Alvin F.

Introducing Alvin Ferdiansyah, a Cyber Security Consultant with proven professional years of experience in the field. With a top industry certification, Alvin specializes in offensive security, focusing mainly on web applications and infrastructure. He's passionate about learning, often diving into bug write ups to pick up new tricks. His favorite moments come about when he can give his best and uncover impactful vulnerability holes in his work. My expertise lies in delivering end-to-end security assessments, from reconnaissance and manual exploitation to in-depth analysis and detailed reporting. I’ve led and contributed to both black-box and grey-box testing engagements, working directly with development and security teams to provide impactful recommendations and reduce attack surface. Over the past years, I’ve conducted security testing across a wide range of environments including financial systems, e-commerce websites, CMS, SaaS platforms, banking sector, cloud hosted infrastructures, insurance and health care companies, and custom software developed by various software houses. Certifications: - CREST Registered Penetration Tester (CRT) - OffSec Certified Professional (OSCP) - PortSwigger Burp Suite Certified Practitioner (BSCP) - CREST Practitioner Security Analyst (CPSA) - Web application Penetration Tester eXtreme (eWPTX) - Mobile Application Penetration Tester (eMAPT) Core Capabilities: - Web Application Penetration Testing: Manual exploitation of OWASP Top 10 vulnerabilities (XSS, IDOR, SQLi, SSRF, CSRF, auth bypass, etc.) - API Security: RESTful, Postman collections, JSON/XML/SOAP based APIs, token tampering, weak token implementation, etc. - Mobile App Security Testing: Reverse engineering APKs, Frida based dynamic instrumentation, root detection bypass, certificate pinning bypass, insecure storage analysis (shared prefs, SQLite, internal files), .so/native lib analysis. - Advanced tool usage (Burp Suite, Kali Linux, nmap, metasploit, nessus, etc) - End2End encryption bypassed. - Custom scripting in Python for automation, request manipulation, and response parsing - Red Team Support: Custom payload development, client-side attacks, infrastructure enumeration, phishing simulation. My testing process is rooted in proven frameworks of OWASP Testing Guide. Each engagement is tailored based on client objectives, risk appetite, and application architecture, but generally follows this structure: - Scoping & Rules of Engagement - Reconnaissance & Threat Modeling - Vulnerability Discovery (automated + manual) - Exploitation (controlled and risk-aware) - Post-Exploitation Analysis (privilege escalation, data exposure) - Reporting (technical + business impact, PoCs, remediation guidance) - Retesting (to verify fixes and validate security posture) This methodology ensures coverage, clarity, and repeatability, allowing stakeholders to clearly understand risk while prioritizing fixes effectively. Deliverables You Can Expect: - PDF report with detailed vulnerabilities, CVSS scores, descriptions, PoCs, and remediation steps - CVSS Scoring and component details. - Executive summary (1 page) for management - Exploitable PoCs with step by step replication - Clear technical and business impact descriptions - Mitigation and recommendation strategies aligned to your environment - OWASP/CWE mapping for risk classification - Structured documentation, screenshots, logs, and retesting summaries Why work with me? - I don’t just find bugs. I help you understand their risk, context, and business impact. - I offer fullcycle engagement: from scoping and execution to documentation and retesting. - I respect deadlines, communicate transparently, and provide clean, organized results. Let’s ensure your application stands secure against today’s threat landscape. I’m available to start as early as you need, and I’ll tailor the engagement to fit your testing scope and business needs. Looking forward to the opportunity. Alvin Ferdiansyah Cybersecurity Consultant | Penetration Tester | OSCP, CREST CRT, CPSA, eWPTX, eMAPT, BSCP