Sareer A.

Penetration tester (OSCP) for web apps, APIs and networks. I find the access-control, business-logic and infrastructure weaknesses that scanners miss, then give your team a clear report: what to fix, why it matters, and how to verify the fix. I'm Sareer -- founder of secfinity.net and a former Offensive Security Expert at Microsoft and at Mercedes-Benz. I work with clients in English and German. Whether you're preparing a release, responding to a customer security review or assessing an existing environment, I help you define a practical testing scope and turn the results into clear engineering actions. WEB APPLICATION & API TESTING • Authentication, session management and authorization across users and roles • IDOR/BOLA, tenant isolation and business-logic weaknesses • Injection, file uploads, SSRF and other relevant OWASP testing areas • Black-box, grey-box or code-assisted testing, depending on the agreed scope NETWORK & ACTIVE DIRECTORY TESTING • External exposure and exploitable service misconfigurations • Internal network and Active Directory assessments • Privilege escalation, lateral movement and segmentation testing within the agreed rules of engagement WHAT YOU RECEIVE • Manually validated findings with reproduction steps and technical evidence • Severity ratings, business impact and practical remediation guidance • An executive summary, tested scope and clearly documented limitations • A findings walkthrough and remediation verification within the agreed retest scope My approach combines manual investigation with targeted tooling. Before testing, we agree the systems, access, testing window and operating constraints. If you need evidence for an audit or customer review, we establish the reporting requirements during scoping. Through Secfinity, I've developed a reporting workflow that keeps findings, evidence and remediation guidance organized and readable for both engineers and decision-makers. Send me a message on Upwork with your application or environment, approximate scope and deadline. I'll help you define the assessment and provide an estimate based on what needs testing. Testing requires written authorization from the system owner or an authorized representative.