Penetration Testing

About

OÜ Klots is an Estonian IT services company founded in 2005. Alongside server administration and hosting, we provide penetration testing and security assessments for organisations that want an independent view of how their systems hold up against a real attacker.

Testing is carried out by Raido Kurel (PhD in electronics, Tallinn University of Technology), a system and network administrator with more than 30 years of experience running production Linux/UNIX servers, networks, firewalls and intrusion prevention systems. That operational background shapes the work: findings are prioritised by realistic business impact, and remediation advice is written to be practical for the people who run the systems.

Every engagement is performed only under a signed agreement and a written authorization from the system owner. See the rules of engagement below.

Services

External penetration testing

Black-box and grey-box testing of internet-facing systems: web applications, customer portals, public and partner APIs, authentication and single sign-on services, corporate websites and exposed infrastructure.

Authentication, session management and access control (including IDOR and multi-tenant isolation)
Input validation and injection flaws, cross-site scripting
API authorization, token handling and sensitive data exposure (OWASP API Security Top 10)
Exposed services, administrative interfaces, outdated components and known vulnerabilities (CVE review)
TLS/SSL configuration and security headers
Business-process abuse, and identification of resource-intensive requests that could enable denial of service (reported, not exploited)

Internal infrastructure security audit

Review of internal networks, branch-office VPN links, Active Directory, virtualisation and backup infrastructure, network devices and monitoring, based on agreed access and read-only methods by default.

Server and cloud configuration review

Hardening review of Linux servers, Docker/Swarm environments, AWS-hosted and on-premises infrastructure, web servers, mail and DNS services.

Deliverables

Final report in PDF (editable format on request): executive summary, technical findings, severity ratings (Critical, High, Medium, Low), business impact and remediation recommendations
Each finding includes the affected system, description, evidence, impact assessment and recommended fix
Findings review meeting with the client's technical and management contacts
Retesting of fixed findings, when agreed

Methodology follows the OWASP Web Security Testing Guide and the OWASP API Security Top 10.

Rules of engagement

These principles apply to every engagement. Nothing is tested without the system owner's written agreement.

Written agreement first. Work starts only after a signed service agreement (and NDA where requested) and a written authorization to test from the system owner.
Defined scope. The systems, hostnames, environments and testing windows are fixed in writing before testing. Systems outside the confirmed scope are not tested. Any scope question is resolved in writing with the client before acting.
Third-party infrastructure is respected. Shared cloud and CDN infrastructure that belongs to third parties is not port-scanned or attacked; only the client's own application layer in scope is tested.
Identifiable traffic. Testing is performed from OÜ Klots' fixed, pre-declared source IP addresses, so the client can recognise test traffic and adjust IDS/IPS/WAF monitoring.
Non-destructive by default. The following are excluded unless separately agreed in writing: denial-of-service and load testing, brute-force or wordlist password guessing against production, phishing and social engineering, destructive exploitation, and changes to client systems.
Immediate reporting of critical issues. Critical vulnerabilities are reported to the client's designated contact immediately, not held until the final report.
Named contacts. A technical point of contact on the client side is available throughout testing, to react to anomalies.
Confidentiality. Client information and all discovered vulnerabilities are confidential. Reports are delivered encrypted to the designated client representative. Client details are never published beyond what the client has agreed to.
Data protection. Personal data is processed according to the GDPR. Test accounts and test data are preferred, and engagement data is deleted when the agreement requires it.
Supervised tooling. Testing combines standard security tools with AI-assisted analysis (Anthropic Claude). The same written scope and rules apply to every tool, and all testing actions are directed and reviewed by the tester.

References

Security testing

Telema AS (2026): external penetration testing of web applications, APIs and internet-facing infrastructure, performed under a security testing framework agreement.
Salome Auto AS (2026): internal security audit covering the headquarters and branch-office networks, Active Directory, server infrastructure and public web services.
Codelive: security reviews of the infrastructure Raido administers as system administrator.

Details of client engagements are confidential and are not published.

Long-term infrastructure clients

Äripäev: UNIX/Linux server administration, firewall and Snort-based intrusion prevention system (since 2001, as employee until 2007 and through OÜ Klots since)
Salome Auto AS / Automaailm: system and network administration, branch-office VPN network, wholesale e-commerce platform (PHP/MySQL)
Mikare Baltic / Mailbow: mail and bulk-mail delivery infrastructure for nearly 20 years
OÜ Klots hosting: own virtualised hosting platform since 2005 (Proxmox/KVM/LXC) with web, mail, DNS, backup and monitoring services for clients

Background: Raido Kurel

Board member of OÜ Klots. System and network administrator since 1995, working mainly with Linux, and also FreeBSD, HP-UX, Solaris and Windows Server. Experience covers VPN (OpenVPN, IPsec), OSPF routing, firewalls and IPS, virtualisation (Proxmox, Xen, VMware, Hyper-V), Docker Swarm, AWS, Zabbix monitoring, and scripting in Bash, Perl and PHP.

Experience

2005: present	OÜ Klots, board member and system administrator
2021: 2024	Codelab OÜ / Codelive, system administrator (AWS, Google Cloud, Docker Swarm, automated deployment, monitoring)
2020	The Xara Palace Hotel, Malta, system administrator (Zabbix monitoring, OSPF-based redundant branch link over radio and VPN)
2008: 2018	ELIKO Competence Centre, system administrator (Linux web services)
1998: 2017	Tallinn University of Technology, assistant lecturer, then researcher; administration of the Department of Electronics IT infrastructure, laboratory teaching, research
2001: present	Äripäev, system administrator (UNIX/Linux servers, firewall, IPS deployment); employee 2001: 2007, through OÜ Klots since
1997: 1998	AS Tigma, computer technician
1995: 1997	Estonian Holidays, IT support and network administrator

Education

2001: 2005	Tallinn University of Technology, PhD in Electronics and Biomedical Engineering. Thesis: Investigation of electrical characteristics of SiC based complementary JBS structures
1998: 2000	Tallinn University of Technology, MSc in Electronics and Biomedical Engineering. Thesis: Current crowding effect in SiC Schottky structures
1993: 1998	Tallinn University of Technology, diploma in Electronics. Thesis: Modelling of wide bandgap Schottky interfaces
2017: 2018	Kehtna Vocational Education Centre, Securing Computer Networks (EQF level 5)
2018: 2019	Kehtna Vocational Education Centre, System Administrator (EQF level 4)
2019: 2020	Kehtna Vocational Education Centre, Senior Telecommunications Technician (EQF level 5)

Training and certifications

Hacking Hands-On (PIT Consulting Estonia, 2007)
Web Applications security course (PIT Consulting Estonia, 2007)
Juniper Networks Certified Associate: Junos (JNCIA-Junos), 2019
MikroTik Certified Network Associate (MTCNA), 2018
Oracle Database 10g Administration Workshops I and II, RAC for Administrators (Oracle University, 2005: 2007)

Selected publications

Research on silicon carbide (SiC) semiconductor devices at Tallinn University of Technology, mostly with Prof. Toomas Rang. Full list in the Estonian Research Information System: ETIS CV of Raido Kurel.

Kurel, R. Investigation of electrical characteristics of SiC based complementary JBS structures. Doctoral thesis, Tallinn University of Technology, 2005.
Kurel, R., Rang, T., Poirier, L. An analysis of critical parameters of SiC JBS structures. Proceedings of the Estonian Academy of Sciences, Engineering, 2004.
Rang, T., Kurel, R. Comparison of dynamic behaviour of complementary 6H- and 4H-SiC Schottky structures using numerical simulation. Proceedings of the Estonian Academy of Sciences, Engineering, 2004.
Kurel, R., Rang, T., Higelin, G. Numerical study of current crowding phenomenon in complementary 4H-SiC JBS rectifiers. Silicon Carbide and Related Materials 2003.
Kurel, R., Rang, T. Hot spots caused by contact inhomogeneities in 4H- and 6H-SiC Schottky structures. Advanced Computational Methods in Heat Transfer VI, 2000.

Penetration Testing and Security Assessment