I perform black-box and grey-box penetration testing on web applications, covering public pages, authenticated areas, forms, API calls, and AJAX endpoints. My process follows a structured methodology: reconnaissance, vulnerability identification (SQLi, XSS, IDOR, auth bypass, business logic flaws), exploitation validation, and remediation guidance.
Every engagement includes a professional report: executive summary for stakeholders, CVSS-scored technical findings with reproduction steps and screenshots, and one retest to confirm fixes after remediation. I'm CEH and ISO/IEC 27001 certified, and I run non-destructive testing that respects your rules of engagement — no data deletion, no bulk extraction, immediate notification on critical findings.
Ideal for websites, SaaS platforms, and web apps that need an external security review before launch, after a major update, or as part of a compliance requirement.