Leviathan OffSec // Fixed scope

Your perimeter changed.
Somebody should tell you.

Most breaches start with something boring: a subdomain pointing at a bucket someone deleted in 2021, an admin panel exposed to the internet, a TLS certificate about to lapse. This is a fixed-scope check for exactly that class of problem, across up to five domains you own. Evidence for every finding, no severity theatre, five business days.

What gets checked

01

Dangling DNS & subdomain takeover

Every CNAME and A record that leaves your zone, checked against 21 provider takeover signatures. A CNAME pointing at a live bucket is not reported as a finding.

02

Exposed admin surfaces

Panels, dashboards, CI, databases and storage endpoints that answer on the public internet, with the response that proves it.

03

TLS & header posture

Certificate expiry and chain problems, protocol versions, HSTS/CSP/frame-ancestors presence. The stuff that turns a misconfiguration into a headline.

04

Visible-CVE surface

Version banners and fingerprints matched against public advisory data, with an explicit note of what the local database could not speak to. No silent gaps.

05

30-day retest

One re-run after you patch, so the report ends in "resolved" rather than "here is your anxiety".

$149 one-off, up to 5 domains
Book the audit

How it runs

Pay and send targets. Checkout collects payment; reply to the Stripe receipt with up to five domains and one line confirming you own or control them.
Authorisation checked first. No work starts until that statement is on record. If authorisation doesn't hold up, the payment is refunded.
Passive first, then careful active checks. DNS, certificate transparency, public exposure, banner and header collection. No exploitation, no brute force, no denial of service.
Report. Findings with the evidence that proves each one, what was checked and what could not be, and the fix in priority order.
Retest at day 30. Reply to the report thread when patches are in. The re-run is included.
What this is not. It is not a penetration test, not a compliance certificate, and not a guarantee that nothing else is wrong. It is a fast, honest check of the exposure class that attackers actually scan for, with the limits of the check stated in the report.

Authorised targets only. Assets must be yours or under written client authorisation. Authorisation is confirmed in writing before any active check runs.

Questions

Why is this so cheap?

Because the scan layer is tooling I already run and maintain — HostageLVX, surfacediff, and Fenrir are MIT-licensed and public. What you're paying for is the triage, the false-positive elimination, and a report a human can act on. It is fixed scope by design.

Do you exploit anything you find?

No. Findings are established with non-destructive evidence: the response, the certificate, the record, the banner. Anything that would require exploiting a vulnerability to prove is flagged for a follow-up engagement instead.

Can I send more than five domains?

Yes, five is included. Extra domains are $20 each, invoiced after you send the list, before work starts.

What if you find nothing?

You still get the report: what was checked, what was excluded and why, the current exposure inventory, and the retest. A clean result is a real result when the coverage is stated.

Who am I buying this from?

Leviathan OffSec — an independent offensive security research lab. Public research and MIT-licensed tooling on GitHub, longer writeups in the research section.