Pentesting & Recon

Test IP cameras over RTSP and ONVIF when port 554 is open

Decode, forge and brute-force JWTs when a Bearer auth header is present

Test LLM apps for prompt injection, system prompt leaks and unsafe tool use

Find origin IPs behind a CDN or WAF using favicon hashes, DNS history and certs

Plan authorized password spray tests across M365, Okta, Exchange and Kerberos

Run a seven-phase pentest pipeline from passive recon through exploitation

Turn an exposed phpinfo page into remote code execution on PHP servers

Scan large IP ranges for open ports with Masscan, RustScan and nmap banners

Scan hosts with nmap to find MySQL, Redis, FTP, SSH and internal API services

Plan an authorized external web and API assessment, starting with recon

Run parameterized recon against a sector database of target companies

Expand sector recon with new candidate domains and run the testing pipeline

Test public S3 or MinIO buckets for stored XSS via Content-Type override

Test SAML SSO for XML signature wrapping, signature stripping and metadata leaks

Enumerate Hikvision ISAPI endpoints on SCADA and IoT web interfaces

Pick target sectors, compile domains and batch recon for authorized security tests

Scan for exposed .env files, backups and git configs across many hosts

Find staging hosts in certificate transparency logs when production is hardened

Enumerate subdomains with crt.sh and subfinder at the start of a recon job

Verify subdomain takeovers caused by dangling CNAMEs pointing to unclaimed services

Exploit unauthenticated multi-step API flows that work without any credentials

Find hidden virtual hosts by fuzzing the Host header and parsing SSL certificates

Screenshot all live hosts to triage targets and fingerprint their technology

Scan web apps for sensitive files, path traversal, vhosts and exposed .env files

Chain verified WordPress CORS, XML-RPC and upload flaws into an RCE path

Chain verified WordPress findings into an authorized path to admin or server control

Find WordPress plugins through the REST API and match their versions to known CVEs

Batch-scan many WordPress sites for users, CORS, XML-RPC and leaked files

Batch-test WordPress plugin CVEs across many domains with detection scripts

Find and verify CVEs in WordPress plugins from version data and CVE databases

Find WordPress REST plugin routes that change data without authentication

Run a 12-phase web app pentest that follows the OWASP WSTG methodology

Test WordPress XML-RPC multicall and pingbacks for brute force and SSRF flaws

Test Zimbra for SOAP user enumeration, CVE-2022-37042 and SSRF on webmail

Run passive domain recon for subdomains, SSL certificates, WHOIS and DNS records

Run red team exercises for jailbreaks, data leaks and agent tool abuse

Run basic penetration tests with recon, vulnerability discovery and exploitation