a solid configuration: updates, least privilege, perimeter protection, verified backups.
- checkUpdates and patching
- checkMulti-factor authentication
- checkWeb application firewall and monitoring
Secure development
We work alongside your team so security becomes part of the development cycle: reviews, automated checks in the pipeline and vulnerability fixes.
- checkSecurity code review
- checkCI/CD checks
- checkVulnerability fixes
How we work
A clear path, with no surprises on your systems.
- 1
Scope and authorization
Together we define what is tested, when and within which limits. We only start with written authorization and a confidentiality agreement.
- 2
Analysis and testing
We gather information, look for vulnerabilities and manually verify the ones that matter, without putting your data or service continuity at risk.
- 3
Report
You receive a document with a summary for decision makers and the technical detail for those who fix: severity, evidence, impact and remedy for each issue.
- 4
Fixing
Your team can make the fixes following the report, or we can make them: it is what we do every day.
- 5
Retest
Once the fixes are in, we repeat the checks on the reported issues and update the report.
Why Shellonback
We find and we fix
We are developers: the report does not end up in a drawer, because we can make the fixes ourselves.
Plain language
Every issue has a severity, evidence and a remedy. No endless lists pasted from a scanner.
Web, cloud and code
We work on applications, AWS and pipelines every day: we know the systems we test from the inside.
Confidentiality
A confidentiality agreement before we start, and results shared only with the people you name.
Frequently asked questions
What is the difference between a vulnerability assessment and a penetration test?add
A vulnerability assessment lists the vulnerabilities present, mostly with automated tools. A penetration test goes further: a specialist actually tries to exploit and chain them, to see how far an attacker could get.
Can the test take my site down or damage data?add
Scope and methods are agreed beforehand. We avoid destructive techniques and, whenever possible, work on a test environment or during low-traffic hours.
Can you test any website?add
No. We only test systems you own or for which you hold written authorization from the owner. Without authorization we do not start.
My website was hacked: what should I do right now?add
Do not delete anything and do not blindly restore an old backup: you may lose the traces of how they got in. Change your passwords, tell your hosting provider and message us: we start from the cleanup and from working out the entry point.
What do I get at the end?add
A report with a non-technical summary and the detail of each issue: severity, evidence, impact and recommended remedy. After the fixes, the updated verification.
Do you fix the issues after the report?add
If you want us to, yes. We can hand the report to your team or take care of the fixes and the hardening ourselves.
Want to know how exposed your company is?
Tell us what you want to check: we will suggest the scope and the kind of engagement that fits.
Your cookie preferences
We use cookies to keep our site secure and user-friendly, and to carry out the activities stated below.
You can customize your cookie preferences at any time by toggling the options on or off.
For more information, have a look at our Privacy and Cookie Policy Privacy and Cookie Policy
Manage consent preferences
Profiling cookies
Profiling cookies are used to provide you with customized services and send you targeted advertising messages in line with the preferences you expressed when browsing our website. They help us to implement behavioral advertising, measure the effectiveness of our ads, and customize the services offered in line with your behavior. These cookies may be set by us or by third-party providers whose services we've added to our pages.
Analytics cookies
Analytics cookies track the traffic and performance of a website, and their analysis generates aggregated statistics. They help us to know which pages are the most and least popular and how you move around the website. These cookies may be set by us or by third-party providers whose services we've added to our pages.
Technical cookies
Always activeTechnical cookies are essential for our site to work correctly and to provide the service you requested.
Functional Cookies
Always activeThese cookies enable the website to provide enhanced functionality and personalisation. They may be set by us or by third party providers whose services we have added to our pages. If you do not allow these cookies then some or all of these services may not function properly.