We audit your attack surface from the outside: subdomains, certificates, exposed files, email configuration and security headers. Nothing to install. No credentials. Reproducible report in 48 hours.
Everything starts with the same question: what does an attacker see when they look at your domain? From there, you pick your coverage level.
Full external recon of your domain. What an attacker sees in their first minute — documented, prioritized, with remediation commands.
An audit is a photo. The monitor is the camera. We watch your surface daily and alert when something changes — before someone else uses it.
We apply the remediations on your stack: WordPress, nginx/Apache, mail. Execution, not theory — with post-fix verification included.
Every finding ships with the exact command that finds it. Verify it yourself, or hand it to your provider. No black boxes.
CT logs, DNS, HTTP(S), MX configuration, public indexes. Open sources only: your server notices nothing.
Every surface is classified by real severity: exploitable today, spoofing vector, or pending hygiene.
PDF with evidence, verification command and exact remediation. Readable by management, executable by your dev.
After fixes are applied, free re-audit. A finding isn't closed until the command stops returning it.
# F-01 · Security headers missing target: https://target.com impact: clickjacking + MIME-sniffing + TLS downgrade evidence: $ curl -sI https://target.com | grep -iE "content-security|x-frame|strict-transport" (no results — 6 headers missing) fix (nginx): add_header X-Frame-Options "SAMEORIGIN" always; add_header Content-Security-Policy "default-src 'self'" always; add_header Strict-Transport-Security "max-age=63072000" always; verification: $ curl -sI https://target.com | grep -ic "strict-transport" 1 ← finding closed
No. All recon is passive: we query public sources (CT logs, DNS, HTTP responses, MX records). It's exactly what an attacker does in their first minute. That's why we can audit any domain without credentials, agents or changes to your infrastructure.
We say so. A clean report with verification evidence is worth as much as one with findings: it's proof your surface is under control. And if you run the monitor, it's the baseline against which we measure future change.
Yes — it's our preferred format. Reports are available white-labeled and your margin is protected: you bill your client, we bill you. Web/design agencies are our main channel.
We charge crypto to avoid asking for fiscal data or banking gateways. If your company needs paperwork, we issue a service receipt with our details and scope — but payment is always crypto, no KYC.
Critical exposures (indexed sensitive files, DMARC dropped to none) trigger an alert on the next pass. Monitor passes run on a short cycle; the daily report summarizes the rest. If you need a minute-level SLA, let's talk.
Send us the domain. We start recon today and deliver the report in two days. No sales calls, no 45-minute demos.
crox@croxsec.comor via nostr: npub1grgfze827hsgh8hn2eh3glswg7fyyun3yrjx3uchqszguwwxufuq8uazte