Pentesting & Recon

Clone black-box ML models through prediction APIs and test membership inference

Test Android APKs with apktool, jadx, Frida and SSL pinning bypass

Apply evidence-led methods for mobile operator work and evidence review

Route Android and iOS app testing across static, dynamic and deep-link checks

Profile MuddyWater TTPs for authorized adversary emulation exercises

Profile Mustang Panda TTPs for authorized adversary emulation exercises

Run NetExec across SMB, LDAP, WinRM and other protocols with 200+ modules

Capture and replay PCAP auth sequences to test session hijack exposure

Test NoSQL injection in MongoDB, CouchDB and Redis for auth bypass

Test device-code token capture against O365 accounts in authorized exercises

Test OAuth and OIDC flows for redirect_uri bypass, state CSRF and PKCE downgrade

Test OPC-UA servers for weak security policies and anonymous access

Test open redirects and tabnabbing for filter bypass and OAuth chains

Manage operational security, scan rate limits and evidence handling in engagements

Coordinate multi-step security engagements with delegation and re-planning

Gather emails, employee lists, breach data and GitHub secrets for recon

Apply evidence-led methods for OSINT operator work and evidence review

Route passive OSINT work using Shodan, Censys, Maltego and breach lookups

Map DNS, WHOIS, subdomains and certificates without touching the target

Profile Patchwork TTPs for authorized adversary emulation exercises

Test PDF lures that route users to fake login portals in authorized phishing

Reason through pentest task trees with evidence, alternatives and prerequisites

Apply evidence-led methods for phishing test work and evidence review

Plan authorized phishing simulations with pretexts, lures and deconfliction

Exploit PHP loose comparison and magic hash flaws to bypass authentication

Profile Pink Sandstorm (Agrius) TTPs for authorized adversary emulation

Document post-exploitation findings, attack paths and detection gaps with CVSS v4

Apply evidence-led methods for post-exploitation work and evidence review

Design phishing pretexts and target shortlists from OSINT for authorized tests

Escalate Windows and Linux host privileges via token, UAC, service and SUID abuse

Test PROFINET devices for discovery, identity spoofing and frame injection

Test reverse proxy misconfigurations like nginx alias traversal and exposed actuators

Test QR-code phishing lures against email gateway URL scanners

Test race conditions and TOCTOU flaws with parallel requests on web apps

Format recon findings with CVSS v4 scores, ATT&CK mapping and evidence

Apply evidence-led methods for recon work and evidence interpretation

Look up payloads, CVE PoCs and writeups from curated security references

Test RMM tool abuse for persistence and C2 in authorized red team exercises

Read and interpret rules of engagement while planning with the operator

Test ROS2 DDS networks for unauthenticated topics and message injection

Find dangling S3 buckets behind subdomain CNAMEs for authorized takeover tests

Profile Salt Typhoon TTPs for authorized adversary emulation exercises

Test SAML 2.0 flows for XML signature wrapping and assertion forgery

Profile Sandworm IT-to-OT tradecraft for lab-only emulation with safety gates

Profile Sandworm Team TTPs for authorized adversary emulation exercises

Profile Scattered Spider TTPs for authorized social engineering emulation

Test self-hosted CI runners for persistence, fork-PR abuse and lateral movement

Check security findings against seven gate questions before reporting

Profile SideWinder TTPs for authorized adversary emulation exercises