Warning The vulnerabilities PHP2Shell and HTTP2Shell are being heavily exploited right now. Many websites and servers are affected. Please check here first whether you are affected. Am I affected?
External security analysis · Enumeration
What an attacker finds about you, we find first.
Every attack starts with reconnaissance: find subdomains, probe services, read versions, search leaks. We run exactly this enumeration against your domain and IP address, with your approval and without access to your systems.
What we enumerate
Your attack surface, mapped like an attacker would.
-
Subdomains and forgotten systems
We find what is publicly discoverable: test and legacy systems, old websites, dangling DNS records.
-
Open services and versions
Which ports answer, which software runs behind them and whether admin interfaces sit open on the internet.
-
Known vulnerabilities
Detected versions matched against known and actively exploited vulnerabilities.
-
Leaks and spoofed senders
Company addresses in credential leaks, look-alike domains and whether someone can send mail in your name.
Process
From order to report in five working days.
-
Send domain and IP
Two details and your written approval. We find the rest ourselves.
-
Enumeration
Active scans and public source research. No login attempts, business as usual. You get our source IP up front.
-
Report and call
Within 5 working days of approval. PDF plus a 30 minute call.
External analysis or IT Check
This page
External security analysis
from €249 excl. VAT
- Reconnaissance from outside, like an attacker
- 34 checks on domain and IP
- No access to your systems
- Report in 5 working days
IT security check
from €1,299 excl. VAT
- On-site check, from inside
- 100+ checkpoints in 8 areas
- Backups, accounts, network, server room
- Findings and action plan in 2 weeks
What is only visible from inside, such as backups, phishing resistance or Microsoft 365, is outside the external analysis.
All 34 checkpoints
6 Email & DNSCan someone send email in your name?
- SPF: which servers may send for you
- DKIM: signature and published key
- DMARC: policy against spoofing and reporting
- MTA-STS and TLS-RPT: enforced encrypted delivery
- DNSSEC: signed DNS answers
- Nameservers: zone transfer, redundancy, stale records
10 Reachable servicesWhat answers from the internet?
- Open ports on your IP address
- Admin access: SSH, remote support, firewall, NAS and printer UIs
- Databases and file shares exposed
- VPN endpoints and versions
- Visible product versions
- Subdomains, fully enumerated
- Test, staging and legacy systems
- Dangling DNS records (subdomain takeover)
- Cameras, building systems, controllers on your line
- Unprotected cloud storage
4 Web configurationIs your website configured safely?
- Security headers
- Cookie flags
- Exposed paths: .git, config files, backups, directory listings
- Login pages and detectable versions
4 Reputation & credentialsAre your domain passwords in leaks?
- Company addresses in leak collections, with source and date
- Domain and mail servers on blocklists
- Typosquatting and look-alike domains
- Certificates issued in your name
1 OSINTWhat is in search engines and archives?
- Indexed documents, web archives, code repositories and file metadata
3 EncryptionIs your encryption current?
- TLS versions and ciphers
- Certificate chain, issuer, validity, names
- Encryption on your mail servers
6 VulnerabilitiesAre there known vulnerabilities?
- Known CVEs in detected versions
- Match against actively exploited vulnerabilities (CISA KEV)
- Software without vendor support
- Default and sample configurations
- Vulnerable third-party website components
- Misconfigurations that combine into an attack path
Typical triggers
✓ Good fit
- Your systems grew over years and some are forgotten
- Website on WordPress or another CMS
- Own servers, VPN or remote access
- Your insurer or a client asks about your security
- Nobody has ever checked from outside
✕ What it does not cover
- Not a full penetration test, we exploit nothing
- Not a certification
- No internal checks, that is the IT Check
Promised in writing before we start.
- We only test what you approved in writing.
- We change nothing and try no passwords.
- The report goes to you only. No sharing, no reference without consent.
- Data is stored encrypted in Austria and deleted after 12 months at the latest.
Further reading
-
Neue Sicherheitslücke gemeldet: Was Firmen jetzt tun sollten
Almost every week there is a new critical vulnerability.
→ -
PHP2Shell: Was Website-Betreiber jetzt tun müssen
Two critical PHP flaws are being exploited since October 2026.
→ -
Wie Hacker in kleine Firmen kommen: die 6 häufigsten Wege
Most break-ins at small companies follow six simple paths.
→
FAQ
Frequently asked questions
What is enumeration?
Enumeration is the reconnaissance phase of an attack: systematically collecting which systems, services, versions and credentials are discoverable from outside. We do it first so you can close gaps before someone else finds them.
Will we notice the analysis?
Business continues as usual. We only query what your systems already answer publicly, without load and without login attempts. A security monitoring tool may alert, so we give you our source IP up front.
Is an external scan legal?
Yes, with your explicit approval. You confirm you control the domain and IP. We verify against public registers. If something does not match, we do not scan and refund you.
How do I find my IP address?
Open icanhazip.com from your company network. That address is your public IP. If you have several, check your ISP contract. We are happy to help.
What does the external analysis cost?
€249 excl. VAT for one domain or IP address, each additional one €69. Book right here and pay online.
Discuss an external security assessment
Free first call
Briefly describe your situation. We help you assess it and plan the next step. Reply within 24 hours on working days.
External security analysis and attack surface enumeration in Austria
The vetosec external security analysis is an attacker-view attack surface assessment: subdomain enumeration, port scanning, service and version detection, leak research and CVE matching.
34 checkpoints in seven areas. The report works as evidence for cyber insurance, supplier questionnaires and NIS2 supply chain requirements.
office [at] vetosec [dot] at · vetosec.at/contact/