Pentesting & Recon

Get confirmed payloads past WAF rules with encoding, method and parameter tricks

Run a web app pentest that follows the OWASP WSTG methodology with Burp Suite

Test CDN path normalization flaws that cache private authenticated responses

Test cache poisoning through unkeyed headers and parameters in authorized tests

Capture WPA2 handshakes and test passphrase strength with aircrack-ng and hashcat

Run WiFi pentests that capture handshakes, detect rogue APs and test segmentation

Test Microsoft 365 tenants with GraphRunner for persistence and mailbox access paths

Probe LLM endpoints for jailbreaks, prompt injection and data leakage with garak

Relay coerced NTLM auth to AD CS web enrollment (ESC8) in internal pentests

Run advanced Nmap scans with NSE scripts, timing and evasion options

Test exported Android components and intents for injection and data leaks

Test API auth for broken token checks, JWT flaws and credential stuffing exposure

Find BOLA and IDOR flaws by swapping object IDs across REST and GraphQL APIs

Find mass assignment bugs by adding hidden fields like role or isAdmin to requests

Test REST, GraphQL and gRPC APIs against the OWASP API Security Top 10

Find CORS misconfigurations that let other origins read authenticated responses

Test web apps and APIs for broken access control with Burp Suite Authorize

Find price, workflow and voucher logic flaws that scanners miss in Burp Suite

Test contact forms and password resets for CRLF and SMTP header injection

Test Host header handling for password reset poisoning and cache poisoning

Test JWTs for alg none, key confusion and kid injection with jwt_tool

Find open redirects in next and return parameters and chain them into phishing

Find leaked API keys, PII and insecure storage during security assessments

Test LLM apps for system prompt leakage with direct and encoded extraction tricks

Test XML inputs for XXE, XPath injection and entity attacks that leak files

Test for reflected, stored and DOM XSS, then bypass sanitizers and CSP

Find and validate XSS with the Burp Suite scanner, Intruder and Repeater

Exploit XXE to read server files, run SSRF and exfiltrate data in pentests

Assess JWT implementations for weak signing, algorithm confusion and auth bypass

Test mobile app backend auth for token handling, session fixation and IDOR

Test OAuth 2.0 and OIDC flows for redirect URI, PKCE and token leakage flaws

Test RAG pipelines for poisoned documents and indirect prompt injection

Test WebSocket handshakes for hijacking, injection and flooding with Burp and wscat

Fuzz REST and GraphQL APIs for IDOR and other authorized bug bounty flaws

Test authentication, sessions and password policies for broken auth flaws

Intercept and modify web traffic with Burp Suite to find web app vulnerabilities

Test web apps for XSS and HTML injection and assess content security policy bypasses

Test web apps for directory traversal and local file inclusion vulnerabilities

Find insecure direct object references and broken access control in web apps

Run reconnaissance, subdomain enumeration and XSS hunts with bug bounty tooling

Apply MITRE ATT&CK red team tactics, detection evasion and reporting principles

Scan networks, web apps and cloud setups with standard security scanning tools

Find exposed devices and open services with Shodan during authorized recon

Automate SQL injection testing and enumerate databases with sqlmap in authorized tests

Test web apps for OWASP Top 10 flaws including injection, XSS and access control

Plan authorized red team engagements with ATT&CK kill chains and attack paths

Run security audits with OWASP checks, dependency scans and pen test reports

Scan internal networks with fscan for live hosts, open ports and exposed services

Attack Active Directory in authorized red team engagements, from recon to escalation