Authorised scope document
Which domains, IPs and applications will be tested, by which method and in which time window, is written down before testing starts. Nothing outside the scope is touched.
DOKI / Cybersecurity
Cybersecurity · Testing
We test your website, applications and servers only on targets you have authorised in writing. Findings are reported with evidence, severity and a recommended fix, and closure is confirmed by a retest.
- Authorized scope
- Risk table
- Finding evidence
- Remediation plan
01 / What this service includes
Written scope, open method, evidenced results.
Manually verified findings
Tool output does not go into the report as-is. Every finding is confirmed by a specialist, false positives are removed and the real impact is explained.
Prioritised report
The report consists of an executive summary, a risk table, step-by-step reproduction notes and remediation advice. It states clearly which item to handle first.
02 / How it works
The five areas a test covers
Scope differs in every project; the sample view below shows how emphasis is spread in a web application test.
AuthenticationAuthorisationInput and dataConfigurationBusiness logic
03 / Scope
Let's define the scope together.
We clarify the scope, deliverables and acceptance criteria together in the first meeting. The written quote lists that scope item by item; if the scope changes, the quote is updated as a new version.
Only explicitly authorized assets and agreed scope are assessed.
Deliverables
- 01Authorized scope
- 02Risk table
- 03Finding evidence
- 04Remediation plan
04 / Process
How we move forward, step by step.
Each step ends with something concrete in your hands; we move on with your approval.
- 01
Scope
Together we put the goal, the boundaries and the acceptance criteria in writing.
- 02
Assessment
We assess the current state against agreed criteria and note gaps with evidence.
- 03
Reporting
We share what was done, the result and the next step in a plain report.
- 04
Retest
We retest fixed findings and confirm with evidence that they are closed.
05 / Scope
6 layers, 89 test categories
6 layers, 89 test categories, more than 100,000 automated security checks and 24/7 monitoring: from your website to your network, from your staff to your cloud infrastructure, under one roof.
- 6security layersWeb · Network · People · Cloud · Code · Mobile
- 89test categories
- 100,000+automated security checks
- 1,700+attack techniques and scenarioscontrolled simulation
- 600+cloud configuration checks
- Thousandsup-to-date vulnerability templates
- 24/7continuous monitoring option
Test categories, layer by layer
Open a layer; we have briefly written what each category is and why it matters.
Web / site layer
Thousands of up-to-date vulnerability templates and more than 100,000 known vulnerability signatures are scanned in the background.Number of categories: 46
The web layer goes four levels deep. Which depth is applied depends on your target and scope.
Basic8
- 01
SSL/TLS configuration
We check that the encrypted connection between your site and its visitors is set up correctly, the certificate is valid and old, weak encryption methods are switched off.
- 02
Known vulnerability (CVE) scan
We check whether the software and plugins on your site are versions listed among publicly announced vulnerabilities (CVE).
- 03
SQL injection
We test whether data typed into forms and URL fields can reach the database as a command. This flaw can lead to customer data being stolen.
- 04
Cross-site scripting (XSS)
We check whether an attacker can plant malicious code on your pages that runs in your visitors' browsers.
- 05
Exposed admin panel and default password
We check whether admin logins are unnecessarily open to the internet and whether default passwords left from installation have been changed.
- 06
HTTP security headers
We check whether the security settings that tell the browser how to protect your pages are missing or wrong.
- 07
Email protection records (SPF, DKIM, DMARC)
We check the DNS records that make it harder for others to send fake email in your domain's name.
- 08
Information leakage (robots and sitemap)
We check whether the public robots.txt and sitemap files reveal addresses that should stay private.
Intermediate10
- 09
Cross-site request forgery (CSRF)
We test whether a logged-in user can be made to perform an action from another site without knowing it, such as changing a password or email.
- 10
Directory and file listing
We check whether the server shows the contents of its folders to anyone as a list.
- 11
Sensitive file access
We test whether files that should not be public, such as backups, configuration or log files, can be reached by their address.
- 12
API endpoint security
We check whether the services your application talks to in the background (APIs) hand out data to unauthorized requests.
- 13
Payment page (basic PCI checks)
We check whether the payment steps are protected in line with the basic expectations of the card security standard (PCI DSS). This is not a certification.
- 14
Session and cookie security
We check that the session information issued after login is set up correctly against theft and impersonation.
- 15
Open redirect
We test whether a link on your site can be abused to send visitors to a fake site chosen by an attacker.
- 16
Clickjacking
We check whether your page can be embedded invisibly inside another site so that visitors click a button they never meant to.
- 17
CORS configuration
We check the setting that decides whether sites on other domains can read your data through a visitor's browser.
- 18
Error message leakage
We check whether error pages show details that give an attacker clues, such as server, database or code information.
Comprehensive12
- 19
Advanced SQL and NoSQL injection
We dig into hidden (blind) injection paths that basic tests miss, and into techniques specific to different database types.
- 20
Business logic flaws
We look for gaps in the application's rules that tools cannot find on their own, such as using a discount twice or skipping a step to complete an order without paying.
- 21
File upload security
We test whether a harmful file, such as code that could run on the server, can be uploaded through upload fields.
- 22
Subdomain takeover
We check whether subdomains you no longer use but whose DNS records remain, such as an old campaign address, can be taken over by someone else.
- 23
Brute force and rate limiting
We test whether login and form fields stop thousands of attempts made one after another.
- 24
Third-party integrations
We check whether the outside services connected to your site, such as payments, maps or live chat, are used securely.
- 25
Server-side request forgery (SSRF)
We test whether your server can be tricked, with an address supplied from outside, into sending requests to systems on its own internal network.
- 26
XML external entity attack (XXE)
We test whether files on the server can be read through fields that accept XML files.
- 27
Insecure deserialization
We check whether the application safely unpacks packaged data coming from outside. This flaw can go as far as remote code running on the server.
- 28
JWT and token security
We check whether the signature, lifetime and storage settings of login tokens hold up against forgery and theft.
- 29
WAF configuration
We check whether your web application firewall (WAF) really stops known attacks and whether it can be bypassed.
- 30
Input testing (fuzzing)
We automatically send unexpected, malformed and overly long data to fields to see whether the application breaks or a vulnerability appears.
Advanced16
- 31
GraphQL security
In APIs that use GraphQL we test for flaws specific to this technology, such as an exposed schema, overly deep queries and missing permission checks.
- 32
HTTP request smuggling
We test for the flaw that arises when the servers in front of your site (load balancer, cache) and the server behind them read requests differently, which can interfere with other users' requests.
- 33
Template injection (SSTI)
We test whether data that enters page templates can be run as code on the server.
- 34
Command injection
We test whether an attacker can add their own command to the commands the application runs on the server.
- 35
File inclusion (LFI / RFI)
We test whether a page can be forced, through its address, to pull in a file from the server or from outside.
- 36
CRLF injection
We check whether user data can slip into the server response with line-break characters and create fake headers or content.
- 37
Prototype pollution
In JavaScript-based applications we test whether the basic structure of objects can be changed from outside to alter how the application behaves.
- 38
Web cache poisoning
We test whether a harmful copy of a page can be stored in the cache and then served to other visitors.
- 39
Host header injection
We check whether changing the domain information in a request can point content such as password reset links to an attacker's address.
- 40
Insecure direct object reference (IDOR)
We test whether changing a number in the address gives access to another customer's order, invoice or document.
- 41
Leaks in client-side files
We scan the JavaScript files sent to the browser for forgotten keys, hidden addresses or internal information.
- 42
Hidden parameter discovery
We find hidden fields that forms do not show but the application accepts, and test whether they can be abused.
- 43
Technology fingerprinting
We work out how easily outsiders can tell which software, server and versions your site uses. This is the first thing an attacker does.
- 44
In-depth CMS scan
In content management systems such as WordPress, we scan the core, theme and plugins one by one for known flaws and misconfigurations.
- 45
Visual reconnaissance
We capture screenshots of the pages linked to your domain in bulk and quickly pick out risky screens such as forgotten test pages and exposed panels.
- 46
Race conditions
We test whether rules can be bypassed by sending the same action many times at once, such as using a single-use coupon twice.
Network layer
More than 100,000 known vulnerability signatures are matched against your network services.Number of categories: 20
- 47
Open port scan
We list the doors (ports) you have open to the internet and identify which ones were left open for no reason.
- 48
Service and version detection
We identify which software, in which version, runs on each open port; an old version often means a known vulnerability.
- 49
Vulnerability (CVE) matching
We match the service versions we find against known vulnerabilities and rank them by risk.
- 50
Firewall check
We verify from outside that your firewall lets through only the traffic it should.
- 51
Detailed port scan (including UDP)
We scan the full port range, including the often-overlooked UDP services, to find services that stayed hidden.
- 52
In-depth SSL/TLS analysis per service
Not just your website: we also examine the encryption settings of email, VPN and other services one by one.
- 53
Default credentials
We check whether devices such as routers, cameras, printers and servers still use their factory usernames and passwords.
- 54
Mail server security
We check whether your mail server can be used by others to send spam and whether it allows unencrypted connections.
- 55
DNS zone transfer
We check whether your DNS server hands all of your domain records to anyone who asks for them.
- 56
Internal network segmentation analysis
We test that your network is split into proper segments, for example that the accounting server cannot be reached from the guest network.
- 57
VPN and remote access security
We check whether remote access points are up to date, use strong authentication and are free of known vulnerabilities.
- 58
Misconfiguration scan
We look for settings on servers and network devices that are wrong or left too loose.
- 59
Vulnerability chaining analysis
We assess how serious an attack several vulnerabilities that look minor on their own could become when used one after another.
- 60
Controlled vulnerability validation
We prove that a vulnerability we found can really be exploited, without harming your systems and within the limits you allow; this is how we weed out false alarms.
- 61
File sharing (SMB) analysis
We check whether shared folders are open to unauthorized people and whether the sharing service has known vulnerabilities.
- 62
SNMP service analysis
We check whether the SNMP service that manages network devices gives away device information using default access settings.
- 63
Active Directory security
We examine weak settings and privilege paths in Windows user and permission management (Active Directory) that could lead to the whole network being taken over.
- 64
Remote desktop (RDP) security
We check whether remote desktop access is open to the internet, whether it is up to date and whether it is protected against password guessing.
- 65
VoIP and SIP security
We check whether your internet phone system is protected against eavesdropping, misuse and toll fraud.
- 66
IPv6 security
We check whether services closed off on IPv4 remain open through newer IPv6 addresses.
People / process layer
Most attacks start with an email or a phone call. We measure how prepared your staff and processes are for that.Number of categories: 14
- 67
Email awareness assessment
We measure how well your staff recognise suspicious emails.
- 68
Corporate email protection compliance
We check whether your company email's protection against spoofing, phishing and malicious attachments follows good practice.
- 69
Open-source information leakage (OSINT)
We find out how much information useful to an attacker is available about your company and staff in public sources.
- 70
Controlled phishing simulation
With your prior approval we send harmless fake emails and measure how many people click the link or enter details. Nobody is punished; the aim is training.
- 71
Password policy and multi-factor authentication review
We review your password rules and whether a second verification step (MFA) is switched on for critical accounts.
- 72
In-depth OSINT and social media analysis
We uncover the targeted scenarios an attacker could build from key employees' social media and public profiles.
- 73
Comprehensive phishing campaign
We run a measured phishing programme in several waves with different scenarios and report the progress over time.
- 74
Phone-based social engineering (vishing)
With your written approval we test whether a caller posing as someone else can get information or actions from your staff.
- 75
Physical security awareness
We assess your staff's awareness of physical risks such as unauthorized entry to the office, documents left on desks and unlocked screens.
- 76
Reporting and staff training recommendations
We report the results without blaming individuals and recommend training topics and frequency that suit your team.
- 77
Lookalike and fake domain detection (typosquatting)
We detect fake domains that closely resemble yours and were registered to deceive your customers.
- 78
Leaked password and data breach check
We check whether your company email addresses have circulated together with passwords in past data breaches.
- 79
Document metadata leakage
We scan the PDFs and office documents published on your site for hidden details left inside, such as usernames, software versions and folder paths.
- 80
Corporate code repository leak analysis
We search public code repositories for code, passwords or keys belonging to your company that may have leaked.
Cloud layer
More than 600 cloud configuration checks for AWS, Azure and Google Cloud.Number of categories: 4
- 81
Cloud configuration audit
We audit your AWS, Azure and Google Cloud accounts with more than 600 checks covering permissions, logging, encryption and network settings.
- 82
Exposed cloud storage detection
We check whether file storage in the cloud (buckets) has been left open to everyone on the internet by mistake.
- 83
Kubernetes security
We review the access, permission and network settings of your container platform against secure configuration guidelines.
- 84
Container image vulnerability scan
We scan the container images your applications are packaged in for outdated components with known vulnerabilities.
Code / development layer
We catch vulnerabilities inside the code, before the application goes live.Number of categories: 4
- 85
Static source code security analysis
We examine the code without running the application and find, line by line, the mistakes that lead to vulnerabilities.
- 86
Dependency and library vulnerability analysis
We identify versions with known vulnerabilities among the ready-made libraries your code uses.
- 87
Infrastructure-as-code (IaC) analysis
We catch insecure settings in the code files that build your servers and cloud resources, before those resources are even created.
- 88
Secret and key leak scan in code repositories
We scan your code repository, including its history, for passwords, API keys and access details written into it by mistake.
Mobile layer
We examine your Android and iOS app both through its code and while it runs.Number of categories: 1
- 89
Android and iOS app security analysis (static and dynamic)
We examine your app both through its code and while it runs: data storage on the device, network traffic, authentication and the app's own protection.
Ongoing enterprise service lines
Beyond testing: continuous monitoring, response, simulation and consulting.
- External attack surface management (ASM)Every asset you expose to the internet (domains, servers, panels) is monitored continuously; you are told about a newly opened door or a certificate about to expire.
- 24/7 security monitoring (SOC)Logs from your systems are monitored without interruption and an alert is raised when something looks suspicious. The extent of human review depends on the monitoring level you choose.
- Emergency incident response and forensicsFast response during an attack: stopping the spread, preserving evidence and working out step by step what happened.
- Threat intelligenceWe give you advance information about current threats aimed at your sector and the technologies you use, and update your defences accordingly.
- Attack simulation and purple teamingWith more than 1,700 attack techniques and scenarios we test, together with your team and in a controlled way, whether your defences spot attacks.
- Deception and decoy systemsDecoy systems and fake credentials that look real are placed on your network; if anyone touches them, the attacker is spotted early.
- Compliance readiness consulting (KVKK, ISO 27001, PCI DSS)We identify the gaps and prepare a roadmap to get you ready for these requirements. We are not a certification body; we help you prepare for the audit.
- Password strength auditWith your permission we measure how well the passwords on company accounts resist guessing. We never share the passwords themselves; we only report the weak accounts.
- Security automation (SOAR)We turn repetitive response steps, such as blocking a suspicious address and notifying the right person, into automated workflows, so incidents get a faster and more consistent response.
The figures are the number of checks in our automated security engines. Not every category runs in every test; the ones that fit your target and scope are selected.
Every test runs with your written permission and within the scope we agree together. Tests that could disrupt a service, and social engineering, are planned only with separate written approval. No test proves that a system is completely secure; we report clearly what was and was not found.
DOKI / Cybersecurity
Security testing packages
89 test categories across six layers is our upper scope; not all of them are applied in every test. Which categories are applied is agreed together based on your target and package. Tests that could disrupt a service and out-of-scope assets are not included; social engineering is planned only with separate written approval. One retest within 30 days of the report is included in the price.
06 / Decision details
What to know before you ask for a quote.
What is included, what we need from you, timing and payment, all in one place. The exact scope and price are set in the written quote.
Included
- Black-box or grey-box method, your choice.
- An executive summary and a risk table.
- Evidence, a risk level (critical, high, medium, low) and a fix recommendation for every finding.
- Findings are checked by hand before the report reaches you; raw scanner output is never sent.
- One retest within 30 days of the report is included in the price.
Not included
- Fixing the findings (offered separately as Remediation).
- Tests that could disrupt a service (only with separate written approval, in a controlled setting).
- Phishing and phone-based social engineering (each needs separate written approval).
What we need from you
- A signed written authorisation.
- A scope list: domains, IP addresses, applications and the date range.
- Test accounts for a grey-box test.
- An emergency contact who can be reached during testing.
Timing and delivery
- Tests run on weekdays between 09:00 and 18:00 (Türkiye time).
- The length of the test depends on scope and is stated in the quote.
What sets the price
- Number of web assets (one domain, its subdomains and one connected application).
- Number of network blocks (up to 256 IP addresses each).
- Package level: Starter, Standard or Comprehensive.
Payment and aftercare
- For work agreed in person, the full fee is paid at the start.
- For remote work, half is paid at the start and half on delivery.
- We respond to every request within 12 hours.
- Meetings are held in Turkish; correspondence and deliverables are handled in the language of your choice with translation support.
- We work in person in Istanbul and remotely across Türkiye and worldwide.
07 / FAQ
The questions on your mind.
Tell us what you need; we will define the scope together.
Tell us about your projectWill our site go down during the test?
Attempts that could disrupt service are agreed separately in the scope document and are not performed by default. Test hours are set with you; if an unexpected effect appears, work stops and you are informed.
Is permission needed before testing?
Yes. Only systems you are authorised for and have approved in writing are assessed.
Will testing affect my live system?
Scope, time window and methods are agreed in advance; risky steps require your separate approval.
Let's begin
Let's talk about your project.
Tell us what you need; we will define the scope together.