Hassan S.

OSCP-certified penetration tester with a critical CVE (CVSS 9.8) to my name, finding real vulnerabilities since 2018. I run manual pentests on web apps, APIs, mobile apps, networks and cloud, with reports your developers can fix from and your SOC 2, PCI DSS or HIPAA auditor will accept. Most clients bring me in for one of three reasons. An auditor or an enterprise customer wants a third-party pentest. A launch is coming and they want to know what an attacker would find first. Or a scanner produced hundreds of "critical" findings and nobody knows which ones are real. Whatever the reason, the work is the same: careful manual testing, every finding validated, and a report that gets things fixed. I started out in bug bounty on HackerOne and Bugcrowd, and I still hunt there. Later I moved into application security at Securiti, where I tested every release on a two-week cycle. Then came two years as a security analyst at Dig8Labs, pentesting web, mobile, API and network targets for financial and healthcare clients and taking part in red team exercises. For part of that time I worked as resident engineer inside a major bank, leading vulnerability remediation across its infrastructure and applications. Being on the receiving end of pentest reports changed how I write them. A finding only matters if it gets fixed, and whether it gets fixed comes down to how clearly it's explained. Scanners have their place, and I use them for coverage. But a scanner won't notice that changing one number in a request returns another customer's invoice, that a password reset token never expires, or that two "low" bugs chain into a full account takeover. Those are the issues that become breaches, and they're where I spend most of my time. One of my published write-ups, linked below, shows how far a single reflected XSS can go. I'm also the credited finder of CVE-2026-45697, a pre-authentication template injection in the Formie plugin for Craft CMS. WHAT I TEST • Web applications: OWASP Top 10 and beyond, including broken access control and IDOR, authentication and session flaws, SSRF, injection, file uploads and business logic • APIs: REST and GraphQL, JWT and OAuth, BOLA, BFLA and mass assignment, rate limiting, and endpoints nobody documented • Networks: external attack surface and OSINT, internal networks, Active Directory, privilege escalation and lateral movement • Mobile: Android and iOS, insecure storage, certificate pinning bypass, and the APIs behind the app • Cloud: AWS, Azure (including Entra ID) and GCP configuration and IAM, plus Docker and Kubernetes • Secure code review alongside a pentest, so each finding points to the line that needs to change AUDITS AND COMPLIANCE SOC 2 Type II, PCI DSS (Requirement 11.4), HIPAA, ISO 27001, or a security questionnaire from a large customer: tell me which one you're facing and I'll scope the test to satisfy it. Testing follows OWASP, PTES, OSSTMM and NIST methodology, and the report documents it, which is what auditors look for. WHAT YOU GET • Each finding with reproduction steps, raw requests and responses, annotated screenshots, a CVSS score and a plain-English note on business impact • Fixes in priority order, written for your engineers • A short executive summary for whoever signs off • A walkthrough call with your team • A free retest after you patch, so the final report shows the issues closed • A letter of attestation for customers and auditors, on request There's a sample report in my portfolio if you want to see the format first. Engagements start with a scoping call where we agree targets, approach (black, grey or white box), rules of engagement and dates. You get a fixed price up front, and I'm happy to sign an NDA. I map the attack surface first, confirm every issue safely, and tell you right away if I find something critical rather than saving it for the report. One client described my work as "uncovering critical vulnerabilities and providing developers with clear Proof-of-Concepts and remediation deliverables." The rest of my reviews here say much the same. I also take on longer engagements: testing each release before it ships, regular retests, or joining your team part-time as a security engineer. I'm available 30+ hours a week and open to contract-to-hire. Certifications: OSCP (OffSec), Certified AppSec Practitioner (The SecOps Group), Rapid7 InsightVM Certified Administrator. Tools: Burp Suite Pro, Nmap, Nessus, Metasploit, SQLMap, OWASP ZAP, MobSF, Frida, Wireshark, Kali Linux and scripts I've written myself. If you've never commissioned a pentest before, you don't need to know exactly what to ask for. Send me a couple of lines about what you're building and why you need the test. I'll tell you whether I'm a good fit, suggest a sensible scope, and give you a fixed price before you commit to anything. I usually reply within a few hours.