Home / Services

Pentest Services

Comprehensive security assessments tailored to your organization's needs

Every organization faces unique security challenges. My approach to penetration testing and security assessments combines deep technical expertise with an attacker's mindset, delivering actionable findings that help you understand and mitigate real risks. With over 8 years of experience across hundreds of engagements, I provide thorough, professional security assessments that go beyond automated scanning.

☠

Web Application Penetration Testing

Web applications are the primary attack surface for most organizations. My web application penetration tests go far beyond automated scanning — I manually test for complex vulnerabilities including business logic flaws, multi-step authentication bypasses, race conditions, and chained attack scenarios that automated tools consistently miss.

What's Covered

  • OWASP Top 10 — comprehensive coverage of injection, broken authentication, sensitive data exposure, XXE, broken access control, misconfigurations, XSS, insecure deserialization, vulnerable components, and insufficient logging
  • Business logic testing — workflow manipulation, price tampering, privilege escalation through application logic
  • Authentication & session management — credential stuffing resistance, session fixation, token analysis, MFA bypass testing
  • Input validation — SQL injection, XSS (reflected, stored, DOM-based), command injection, SSTI, SSRF
  • Authorization testing — IDOR, horizontal and vertical privilege escalation, role-based access control verification

Tools Used

Burp Suite Professional, SQLMap, Nuclei, FFuf, Dirsearch, custom Python scripts, browser developer tools

Deliverables

Detailed report with executive summary, technical findings with proof-of-concept, risk ratings (CVSS), remediation recommendations, and a remediation verification retest.

⏻

Network Penetration Testing

Network infrastructure remains a critical attack vector, especially with the rise of remote work and hybrid environments. I perform both external and internal network penetration tests to identify misconfigurations, weak services, and exploitation paths that could lead to full network compromise.

What's Covered

  • External assessment — perimeter scanning, service enumeration, vulnerability identification, exploitation of internet-facing services
  • Internal assessment — lateral movement, Active Directory attacks (Kerberoasting, AS-REP roasting, Pass-the-Hash), privilege escalation
  • Firewall & segmentation review — testing network segmentation effectiveness, firewall rule analysis, VLAN hopping
  • Service-level testing — SMB, RDP, SSH, FTP, DNS, SNMP misconfigurations and known vulnerability exploitation
  • Wireless security — Wi-Fi penetration testing, rogue access point detection, WPA2/WPA3 assessment

Tools Used

Nmap, Metasploit, CrackMapExec, BloodHound, Responder, Impacket, Wireshark, Aircrack-ng

Deliverables

Network topology analysis, vulnerability findings with exploitation evidence, attack path diagrams, prioritized remediation roadmap.

📱

Mobile Application Security Testing

Mobile applications introduce unique security challenges — from insecure data storage on the device to vulnerable API communications. I test both Android and iOS applications using a combination of static and dynamic analysis techniques to uncover vulnerabilities across the entire mobile application stack.

What's Covered

  • Static analysis — decompilation, source code review, hardcoded secrets detection, insecure configurations
  • Dynamic analysis — runtime manipulation using Frida, API hooking, SSL pinning bypass, function tracing
  • Data storage — SQLite databases, SharedPreferences, Keychain/Keystore analysis, clipboard data leakage
  • Network communication — man-in-the-middle testing, certificate validation, API traffic analysis
  • Platform-specific — Android intent/content provider abuse, iOS URL scheme hijacking, webview vulnerabilities

Tools Used

Frida, Objection, MobSF, JADX, APKTool, Charles Proxy, Burp Suite, Drozer

Deliverables

Comprehensive mobile security report with OWASP Mobile Top 10 mapping, proof-of-concept demonstrations, and platform-specific remediation guidance.

💻

API Security Testing

APIs power modern applications and are increasingly targeted by attackers. I test REST, GraphQL, and gRPC APIs for authorization flaws, injection vulnerabilities, rate limiting issues, and data exposure that could compromise your backend systems and user data.

What's Covered

  • BOLA (Broken Object Level Authorization) — testing for IDOR vulnerabilities across all API endpoints
  • BFLA (Broken Function Level Authorization) — verifying role-based access controls on sensitive operations
  • Mass assignment — testing for unintended parameter binding that could modify protected fields
  • Rate limiting & resource consumption — denial-of-service through API abuse, pagination bypass, excessive data retrieval
  • Injection attacks — SQL injection, NoSQL injection, GraphQL injection, command injection via API parameters
  • Authentication & token security — JWT analysis, OAuth flow testing, API key leakage, token lifetime and rotation

Tools Used

Burp Suite, Postman, GraphQL Voyager, custom Python/Go scripts, Nuclei, wfuzz

Deliverables

API security assessment report with OWASP API Security Top 10 mapping, endpoint-level findings, and API-specific remediation recommendations.

☁

Cloud Security Assessment

Cloud environments introduce a shared responsibility model where misconfigurations can expose critical data and infrastructure. I assess AWS, GCP, and Azure environments for IAM misconfigurations, storage exposure, network security gaps, and serverless vulnerabilities.

What's Covered

  • IAM review — overly permissive policies, privilege escalation paths, unused credentials, MFA enforcement
  • Storage security — S3 bucket policies, GCS access controls, Azure Blob storage exposure, public access audit
  • Network configuration — security group rules, VPC configurations, load balancer settings, exposed management interfaces
  • Serverless security — Lambda/Cloud Functions configuration review, event injection, excessive permissions
  • Container security — Docker image scanning, Kubernetes RBAC review, pod security policies, registry security
  • Logging & monitoring — CloudTrail/Cloud Audit Logs configuration, alerting gaps, incident response readiness

Tools Used

ScoutSuite, Prowler, CloudSploit, Pacu, custom scripts, cloud provider CLI tools

Deliverables

Cloud security posture report with CIS Benchmark mapping, risk-prioritized findings, architecture recommendations, and compliance gap analysis.

🔎

Vulnerability Research

Beyond standard penetration testing, I conduct deep vulnerability research aimed at discovering zero-day vulnerabilities and novel attack techniques. This includes reverse engineering, exploit development, and CVE discovery. My research has resulted in published CVEs and recognition from major technology companies.

What's Covered

  • Zero-day research — discovering previously unknown vulnerabilities in commercial and open-source software
  • CVE discovery & disclosure — responsible disclosure through vendor security teams and MITRE CVE program
  • Reverse engineering — binary analysis, protocol reverse engineering, firmware analysis
  • Exploit development — proof-of-concept exploit creation for identified vulnerabilities
  • Attack surface analysis — comprehensive mapping of an organization's exposure across all digital assets

Notable Work

CVE-2020-24416 — discovered a critical reflected XSS vulnerability in Adobe InDesign that could lead to session hijacking and account compromise. This finding was recognized by Adobe's security team and added to their Hall of Fame.

Ready to Secure Your Organization?

Let's discuss your security needs and find the right assessment for your environment.

Get in Touch