Casos de éxito

About Qwantec

Qwantec is the leading company in HR management and attendance control technology solutions in Chile and Peru. With over 14 years of experience, it has optimized processes for more than 6,000 clients.

Need

As an application's public exposure grows, so does its attack surface. Qwantec needed an objective evaluation of the exposed surface configurations in the deployment of its application Reloj Control and infrastructure: elements that an attacker can observe from the outside, such as improperly exposed files and endpoints, and HTTPS configuration (TLS versions, certificates, ciphers, among others). The goal was to identify and validate potential weaknesses before they became a risk vector.

Solution

To address this need, a pentest service was conducted for the Reloj Control application and its infrastructure. The process included:

• Pentest execution through scanning the exposed surface of the application and its infrastructure.
• Delivery of a report detailing vulnerabilities and weaknesses found and validated by the team.

The analysis focused on areas where web deployment configuration risks typically accumulate: the detection of exposed files and endpoints, and HTTPS configuration, including TLS versions, certificates, and ciphers. Manual validation allowed for refining the automated analysis results, discarding false positives and confirming actual weaknesses.

Outcome

The project concluded with the delivery to Qwantec of a clear, validated, and actionable diagnosis of the security status of Reloj Control's exposed configurations and its infrastructure. Through this Ethical Hacking process, the company gained an objective view of its exposure surface and was able to prioritize hardening actions on the most critical points.

Beyond the specific findings, the work enabled Qwantec to reduce uncertainty about its security posture and establish a solid foundation for continuous improvement, reaffirming the importance of incorporating periodic reviews as a proactive practice to protect the trust of the more than 6,000 clients who rely on its platform.

The details of the service and its results are confidential.