Pentesting & Recon

Run SQL injection tests with sqlmap, including WAF bypass tamper scripts

Set up proxy rotation and stealth HTTP tooling for authorized web testing

Collect operator inputs through structured questions with free-form answers

Capture and replay 433, 868 and 915 MHz radio signals with SDR tools

Apply evidence-led methods for supply chain operator work and evidence review

Route supply-chain attack simulations from typosquats to mirror poisoning

Test exposed Terraform state files for secrets, keys and infrastructure layout

Profile Turla TTPs for authorized adversary emulation exercises

Test HTTP verb tampering and method override for auth bypass

Profile Volt Typhoon living-off-the-land TTPs for authorized emulation

Orchestrate a five-stage vulnerability pipeline from scan through exploit

Evade WAFs with payload obfuscation, origin IP discovery and rate tricks

Route web exploitation work to the right technique playbook

Find REST API endpoints, detect GraphQL and fuzz parameters

Map login endpoints and JWT, OAuth, SAML and SSO auth mechanisms

Test web cache poisoning through unkeyed headers and parameter cloaking

Scan WordPress, Joomla and Drupal sites for versions and known issues

Audit cookies and bisect which ones gate hidden sinks and race windows

Discover web app files and vhosts and pull JavaScript endpoints

Enumerate web apps for directories, vhosts, APIs, CMS and WAF exposure

Find subdomain takeovers from dangling DNS on GitHub Pages, Heroku and Azure

Fingerprint which web application firewall protects a target

Apply evidence-led methods for wireless operator work and evidence review

Route 802.11 wireless attack testing by target crypto type and posture

Assess wireless networks across WiFi, Bluetooth, RFID and NFC

Test WPA-Enterprise networks for rogue RADIUS and MSCHAPv2 capture

Capture WPA2-PSK handshakes and crack passphrases offline with hashcat

Test WPA3-SAE transition downgrades and Dragonblood side channels

Recover WPA keys from WPS with the Pixie-Dust offline attack

Test XPath and XSLT injection in XML data stores and server-side XSLT

Test cross-site leaks that infer authenticated state via timing and frames

Exploit reflected, stored and DOM XSS including CSP and filter bypasses

Test Z-Wave networks for S0 key derivation flaws and replay exposure

Test Zigbee Touchlink commissioning for key exposure and command injection

Index of pentesting, code audit, red team and threat intel guides for security work

Run an Android APK red-team pipeline from decompilation to intent injection probes

Find where local bug bounty tools, wordlists and clones are installed

Plan a bug bounty hunt with a five-phase workflow and anomaly checks

Run a full bug bounty workflow from recon and scope checks to reporting

Write Bugcrowd reports with VRT category matching and severity overrides

Assess VPN and remote-access appliances from Cisco, Fortinet, Citrix and Palo Alto

Redact cookies and personal data from bug bounty proof-of-concept evidence

Hunt API mass assignment, prototype pollution and HTTP verb tampering bugs

Hunt ASP.NET ViewState, machineKey and trace endpoint weaknesses

Hunt account takeover paths through password reset, OAuth linking and MFA gaps

Hunt authentication bypasses in SAML flows, login logic and access controls

Hunt missing rate limits, OTP brute force and username enumeration weaknesses

Hunt business logic flaws like coupon stacking, negative quantities and price tampering

Hunt web cache poisoning and cache deception bugs in CDN and proxy setups