Securing Your Web Applications with Precision, Expertise, and Real-World Insights.
My name is Nishat, and I am a professional penetration tester and ethical hacker with extensive experience in securing web applications, APIs, and backend systems. I specialise in identifying vulnerabilities, assessing risks, and providing actionable remediation recommendations to strengthen an organization’s cybersecurity posture. While I am new to Freelancer.com, I bring real-world hands-on experience and deep technical knowledge, ensuring high-quality, reliable results for every client.
I follow a structured and methodical approach to security testing, based on industry standards such as the OWASP Testing Guide, OWASP Top 10, NIST SP 800-115, and modern adversarial tactics. My methodology ensures comprehensive coverage of attack surfaces and focuses on the practical exploitability and impact of each vulnerability. I combine manual testing techniques with industry-leading tools as well as custom-built scripts for advanced testing, automation, and deeper security analysis.
My core services include:
Web Application Penetration Testing – Full OWASP-aligned testing covering authentication, session management, access controls, input validation, business logic flaws, and workflow abuses.
Server-Side Vulnerability Assessment – Detection and exploitation of SQL Injection, NoSQL Injection, Command Injection, Template Injection, XML External Entity vulnerabilities, insecure deserialization, and unsafe file handling.
Client-Side Security Testing – Identification of XSS (stored, reflected, DOM-based), CSRF, Clickjacking, insecure client-side logic, DOM manipulation issues, and weak Content Security Policy enforcement.
API and Backend Security Testing – Assessment of REST, GraphQL, and other API endpoints for authentication flaws, improper input handling, IDOR, endpoint discovery, rate-limit bypass, and data exposure vulnerabilities.
Server and Configuration Security Review – Analysis of server misconfigurations, insecure headers, outdated frameworks, weak SSL/TLS settings, file permissions, exposed admin interfaces, and deployment security weaknesses.
Tools and Techniques – Expertise in Burp Suite Professional, OWASP ZAP, Nmap, SQLMap, Nikto, WhatWeb, Dirsearch, Gobuster, Wfuzz, Raccoon, and other professional-grade tools. Additionally, I develop custom scripts and automation tools for fuzzing, payload generation, and advanced reconnaissance to achieve comprehensive coverage beyond standard scanners.
Reporting and Recommendations – Delivery of detailed, structured, and actionable reports including:
Vulnerability descriptions with severity ratings
Exploitation steps, screenshots, and payloads
Root cause analysis
Practical mitigation strategies
Optional threat modelling using DREAD or STRIDE
Every engagement I undertake is conducted with professionalism, accuracy, and a focus on real-world impact. I prioritize clear communication, detailed evidence, and actionable guidance that allows development teams to remediate vulnerabilities effectively.
Work Terms
All work is performed with strict adherence to ethical hacking principles and legal authorization. The client must provide explicit permission to test systems or applications. I deliver accurate, detailed, and professional penetration testing reports, including exploitation evidence, root cause analysis, and mitigation recommendations. All findings are confidential and intended solely for the client’s use. Reproduction or distribution without consent is prohibited. I am committed to timely communication, meeting agreed deadlines, and providing clear guidance to remediate vulnerabilities. Work will follow industry best practices, OWASP guidelines, and professional testing methodologies. Any tools used, including Burp Suite, OWASP ZAP, Nmap, SQLMap, and custom scripts, will be applied responsibly and safely. I am not liable for misuse of provided findings or unauthorized actions outside the agreed scope.