Blog on Penetration Testing & Security Audits | VidraSec

How Much Does a Penetration Test Cost?

Wed, 08 Jul 2026 00:00:00 +0000

“What does a pentest cost?” is the question I get asked the most, and the honest answer is always “it depends.” That’s not a dodge. A pentest is billed by effort, not sold as a fixed product, so the real question underneath it is what decides how much effort a given project actually needs. This post explains exactly that.

VidraCrypt: Zero-Knowledge File Sharing in the Browser

Mon, 06 Jul 2026 00:00:00 +0000

During a pentest, I regularly need to send clients things they really don’t want lying around in an inbox: the final report, extracted credentials, a dump used as proof for a finding. Email and generic file sharing tools are a bad fit for that. So I built VidraCrypt (opens in a new tab), a small open-source tool that decrypts files entirely in the browser, with the server never seeing the passphrase or the plaintext.

Pentest Provider Checklist for DACH SMBs

Sat, 13 Jun 2026 00:00:00 +0000

Choosing a penetration testing provider is hard when you are not a security specialist yourself, which is the situation most SMBs are in. The market is full of confident sales pitches, and the difference between a genuinely useful test and an expensive compliance checkbox is not obvious from a brochure. This checklist gives you the specific questions to ask and what good answers sound like.

What a NIS2-Ready Pentest Looks Like for a 50 to 500 Person Company

Thu, 11 Jun 2026 00:00:00 +0000

NIS2 has pulled thousands of mid-sized companies into a compliance regime they never had to think about before. If you run IT at a 50 to 500 person company in the DACH region, you have probably been told you need to “do something about NIS2,” and that a penetration test is part of it. This article explains, plainly, what a NIS2-ready pentest actually looks like and what auditors expect to see.

Boutique Single-Operator Pentest vs. Large Firm vs. PTaaS: How to Choose

Tue, 09 Jun 2026 00:00:00 +0000

You need a penetration test, and the market offers three very different shapes of provider: the boutique single operator, the large security firm, and the PTaaS platform. They are priced differently, they deliver differently, and they are not interchangeable. This guide compares them on the factors that actually change the outcome.

Phishing Defense: Why Awareness Training Is Not Enough (And What to Do Instead)

Mon, 08 Jun 2026 00:00:00 +0000

Security awareness training is valuable. Recognizing suspicious emails, questioning unexpected login requests, and knowing what phishing looks like: all of that makes attacks harder.

But here’s the honest truth: with enough effort, anyone can be phished. I run simulated phishing campaigns for clients regularly as part of Cyber Attack Simulation engagements, and I have never failed to catch at least a few users, no matter how good their training is.

The Penetration Testing Buyer's Guide: Scope Right, Spend Smart

Tue, 02 Jun 2026 00:00:00 +0000

You’ve decided you need a penetration test. Good call. But before you sign a proposal, there’s a lot that can go wrong: wrong scope, wrong methodology, wrong expectations. The result is a report that collects dust and a budget that got wasted.

This guide is written for the people buying pentests, not the people running them. It covers what a pentest actually is, when to do one, what to expect, and how to avoid the most common and expensive mistakes.

Bypassing BitLocker Without a Screwdriver: bitpixie and What You Can Do About It

Tue, 10 Mar 2026 00:00:00 +0000

BitLocker is always a topic in Windows client pentests. For full-disk encryption not to be easily bypassed, BitLocker must be configured securely.

There is in fact a vulnerability that can be used to bypass BitLocker without special hardware, and in principle anyone can exploit it. This post covers the bitpixie attack, why BitLocker’s default mode is vulnerable, and what you can do about it.

Dump Hashes in Windows 11 24H2

Sun, 02 Mar 2025 00:00:00 +0000

In this blog post, I describe how I managed to read password hashes from the lsass.exe process memory in Windows 11 24H2. Since this version was still very new at the time of writing this post, some of the issues are due to a lack of tool support and should be resolved in the future. However, this post may also help in adapting the tools for later Windows versions.

Kerberos: How the Authentication Protocol Works

Wed, 15 Jan 2025 00:00:00 +0000

Kerberos works similarly to a passport: A passport authority issues the passport after the person has identified themselves. With this passport, they can then go to the border and prove their identity.

Active Directory Tiering: Terminal Servers and Helpdesk

Tue, 15 Oct 2024 00:00:00 +0000

In this blog post, I will briefly address two often overlooked vulnerabilities and misconfigurations in the Active Directory Tiering model. Specifically, I will focus on the mishandling of terminal servers and the helpdesk user group.

UAC Bypass

Wed, 07 Aug 2024 00:00:00 +0000

What do we see in the photo? The settings for User Account Control (UAC). But what exactly is that and how can it be bypassed?

BloodHound Introduction for Admins

Thu, 04 Jul 2024 00:00:00 +0000

BloodHound is a tool developed by penetration testers and red teamers to better identify and visualize attack paths in Active Directory. However, that doesn’t mean it can’t also be used effectively by admins or the blue team.

Exploit CheckPoint vulnerability with one simple command

Fri, 31 May 2024 00:00:00 +0000

This week, a vulnerability in the CheckPoint VPN Gateway (CVE-2024-24919) was disclosed. Unfortunately, CheckPoint has provided us with very little information about the impact of this vulnerability. I want to change that! I will show how the vulnerability can be exploited and what information an attacker can extract.

Active Directory Password Policy

Mon, 29 Apr 2024 00:00:00 +0000

Unfortunately, setting a good password policy for Active Directory is difficult. This is also because there are several best practices that sometimes contradict each other. In this post, I will try to address the various best practices and give my own recommendation.

Built-in Misconfigurations - Pre-Windows 2000 Compatible Access

Mon, 22 Apr 2024 00:00:00 +0000

This is the first part of a series in which we look into default insecure configurations in Active Directory. This part covers the Pre-Windows 2000 Compatible Access group. What is it? What are the risks? And what can we do about it?

Improving the Performance of Linux Guests in Hyper-V

Wed, 03 Apr 2024 00:00:00 +0000

Despite Hyper-V’s impressive performance, its GUI can feel sluggish compared to direct interaction on your host. Finding a solution to this was challenging, as resources were scarce. This post outlines how to configure Hyper-V and Linux virtual machines for a more responsive UI, achieving a performance level comparable to VMware Workstation.

Securing BitLocker: Initial Setup and Defending Against Attacks

Fri, 15 Mar 2024 10:46:31 +0200

Firstly, what exactly is BitLocker? BitLocker is Microsoft’s full disk encryption solution. While there are alternative solutions from other companies, my experience shows that BitLocker is the preferred choice for most organizations today. The reasons are straightforward: it’s included at no additional cost and integrates seamlessly with Active Directory and EntraID.

This article will guide you through setting up BitLocker and also go into some of the potential attacks against BitLocker, offering insights into its security features.