Pentesting & Recon

Study macOS dylib hijacking, DYLD variables and XPC abuse for process injection

Test how macOS TCC, Gatekeeper, SIP and sandbox protections hold up in red teams

Bypass certificate pinning in Android and iOS apps, including React Native and Flutter

Test ARP, LLMNR, DHCPv6 and VLAN attacks on local networks in authorized tests

Test MongoDB-style query operators and JSON filters for NoSQL injection

Test NTLM relay and coercion paths for privilege escalation in Windows domains

Test path traversal and local file inclusion in downloads, includes and archives

Test race conditions and TOCTOU gaps with single-packet HTTP/2 and rate-limit bypass

Map assets, endpoints and tech stack to build a structured testing plan

Route recon work to asset discovery, fingerprinting and endpoint inventory

Test HTTP request smuggling from framing mismatches between proxies and origin servers

Set up reverse shells, PTY upgrades and file transfers during authorized tests

Recover RSA plaintext from weak keys, small exponents and shared factors

Test SAML assertions for signature flaws, wrapping and audience checks

Escape Python, Lua, seccomp and container sandboxes in CTF and authorized tests

Test SQL injection in login, sorting and filter inputs including blind and OOB paths

Test server-side fetches for SSRF toward internal networks and cloud metadata

Test server-side template injection in previews, rendering and template engines

Build ROP chains and ret2libc exploits from stack overflows on Linux binaries

Find hidden data in images, audio and text using LSB, EXIF and whitespace tricks

Find dangling DNS records that let attackers claim unused cloud or SaaS subdomains

Attack block cipher modes with padding oracles, bit flipping and ECB cut-and-paste

Set up tunnels and pivots through hosts with SSH, Chisel and Ligolo-ng

Test PHP loose comparisons and type juggling in auth and HMAC checks

Test exposed Redis, PHP-FPM, Hadoop and similar services with no authentication

Test file upload checks, storage paths and preview flows for upload-to-RCE chains

Get injection payloads past a WAF with encoding, protocol tricks and rule gaps

Test web caches for path confusion that exposes authenticated pages to other users

Study AMSI, ETW and EDR evasion techniques used in authorized Windows red teams

Map Windows lateral movement with PsExec, WMI, WinRM, RDP and pass-the-hash in tests

Escalate from low-privilege Windows shells with token abuse, Potato and service flaws

Test XSLT processors for XXE, document() SSRF and extension-based code execution

Test user input in HTML, attributes, DOM sinks and uploads for XSS

Test XML, SVG and OOXML parsers for external entity file reads and SSRF

Build safe local reproductions of patched CVEs for write-ups and control testing

Reproduce and patch disclosed, already-fixed vulnerabilities in a pinned offline lab

Hunt bug bounty programs on YesWeHack with scope mapping and report drafting

Bypass 401 and 403 access controls through path tricks, headers and method changes

Abuse dangerous Active Directory ACLs found by BloodHound for takeover paths

Abuse unconstrained, constrained and RBCD Kerberos delegation to impersonate users

Run a full Active Directory domain attack from enumeration to DCSync and tickets

Keep domain admin access alive with scheduled tasks, Golden Tickets and AdminSDHolder

Escalate across Active Directory domain trusts with SID history and ExtraSids

Abuse Active Directory Certificate Services flaws ESC1 to ESC11 with Certipy

Collect domain controllers, trusts, GPOs and SPNs from Active Directory with Adinfo

Test AI agent systems against the OWASP Agentic AI Security Top 10

Test LLM and RAG systems for system prompt leaks, data extraction and poisoning

Test agent identity, permissions and session security in AI and MCP systems

Test Jupyter, MLflow, Ray, Gradio and Ollama servers for missing authentication