Pentesting & Recon

Profile FIN7 spearphishing and ransomware tradecraft for authorized emulation

Profile FIN7 (Carbanak) TTPs for authorized adversary emulation exercises

Write final pentest reports with executive summary and remediation roadmap

Define finding schemas, evidence references and verification rules for reports

Interpret finding verdicts and present justified severity with evidence and fixes

Test flash-loan patterns such as callback reentrancy and oracle amplification

Escalate from one GCP project to organization-wide control in authorized tests

Chain GCP service account impersonation and actAs grants to reach org admin

Launch tracked phishing simulations through the GoPhish REST API

Test GraphQL APIs for introspection, injection and authorization gaps

Test HTTP header injection, CRLF splitting and host-header cache poisoning

Test HTTP parameter pollution for parser mismatches and WAF bypasses

Test HTML smuggling delivery that evades email gateway file inspection

Test BACnet/IP building automation devices for discovery and write exposure

Test DNP3 outstations for enumeration, control and auth downgrade exposure

Test Modbus TCP devices for unauthenticated reads and writes

Apply evidence-led methods for ICS operator work and evidence review

Route ICS and OT assessments by protocol, confirming written scope first

Route industrial control system testing and gate every write action on approval

Test Siemens S7 PLCs for unauthenticated reads, writes and mode changes

Pivot from SSRF or RCE to cloud metadata and steal instance role credentials

Apply evidence-led methods for IoT operator work and evidence review

Route IoT and embedded device testing from firmware to wireless sidebands

Assess IoT devices for default credentials, firmware flaws and exposed protocols

Test JWT flaws like alg confusion, kid injection and weak HMAC secrets

Pivot through Kubernetes service accounts, RBAC and kube-apiserver access

Escape Kubernetes pods to the node through hostPath, privileges and capabilities

Escalate Kubernetes RBAC permissions through pods/exec, secrets and impersonation

Drive Kali Linux tools through an MCP server with SSH tunnel setup

Request Kerberos service tickets for SPN accounts and crack them offline

Analyze kill chains and pick attack paths by prerequisites and confidence

Profile Kimsuky (Velvet Chollima) TTPs for authorized adversary emulation

Test legacy 802.11 clients for KRACK and FragAttacks key reinstallation flaws

Extract LAPS-managed local admin passwords from AD computer objects

Move laterally with Pass-the-Hash, WinRM, PsExec and Ligolo-ng tunnels

Profile Lazarus social engineering and supply-chain tradecraft for authorized emulation

Profile Lazarus Group TTPs for authorized adversary emulation exercises

Test LDAP injection for auth bypass, filter abuse and blind extraction

Test path traversal and local file inclusion for file reads and PHP wrapper RCE

Enumerate Linux privilege escalation paths from sudo and SUID to kernel CVEs

Route LLM red team tests across the AATMF v3 tactic catalog

Profile RaaS affiliate tradecraft from initial access to canary encryption

Register and configure lookalike domains with DNS and TLS for phishing tests

Test LoRaWAN join procedures, frame replay and rogue gateway downlinks

Run the out-of-band blue team handshake before any phishing campaign sends

Test Microsoft 365 mailbox compromise paths from consent phishing to persistence

Test macOS post-exploitation for launchd persistence, TCC and Keychain access

Test mass assignment that lets extra request fields escalate to admin

Test 2FA and OTP flows for reuse, race, backup-code and reset bypasses