Application Penetration Test Required
Budget: $30 – $250 USD
I need a controlled, professional penetration test against my own server, strictly for a security assessment. The scope is limited to application-level security; network, wireless, and physical assets are out of bounds unless something there directly affects the application attack surface.
Here’s what I expect:
• An ethical attack on every exposed application component—APIs, web front-end, authentication flows, file uploads, session management, business logic, and any third-party integrations.
• Use of industry-standard tooling such as Burp Suite, OWASP ZAP, Metasploit, and custom scripts where helpful, always observing responsible-disclosure practices.
• Zero disruption to production data or availability; all tests must run in the maintenance window we will schedule together.
• A clear, prioritized report that lists each finding, proof-of-concept steps, risk rating (using CVSS or similar), and actionable mitigation advice.
• A brief follow-up call so I can walk through the results, clarify technical details, and plan remediation.
Only conduct activity I have explicitly authorized in writing. Any discovery of critical issues must be reported immediately so I can triage them. I’ll provide you with target URLs, test credentials, and any additional documentation you need once we’ve agreed on terms.
Here’s what I expect:
• An ethical attack on every exposed application component—APIs, web front-end, authentication flows, file uploads, session management, business logic, and any third-party integrations.
• Use of industry-standard tooling such as Burp Suite, OWASP ZAP, Metasploit, and custom scripts where helpful, always observing responsible-disclosure practices.
• Zero disruption to production data or availability; all tests must run in the maintenance window we will schedule together.
• A clear, prioritized report that lists each finding, proof-of-concept steps, risk rating (using CVSS or similar), and actionable mitigation advice.
• A brief follow-up call so I can walk through the results, clarify technical details, and plan remediation.
Only conduct activity I have explicitly authorized in writing. Any discovery of critical issues must be reported immediately so I can triage them. I’ll provide you with target URLs, test credentials, and any additional documentation you need once we’ve agreed on terms.