Gray Box Online Shop PenTest

I need a seasoned penetration tester to perform a gray-box security assessment of my live e-commerce site. You will receive limited user-level credentials; everything else you discover on your own. This is currently a complete test environment on which you can test everything.

My top concerns are:
• SQL injection
• Cross-site scripting (XSS)
• Broken authentication and session handling

Feel free to probe other vectors you spot, but the report must clearly state findings in those three areas.

Deliverables
1. Executive summary written in plain language for non-technical stakeholders.
2. Technical report detailing each vulnerability, its severity (CVSS preferred), reproducible proof-of-concept steps, affected endpoints, and recommended fixes.
3. Secure copies of any custom scripts or payloads you create during testing.
4. Optional short call to walk me through critical issues and clarify remediation steps.

Scope guidelines
• Only test the test shop domain and its API endpoints.

If you have experience with OWASP Top 10, Burp Suite, Zap, or similar tooling, let me know in your proposal along with an estimated timeline.