IIT Hack: A Look at Their Penetration Testing Services and Pricing

If you run software that handles other people's data — a SaaS product, a storefront, an API, a Telegram bot with a payment flow — at some point you need someone to try to break it on purpose. IIT Hack is a penetration testing outfit offering exactly that, and unusually for the industry, they publish their prices.

This is an overview of what they cover and how they work, based on their public site.

The Headline Numbers

Four figures sit under their hero, and they set expectations well: 6+ service types, OWASP methodology, 48h report turnaround, and 100% manual testing.

That last one is the important claim. A great deal of what gets sold as a "pentest" is an automated scanner run with a logo on the PDF. Scanners are useful, but they find known signatures — they do not find business-logic flaws, and business-logic flaws are what actually cost companies money.

What They Test

Six engagement types, each with a published price band:

A few of these deserve comment.

API Security Testing is the one most teams under-buy. If you ship a mobile app or a single-page frontend, the API *is* your product's attack surface — the client is just a convenient way to call it. BOLA (broken object level authorisation) is the single most common serious API flaw in the wild, and it is invisible to a scanner because the request looks perfectly valid; it is only wrong because the object belongs to someone else.

LLM / AI Pentesting is the newest category and follows the OWASP LLM Top 10. If you have wired a language model into a product — a support bot, a document assistant, anything with retrieval — prompt injection is a real and current problem, not a theoretical one. Indirect injection through RAG content is particularly nasty: the attacker never talks to your model, they just leave instructions in a document your model later reads.

Thick Client covers desktop software: .NET and Java reverse engineering, DLL hijacking, memory analysis, IPC review, and Electron-specific issues. This is relevant to anyone shipping licensed desktop applications, where the binary is in the customer's hands and the licence check is the thing under attack.

How They Work

Their process follows a four-phase structure aligned with PTES and the OWASP testing guides:

1. Reconnaissance — mapping the attack surface: subdomains, open ports, technology fingerprints, exposed credentials, OSINT.
2. Vulnerability Assessment — systematic identification across OWASP categories, configuration flaws and logical vulnerabilities, manual and tool-assisted.
3. Exploitation — controlled exploitation to demonstrate real impact: privilege escalation, data exfiltration, lateral movement, all within agreed scope.
4. Reporting & Remediation — technical and executive reports with CVSS scores and proof-of-concept evidence, plus step-by-step remediation.

The distinction between phases 2 and 3 is what separates a real engagement from a scan. Anyone can produce a list of "potential" issues. Demonstrating that a finding is actually exploitable — with a working proof of concept — is what tells you whether to fix it this week or next quarter.

What Is Included

Every package includes a written report and post-engagement support. Specifically:

• CVSS scoring and PoC evidence on every finding
• Executive summary alongside the technical report — the thing you can actually hand to a board or an auditor
• One free retest on critical findings within 30 days
• Developer Q&A after delivery, so your team can ask what a finding actually means
• NDA on request
• Response within 24 hours on scoping enquiries

The free retest matters more than it sounds. A report that tells you what is broken is only half the job; confirming your fix actually closed the hole is the other half, and plenty of firms charge again for it.

Their Stated Differentiator

They lead with bug bounty experience — the team hunts on public programs, and the argument is that this brings a different mindset than checklist-driven consulting. It is a fair claim. Bounty hunters are paid only for what they find, which selects hard for creativity and for chaining small issues into serious ones.

Their pricing is scope-based rather than fixed, and they say so plainly: rates vary with complexity and duration, and custom bundles are available.

Do You Actually Need One?

If any of these describe you, probably yes:

• You handle payments, or store personal data belonging to other people
• You have an API that mobile or web clients authenticate against
• A customer or partner has asked you for a security assessment
• You are about to raise, and diligence is coming
• You have added an LLM to a product that touches customer data

If you are running a static marketing site with no login, your money is better spent elsewhere.

For those running Telegram businesses specifically — bot storefronts, payment flows, licensed desktop tools — the relevant surfaces are the payment callback path, the licence verification endpoint, and anywhere a bot accepts user input that reaches a database. Those are the places where a business-logic flaw turns into free product or a leaked customer list.

Related

• IIT Hack — services, methodology and scoping form
• TelePilot Pro products — licensed Telegram automation software
• Documentation

*Service details and pricing above are taken from IIT Hack's public website and were accurate at the time of writing. Confirm current scope and rates with them directly.*