7 min read
CaptiveCrunch: When the Network Is the Phish
CaptiveCrunch turns the captive portal itself into the phish, and MFA does not answer it. How the chain works, and what your simulations never covered.
Read the post →Offensive Security
Find out how you’d actually be breached.
Brackish is an offensive security firm. We emulate real attackers against your systems, then hand you the evidence, the impact, and the fix — not a scanner export with the logo changed.
Fig. 01 — Attack pathRev. A
- External recon - leaked credentials
- VPN lacks MFA
- Internal foothold
- Exploit Active Directory misconfiguration
- Domain compromise
A representative chain: external exposure to domain compromise. Individual findings rarely matter on their own — the path does.
Fig. 02
Services
Fifteen engagement types, one team. Each one ends with something you can act on and hand to an auditor.
- 01
Network Penetration Testing
External and internal testing of your network, from the perimeter an attacker meets first to the lateral movement they attempt once inside.
Read more → - 02
Web Application Penetration Testing
Authenticated, business-logic-aware application testing that goes past the scanner output and into how your application actually works.
Read more → - 03
API Penetration Testing
Endpoint-by-endpoint testing of the interfaces that carry your data, with a focus on authorization, input handling, and abuse resistance.
Read more → - 04
Mobile App Penetration Testing
Android and iOS testing across the whole app: static and dynamic analysis, on-device data handling, and the backend APIs behind it.
Read more → - 05
IoT Penetration Testing
Connected device testing across firmware, radio interfaces, companion apps, and the cloud services that tie them together.
Read more → - 06
Social Engineering
Phishing, vishing, and pretexting campaigns run as a controlled test of your people, your process, and your ability to detect them.
Read more → - 07
Red Teaming
Full-scope adversary emulation against people, process, and technology — measuring detection and response, not just exposure.
Read more → - 08
Vulnerability Scanning
Ad-hoc or recurring scans, with the raw output plus an analyst pass that separates the findings that matter from the noise.
Read more → - 09
Attack Surface Management
Continuous discovery of what you expose to the internet, with every finding validated by a tester before it reaches you. Powered by Pincher.
Read more → - 10
Cloud Penetration Testing
Hands-on testing of AWS, Azure, and GCP — identity, misconfiguration, and the paths that turn one foothold into a tenant-wide problem.
Read more → - 11
Secure Code Review
A source-led review of the codebase itself — exploitable flaws mapped to the line that needs to change, before the code ships.
Read more → - 12
Configuration Reviews
Read-only reviews of Microsoft 365, CI/CD, identity, and cloud tenants — the settings an attacker would use, without firing a shot at production.
Read more → - 13
AI Penetration Testing
Hands-on testing of LLMs, agents, and RAG — prompt injection, data exposure, and the tools a model should never have been allowed to call.
Read more → - 14
Physical Penetration Testing
On-site testing of buildings, badges, and desks — tailgating, cloning, and unlocked rooms that skip every network control you own.
Read more → - 15
Wireless Penetration Testing
Testing of your Wi-Fi estate the way a nearby attacker would: join, intercept, and see how far a wireless foothold actually goes.
Read more →
Fig. 03
How an engagement runs
No surprises, no scope creep, and no report you have to translate before anyone can act on it. Every project is managed by an experienced project manager, and it all runs through portal.brackish.io.
- Phase 01
Scope and rules of engagement
We agree targets, constraints, escalation paths, and what success looks like — in writing, before anything is touched.
- Phase 02
Reconnaissance and mapping
We enumerate the real attack surface, which is routinely larger than the one on the asset inventory.
- Phase 03
Exploitation and pivoting
We prove impact by chaining findings the way an attacker would, rather than listing issues in isolation.
- Phase 04
Reporting and retest
You get reproducible evidence, prioritized remediation, and a retest confirming the fixes actually hold.
Fig. 04
From the blog
Recent write-ups from engagements and research — the same testers, written down.
- 8 min read
Healthcare Regulation Brief
The HIPAA Security Rule overhaul slipped again, and the 240-day compliance window is the part nobody reads. Where the rule stands and what it will demand.
Read the post → - 6 min read
One Phishing Test a Year Is a Compliance Artifact, Not a Security Control
One phishing simulation a year measures a single day with a single pretext. Why cadence beats the annual checkbox, and which metric is worth reporting.
Read the post →
Common questions
Questions we hear first
- What types of penetration testing do you offer?
- We provide comprehensive testing across web applications, mobile apps, APIs, networks, cloud, wireless, IoT, and AI-enabled systems, plus physical assessments, social engineering, and full-scope red team engagements. Every engagement is scoped to your environment rather than sold as a fixed package.
- How is Brackish different from other security firms?
- Our testers are seasoned, highly certified offensive security professionals who perform original research and uncover real-world vulnerabilities — not operators running an automated scan and reformatting the output. You work directly with the people doing the testing.
- Will penetration testing disrupt our operations?
- No. We coordinate closely with your team so testing is safe, controlled, and minimally disruptive, and we schedule around low-traffic or out-of-hours windows where that is the right call. Constraints and escalation paths are agreed in writing before anything is touched.
- What happens after the test is complete?
- You receive a detailed report, a live walkthrough of the findings, and prioritized remediation guidance. We stay available afterwards to help validate fixes and to keep improving your posture over time.
Ready to find out what an attacker would find?
Tell us what you need tested. We’ll come back with scope, timeline, and a fixed price.