Cybersecurity consultancy
Madrid · remote
First, weunderstand it.Then webreak it.
Cybersecurity consultancy for small and mid-sized companies. Before we attack anything, we learn how the business works. We use AI tooling to cover more ground and verify every vulnerability by hand, with a working proof of concept.
We also review and maintain online storesApproach
01
A scanner tells you what might be wrong. We show you what is wrong, and how it is exploited.
Automation covers ground. It finds the forgotten service, the unpatched version, the parameter that answers oddly. We use it, and we use it heavily: it is the only way to look at an entire surface without leaving gaps.
What automation does not do is tell a false positive from a way in, or chain three minor flaws into access to the database. That is done by a person sitting in front of the system.
So every finding in our reports has been reproduced by hand. If we could not exploit it, we do not call it a vulnerability.
01
Automated coverage
Our own tooling and third-party tooling to enumerate the whole surface, not a sample of it.
02
Manual verification
Every finding is reproduced by hand. What cannot be reproduced is not reported.
03
Proof of concept
A request, a script or a video. Something your team can run and watch fail.
04
Impact, explained
What is reached, with what privilege, and what happens next. No hollow risk scores.
Services
02
Four security jobs. Four for the store that sells.
Security
- 01External perimeter testWe enumerate everything your organisation exposes to the internet and attack it from outside, with no credentials, the way someone who has just found you would.
- 02Authenticated web application pentestWe log in with a user for each role and look for what a scanner cannot tell apart: broken business logic and permissions that fail to separate what they should.
- 03Internal test / Active DirectoryWe start from a machine inside the network, with the credentials of any ordinary employee, and measure how far that gets.
- 04Fix verification retestWe go back over every finding in the previous report and check whether the fix holds. We reopen whatever is still exploitable.
Online stores
We review, improve and maintain your store. Every change is tested before publishing, and a copy of the previous state is kept.
- 05Online store technical reviewWe open the store as a shopper would and look at what is not on the surface: surplus scripts, weight, mobile, analytics and third-party access.
- 06Product page and enquiry improvementsConcrete changes to the product page and the enquiry, aimed at removing steps for the buyer. Each one is tested before publishing and can be switched off.
- 07Online store maintenanceThe store keeps running after delivery: campaigns, small changes, new scripts and fixes, with a record of everything.
- 08Online store security reviewWe look at the part of the store that is actually yours: the site, email, access and third-party scripts. The platform, only with the provider's permission.
Scope is agreed in writing before we start. Write to us and we will define it.
How we work
03
Five steps. The third is the one that sets us apart and the one that takes longest.
01
Scope
We define in writing what is in, what is out and where we attack from. Nothing is touched without signed authorisation.
02
Reconnaissance
We map the whole surface with heavy automation. This is where AI lets us cover more ground than one person would cover alone.
03
Manual verification
We sit down in front of every candidate and either exploit it or discard it. False positives die here, not in your inbox.
04
Report
Every vulnerability with its working proof of concept, the real impact and the concrete fix. Written so that whoever decides can follow it and whoever writes the code can apply it.
05
Retest
Once you have fixed it, we try again. Only then do we call a finding closed.
Who does it
04
A consultancy specialised in offensive security. We find vulnerabilities and verify them by hand.
Bug bounty · as a hobby
Programmes and platforms where the founder hunts for vulnerabilities in his spare time.
- Google VRP
- Microsoft MSRC
- HackerOne
- YesWeHack
- Bugcrowd
- Intigriti
Alan Ortega Álamo
Founder · technical work
Bug bounty is a hobby here, not the business: three fixes of his own merged upstream —grpc-go (fixed and rewarded by the VRP), protobuf-go and go-ethereum— and a report currently open with Microsoft MSRC.
- grpc-go
- Google VRP · Insufficient check in the RBAC Authenticated matcher
- Fixed · credited · rewarded by the VRP
- See the PRRelease notes
- go-ethereum
- Ethereum open source · Encoding bug in the Gloas execution request list
- Fixed · own patch merged upstream
- See the PR
Finding record
Only findings already fixed and public. Open reports are not detailed.
Open reports
There is a report in progress with Microsoft MSRC. Pending resolution. Once it closes and becomes public, it gets counted here.
FAQ
05
What is worth knowing before you commission a pentest.
All questionsHow is this different from a vulnerability scan?
A scanner returns a list of candidates: things that might be wrong. We use those tools to cover the surface, and then we try to exploit every candidate by hand.
Whatever we cannot reproduce stays out of the report, and whatever goes in comes with its proof of concept.
How much does it cost?
We do not publish rates because the work changes a great deal with scope: a single domain is not an internal network with Active Directory.
We agree the scope in writing first, and the price is given for that specific scope, before we start.
What do you need from us to start?
Written authorisation from the owner of the systems and an agreed scope: which domains, ranges or applications are in and which are out. Without that, nothing is touched.
Depending on the service, also: one user per role for the web application pentest, or a machine inside the network with an ordinary employee’s credentials for the internal test.
Are you a certification body? Does the report count for ISO 27001, ENS or NIS2?
We are not a certification body or an accredited organisation, and the report does not certify compliance with any standard.
What it documents is what was tested, which vulnerabilities were verified and how to fix them. If a compliance process asks you for technical evidence, that is the information you can provide; whether you comply is decided by whoever audits that standard.
Contact
06
Tell us what you want us to look at. We answer if we can help, and we say so if we cannot.
contacto@nodumsec.comAfter you write
- 01
Reply
We read every message and answer from a nodumsec.com address. If we cannot help, we say so.
- 02
Scoping call
A short call to understand what you want tested, from where and by when.
- 03
Proposal
We send you the scope, the dates and the price in writing. If you accept, the contract and the authorisation are signed before any system is touched.
Or write from here