Rahees A.

I help businesses find security vulnerabilities in websites, web applications, and APIs before attackers can exploit them. I'm a software engineer with 7 years of experience building web applications, backend systems, and APIs. This development background helps me understand application architecture and identify security weaknesses beyond what automated scanners detect. I combine manual security testing, established penetration-testing tools, and AI-assisted analysis to deliver actionable security assessments. WHAT I OFFER Web Application Penetration Testing - OWASP Top 10 security assessment - SQL Injection and Cross-Site Scripting (XSS) - Broken Access Control and IDOR - Authentication and authorization testing - Session management and JWT security - Business logic vulnerability testing API Security Testing - REST API penetration testing - Broken Object Level Authorization (BOLA) - Authentication and authorization flaws - Input validation and injection testing - Rate limiting and access control assessment - Sensitive data exposure Android Security Assessment - Android application security checks - APK and application configuration review - Insecure data storage checks - API communication security - Authentication and session testing - Android debugging and runtime assessment TOOLS & TECHNOLOGIES - Burp Suite - OWASP ZAP - Nmap - Metasploit - SQLMap - Android Debug Bridge (ADB) DELIVERABLES Every assessment can include: - Executive security summary - Detailed vulnerability findings - CVSS severity classification - Reproducible proof of concepts - Screenshots and technical evidence - Business impact assessment - Remediation recommendations - Retesting and verification MY APPROACH 1. Understand the application and define authorized testing scope. 2. Map the attack surface and identify potential weaknesses. 3. Perform manual and tool-assisted security testing. 4. Validate findings and eliminate false positives. 5. Prepare a professional security assessment report. 6. Verify remediation when requested. I focus on real, validated vulnerabilities rather than generating reports full of automated scanner findings. All security testing is performed with explicit authorization and within the agreed scope. Have a website, API, or Android application that needs a security assessment? Let's discuss your requirements.