Pentest-Tools

Pentest-Tools

Type	Privately held company
ISIN	🆔
Industry	Cybersecurity
Founded 📆	May 23, 2017 (2017-05-23)
Founder 👔	Adrian Furtună
Headquarters 🏙️	, Bucharest , Romania
Area served 🗺️	Worldwide
Key people	Adrian Furtună (CEO), Andrei Pitiș (chairman)
Products 📟	Cybersecurity software
Services	Computer security, Penetration test
Owner	Adrian Furtună
Members
Number of employees	61 (2024)
🌐 Website	https://pentest-tools.com/
📇 Address
📞 telephone

Pentest-Tools is a technology company based in Bucharest, Romania, that specializes in cybersecurity products and services, including software tools for penetration testing, vulnerability assessment, attack surface mapping and monitoring, vulnerability management, and other white hat hacking activities.

Its main product is Pentest-Tools.com, a security testing toolkit that incorporates over 20 penetration testing tools, including a port scanner, a subdomain finder, a network vulnerability scanner, a web application scanner for dynamic application security testing, a tool for URL fuzzing, a web application firewall detector, vulnerability scanners for content management systems such as WordPress, Drupal, Sharepoint, Joomla, and many more.

The product also has features aimed at scaling offensive security workflows, including automation options for multiple stages of an information technology security assessment such as vulnerability scanning, vulnerability management, and reporting.

The company founded and led by Adrian Furtună serves over 2000 B2B customers in more than 119 countries. As of 2024, the company employs more than 60 people.

History

PentestTools SA was established in May 2017 by Adrian Furtună.

In April 2016, Furtună, who had been working as an IT security engineer since 2007, and as a security consultant and technical manager for security services at KPMG Romania, started his first company, VirtualStorm. Later that year, at DevTalks Bucharest 2016, Furtună did the first live demo of what would later become Pentest-Tools.com.

In February 2017, the first 2 employees joined the company and the initial team got accepted into the mentorship program Innovation Labs, where they won the Grand Prize.

In the same year, at the cybersecurity conference DefCamp, Adrian Furtună gave a presentation titled “Pentest-Tools: The first online penetration testing framework”, officially launching the product.

In May 2018, Andrei Pitiș, co-founder at Innovation Labs, Founder at VectorWatch (acquired by FitBit), Former VP Product at Fitbit, and founder and CEO at Simple Capital, joined Pentest-Tools.com and in April 2022 he became chairman of the board.

From 2017 to 2024, PentestTools SA expanded from 3 to 61 employees. It now serves customers in the small and medium business and enterprise segments, including Orange S.A., Assicurazioni Generali, Thales Group, the SETI Institute, the University of Southern California, and dozens more.

Products

Pentest-Tools.com was the first product that made it possible for security practitioners to use previously disconnected penetration testing tools as a single, cloud-based solution delivered as software-as-a-service. This allowed security and IT specialists to do their security testing activities in the browser as opposed to installing tools locally, on their device - a manual, time-consuming, and resource-intensive process that also involved updating and maintaining them.

Additionally, Pentest-Tools.com provided the ability to see the tools’ unified output in the browser and generate a report that included findings from multiple tools, along with IT risk descriptions, and remediation recommendations. This enabled the penetration test report to present the reader with a comprehensive overview of the tested target (network asset or web application).

Initially, the team used specific open-source technology, such as Nmap, OpenVAS, and WPScan, as the foundation of their tools, but soon switched to creating proprietary software as their main product.

For instance, on December 10, 2020, at the height of the Covid-19 pandemic, Pentest-Tools.com launched pentest robots at BlackHat Europe 2020. This proprietary robotic process automation (RPA) solution helps penetration testers and other security specialists automate time-consuming work by providing a visual studio where they can build custom testing flows for specific stages of a penetration test, such as reconnaissance or exploitation.

The company also replaced their Website Vulnerability Scanner on April 5, 2021, with a new one, built from scratch. A public benchmark puts its performance almost on par with top industry competitors such as Acunetix and Burp Scanner, part of Burp Suite. The scanner can identify and automatically validate cross-site scripting, SQL injection, Command injection, XML external entity attack, and other critical security issues specific to web applications.

On September 9, 2021, Pentest-Tools.com launched a new ethical exploitation tool - Sniper: Auto-Exploiter, which automatically detects and exploits critical vulnerabilities using real attack methods to extract proof – without disrupting the target. The company also creates custom exploits for high-risk vulnerabilities in widely used software, such as Cisco, Apache, Magento, SolarWinds, PHP, Ivanti, and many more. Sniper: Auto-Exploiter uses these manually crafted exploits to simulate a cyberattack and validate the technology is vulnerable to that particular security issue.

In December 2021, Pentest-Tools.com was one of the first companies to develop detection for Log4Shell, the zero-day vulnerability in Log4j which involved arbitrary code execution and had a wide-ranging impact on technology used across the world. Detection was possible with two of the product's main tools, the Website Vulnerability Scanner and the Network Vulnerability Scanner. Log4Shell continued to be one of the most exploited vulnerabilities of 2022 and a persisting problem for the IT industry.

On October 24, 2022, the company published a Vulnerability & Exploit Database that provides public access to the security vulnerabilities and exploits customers can detect with the tools on Pentest-Tools.com and confirm as a realistic risk to their organizations. The database includes well-known vulnerabilities in the cybersecurity community, such as MOVEit, Spring4Shell, Shellshock, Heartbleed, POODLE, Dirty COW, EternalBlue, Zerologon, SIGRed, Logjam, and more. Many of these vulnerabilities are also part of the catalog maintained by the Cybersecurity and Infrastructure Security Agency which many organizations and specialists use as a key reference for their information security risk assessment activities.

A new API Vulnerability Scanner was added to the toolkit on Pentest-Tools.com in April 2023. The tool is designed to identify API-specific vulnerabilities, including SQL injection, server-side request forgery, Local File Inclusion, Code injection, Request URL override, and others using custom detectors. To execute tests that match the evaluated API's behavior, this vulnerability scanning tool parses the API specification file before checking for security issues.

A Cloud Vulnerability Scanner became part of the company's product in June 2023, further expanding Pentest-Tools.com's capabilities in terms of vulnerability assessment activities. The technology behind this tool was showcased in a presentation at the cybersecurity conference DefCamp 2023.

The organization continues to expand its range of tools by launching a Kubernetes Vulnerability Scanner in July 2024 to match increased usage of this open-source container orchestration system by IT infrastructure specialists. Designed to find security vulnerabilities in Kubelet API endpoints, cluster components, pods, logs, etcd instances, and other critical components, this vulnerability scanner also enables security practitioners to simulate an authenticated attack, provided they have a service account token.

Awards and accolades

Pentest-Tools.com won the Grand Prize at Innovation Labs 2017, and the `Best Innovation” prize at the Startup Spotlight Awards 2018. In 2021 Pentest-Tools was the only company that represented Romania at the Black Hat Europe 2021 event.

It was also awarded Best Vulnerability Management Solution (highly commended) at SC Awards 2022. In the same year, it was selected in Companies to Watch in the Deloitte Technology Fast 50 CE 2022. The Employers' Association of the Software and Services Industry of Romania (ANIS) awarded the Software of the Year Award for Pentest-Tools, in 2021.

In July 2024, Deloitte selected Pentest-Tools.com as one of the 500 fastest growing tech companies in EMEA, placing it at number 309. The selection process was based on an analysis of the financial performance of the companies included in this report.

Professional certifications

Members of the Pentest-Tools.com team hold cybersecurity certifications such as:

• GSE - GIAC Security Expert
• CISSP - Certified Information Systems Security Professional
• OSCP - Offensive Security Certified Professional
• GCIH - GIAC Certified Incident Handler
• GCIA - GIAC Certified Intrusion Analyst
• GPEN - GIAC Penetration Tester
• CRTP - Certified Red Team Professional
• OSWP - OffSec Wireless Professional by Offensive Security
• OSWE - Advanced Web Attacks and Exploitation by Offensive Security
• OSEP - Advanced Evasion Techniques and Breaching Defenses by Offensive Security
• CEH - Certified ethical hacker
• eJPT - Junior Penetration Tester by INE Security

Services

• PentestTools SA also offers professional offensive security services:
• Managed vulnerability assessment
• Web application penetration test
• Network penetration test
• API penetration test
• Mobile penetration test
• Red teaming

Based on their particular focus, engagements include manual breach and attack simulations, in-depth network security evaluations that uncover vulnerabilities which can lead to a supply chain attack, identifying business logic vulnerabilities attackers can manipulate for financial gain and cyber extortion, and discovering and ranking application security issues based on their real business impact. Professional offensive security services rely on manual testing and exploitation and a deep knowledge of the client environment.

Community contribution

Pentest-Tools.com offers free versions for most of their tools which anyone can use, provided they have the legal right to scan a particular target (web application or network host). These free penetration tools run passive tests that do not endanger the confidentiality, integrity, and availability (the CIA triad) of the tested system.

The company also provides a target that exposes deliberately vulnerable services related to both web applications and network hosts, which cybersecurity students and beginners can use to develop their skills and knowledge.

Pentest-Tools.com sponsors community events such as BlackHat Europe, OffensiveCon, NahamCon, Hexacon, and DefCamp, which provide access to specialized knowledge and research through presentations, training, and live hacking activities.

The organization also contributes with educational resources such as vulnerability research articles on issues such as the XZ Utils backdoor, RegreSSHion, SMBGhost, security problems in Roundcube (which was used in cyberwarfare), Magento and other widely used technologies.

External links

• Official website

This article "Pentest-Tools" is from Wikipedia. The list of its authors can be seen in its historical and/or the page Edithistory:Pentest-Tools. Articles copied from Draft Namespace on Wikipedia could be seen on the Draft Namespace of Wikipedia and not main one.

---