The Attack Surface Most Pentest Vendors Skip

Identity verification, biometric liveness, and SSO/authentication testing, informed by ISO/IEC 30107-3 (Presentation Attack Detection) and NIST 800-63A identity assurance guidance.

Book a Scoping Call

Why We Built a Specialty Here

Most VAPT vendors scope to OWASP Top 10 and stop. The highest-impact vulnerabilities we've found in the last two years haven't been in injection or XSS, they've been in the systems that decide whether an entity is who it claims to be.

A single KYC bypass means fraudulent onboarding at scale, often invisible until chargebacks appear. A single SSO flaw can mean full authentication-layer compromise across every tenant.

Identity Verification & KYC Bypass Testing

  • 1
    Liveness detection bypassprinted photo attacks, screen replay, video injection, deepfake/synthetic media against PAD Level 1 and 2 controls
  • 2
    Document verification bypasstemplate forgery, MRZ/OCR field manipulation, metadata inconsistency exploitation
  • 3
    Biometric injectionvirtual camera driver injection, API-level bypass skipping client-side capture entirely
  • 4
    Onboarding logic abusestep-sequence manipulation, race conditions between verification and account activation, re-verification bypass

SSO & Authentication Testing

  • 1
    SAMLXML signature wrapping, assertion replay, missing audience restriction validation, XXE via metadata parsing
  • 2
    OAuth2/OIDCredirect_uri bypass, authorization code interception, PKCE downgrade, state parameter omission, scope escalation
  • 3
    JWTalgorithm confusion (RS256→HS256), kid header injection, weak signing key brute-force
  • 4
    Session managementfixation, hijacking, insufficient invalidation
  • 5
    MFAfallback abuse, backup code enumeration, OTP rate-limit gaps
  • 6
    Federation trustIdP impersonation, cross-tenant token confusion in multi-tenant SSO

If Your Product Does Onboarding, KYC, or SSO,
This Is the Test You Need

Talk to Us About an Identity/SSO Engagement