Pentesting & Recon

Guide authorized Active Directory red-team testing with scope, evidence and exit rules

Guide authorized API security testing for BOLA, auth bypass and mass assignment

Guide authorized testing of authentication, JWT, OAuth and MFA weaknesses

Guide authorized web cache poisoning tests with unkeyed inputs and CDN behavior

Guide authorized clickjacking tests covering frame options and CSP bypasses

Guide authorized cloud security tests for IAM, storage, metadata and serverless flaws

Guide authorized command injection tests, including blind and out-of-band variants

Guide authorized source code security review with data-flow and dependency checks

Guide authorized container and Kubernetes security tests including escape paths

Guide authorized CORS tests for origin reflection, null origins and credential exposure

Guide authorized cryptography weakness tests on algorithms, padding and key handling

Guide authorized CSRF tests covering token bypasses, SameSite gaps and JSON CSRF

Match recon findings to CVEs with evidence before deeper red-team testing

Validate candidate CVEs with scoped evidence before deciding to pivot or report

Guide authorized insecure deserialization tests across Java, PHP, Python and .NET

Guide authorized defense evasion tests for WAF bypass, EDR and traffic obfuscation

Guide authorized file vulnerability tests for path traversal, uploads and LFI

Guide authorized NoSQL, LDAP, XPath and expression injection tests

Guide authorized business logic tests for races, price tampering and permission flaws

Guide authorized mobile app tests on storage, pinning bypass and exposed components

Guide authorized network security tests for exposed services and segmentation bypass

Guide authorized open redirect tests, including OAuth redirect_uri abuse

Guide authorized payload construction and staging choices for red-team testing

Guide authorized post-exploitation work on privilege escalation and lateral movement

Guide authorized recon for subdomains, port scanning, fingerprinting and OSINT

Build a recon profile from a bare domain, URL or IP before attack routing

Guide authorized SQL injection tests for union, blind, error and second-order variants

Guide authorized SSRF tests for blind SSRF, protocol smuggling and cloud metadata

Guide authorized server-side template injection tests for common template engines

Guide authorized subdomain takeover tests for dangling DNS and cloud services

Route authorized web security testing to the right vulnerability specialist skills

Guide authorized XSS tests for reflected, stored, DOM-based and CSP bypass cases

Guide authorized XXE tests for file read, SSRF and blind XXE variants

Guide hands-on web and AI security tests with case studies and OWASP LLM risks

Run a full web application penetration test from stack fingerprinting to logic flaws

Walk through advanced web attack surfaces with injection, protocol and logic playbooks

Solve CTF challenges that involve attacking ML models, prompt injection and LoRA

Solve CTF cryptography challenges covering RSA, AES, lattices and padding oracles

Solve miscellaneous CTF puzzles such as pyjails, encodings, SDR and sandbox escapes

Gather open source intelligence for CTF tasks, from geolocation to username lookup

Turn memory corruption bugs in CTF targets into code execution with ROP and heap tricks

Find similar CTF challenge writeups online to get reference solutions

Exploit web CTF targets covering XSS, SQL injection, SSTI, SSRF, JWT and uploads

Write a standardized CTF writeup covering solution steps, tools and lessons

Triage a CTF challenge, identify its category and route it to the right solver

Run an AWS Security Agent penetration test on a live web app and verify findings

Judge whether a domain can be spoofed from SPF, DKIM and DMARC DNS records

Map identity provider and tenant setup for a company without testing credentials

Run external recon with wordlists, port lists and vendor product fingerprints