Application & API Penetration Testing
Automated scanners find the easy 30%. The findings that hurt are usually human ones: a broken object-level authorization check, a JWT you can forge, a checkout that lets someone pay once and ship twice. I test the way an attacker would, then write it up so your engineers can fix it without guessing.
- Typical timeline
- 1 to 3 weeks, depending on surface area
- Engagement
- Fixed scope, fixed fee
- Deliverable
- Report, PoC evidence and retest
What the work covers.
Authentication & session security
OAuth 2.0 and OIDC, SAML, JWT handling, MFA enrollment and bypass, session fixation, token leakage and refresh-flow abuse.
Access control & tenancy
IDOR and BOLA, broken function-level authorization, tenant isolation, privilege escalation and role confusion across every object type.
API testing
REST and GraphQL. Introspection abuse, field-level authorization gaps, batching attacks, mass assignment, and the Swagger/OpenAPI surface you forgot was public.
Business logic
Payment and billing flows, signup and referral abuse, coupon and credit manipulation, rate-limit bypass, and multi-step workflow shortcuts.
Injection & server-side flaws
SQLi, NoSQLi, SSTI, SSRF, XXE, insecure deserialization, file upload and path traversal. Confirmed with a working proof, not a scanner line.
Source-aware review
When I can see the code, I read the PHP, .NET or JavaScript and point at the line that needs to change.
How the engagement runs.
No engagement starts without a written scope and agreed rules of engagement. Testing windows, contacts and escalation paths are fixed before anything is touched.
What I need from you
- Scope: URLs, apps, IP ranges or accounts in scope
- One technical contact and one escalation contact
- A testing window, or written approval to test 24/7
- Credentials for the roles that should be tested
- 01
Scope
A short call, then a written scope. Targets, rules of engagement, testing windows and anything that is out of bounds.
- 02
Test
Manual work against the real attack surface, with automated tooling where it helps. Findings are confirmed before they reach the report.
- 03
Prove
Every issue comes with reproduction steps, a CVSS score and a realistic impact statement. Critical is just a word without evidence.
- 04
Verify
After remediation I retest each finding and confirm it is closed. Most engagements stop before this step. This is the one that counts.
Often paired with
Cloud & Infrastructure Security Review
A focused review of the cloud and Linux estate your product sits on. Identity, object storage, network exposure, and the CDN edge in front of it.
SIEM Engineering & Detection
I design, deploy and tune Wazuh so your monitoring actually catches things. Log ingestion, correlation rules, file integrity monitoring and dashboards.
Ready to scope this work?
Send a short description of the environment and what you need to know. You will get an honest read on scope, timeline and whether this is the right engagement.
Typically replies within one business day. NDA on request.
enes.ismaili@gmail.com