Methodology · OWASP WSTG · API Top 10 · PTES

Audit Methodology

Automated coverage and manual exploitation, in that order. Scanners do the routine checks. The depth comes from manual work on business logic, auth flows, and vulnerability chains.

Audit phases

00Phase 00: Scoping

01Phase 01: Reconnaissance

02Phase 02: Discovery

03Phase 03: Exploitation

04Phase 04: Reporting

Web SecurityInfra & AD

Scoping

Authorized, bounded, documented

NDARoEScopeSysReptor

Scoping & Rules of Engagement

—

Authorization & Scope

Signed NDA and written authorization before any traffic. Scope, out-of-scope assets, and testing windows are fixed in advance.

—

Rules of Engagement

DoS exclusions, sensitive-data handling, and an emergency contact, all in writing. We test hard and we do not break production.

—

Test Accounts & Roles

At least two accounts per role. That is what makes IDOR and BOLA testing real instead of a guess.

Reconnaissance

Mapping the attack surface

bbotnmapjqGoogle DorksCNAME

Reconnaissance

—

Asset Enumeration

bbot and nmap plus custom scripts. VHost fuzzing, cloud bucket enumeration, subdomain takeover via CNAME analysis.

—

Data Parsing & Filtering

jq pipelines for large datasets. Find direct origin IPs behind Cloudflare/CDN, categorize tech stacks, flag admin interfaces.

—

Passive Recon & OSINT

Non-invasive searches for leaked credentials and sensitive data exposure via Google Dorks. EXIF metadata analysis before the active phase begins.

Discovery

Systematic audit for misconfigurations and known CVEs

NucleiFeroxbusterKiterunnerSwagger/OpenAPI

Vulnerability Discovery

—

Active Auditing

Nuclei plus Feroxbuster pass for known vulns and server misconfigs. Tuned for recursive directory fuzzing with low false-positive rate.

—

API and Route Analysis

Kiterunner finds hidden API endpoints. Then read the Swagger/OpenAPI specs and reverse the JS bundles for undocumented routes.

—

Perimeter Hardening

Review of SSL/TLS configs, CSP, and DMARC. Blocks the easy client-side attacks.

Exploitation

The work scanners can't do

Burp SuiteAutorizeOASTGraphQL

Manual Exploitation

—

Injection

SQLi, XSS, SSTI, NoSQL, command injection, XXE. Every one is checked by hand, so the report carries no scanner false positives.

—

Access Control & IDOR

Horizontal and vertical privilege escalation, IDOR, and API-layer BOLA and BFLA, run against real multi-account and multi-tenant setups.

—

Authentication & Session

JWT integrity, OAuth and OIDC flows, session fixation, logout invalidation, and rate-limit and MFA bypasses.

—

API Security

OWASP API Top 10: broken object and function-level authorization, mass assignment, excessive data exposure, and GraphQL introspection abuse.

—

Business Logic Flaws

Race conditions, workflow circumvention, parameter tampering. No scanner understands intent, so this part is all manual.

—

Chaining & Out-of-Band

Prototype pollution, insecure deserialization, and SSRF into internal services and cloud metadata. We catch the blind ones (SQLi, XXE, command injection) with out-of-band OAST servers.

Reporting

Translating technical findings into business risk

CVSS v3.1/v4.0OWASP WSTGPTES

Reporting

—

Executive Insight

A plain-language overview of security posture and risk, written for people who don't read CVE descriptions for fun.

—

Technical Roadmap

Reproducible PoCs with concrete remediation and patch verification steps. Your engineers can act on it.

—

Risk Prioritization

CVSS v3.1/v4.0 scores, so critical assets get patched first. Each finding includes severity, impact, and effort to fix.

[ 05 ] · Sample Report

Final Report Preview

Anonymized · Real Format

Report · Anonymized

Sample Pentest Report

Real format from a recent engagement. Vulnerability chains, working PoCs, remediation. Read it before you book to see what you'd get.

Executive summary for decision-makers
Vulnerability chains with working PoC
CVSS v3.1/v4.0 severity ratings
Step-by-step remediation instructions
Retest verification checklist
Delivered in your own template on request

[ Access Document ]

What's in the report

Executive Summary

One-page overview of security posture, risk level, and top critical findings written for CTO/CEO.

Vulnerability Register

Full list of findings with CVSS scores, affected components, attack vectors, and business impact assessment.

Proof of Concept

Step-by-step reproduction for every finding. Screenshots, payloads, HTTP requests. Whatever your dev team needs to confirm the bug.

Remediation Guide

Concrete fix instructions per finding. Not 'update your software' but specific code changes and configuration fixes.

Retest Checklist

Verification checklist for each fix. Run before the engagement closes.

Let's discuss your scope.

Free Consultation
30 minutes · No commitment
NDA before any work

[ Request a Consultation ]