01
Web Security
Manual and tool-assisted testing of web applications, from authentication flows to business logic.
- XSS
- SQLi
- IDOR
- SSRF
- Auth bypass
// expertise
End-to-end offensive testing across the attack surface — from a single login form to a full red team engagement.
Manual and tool-assisted testing of web applications, from authentication flows to business logic.
RESTful and GraphQL API testing — authorization, data exposure and rate limiting.
Reverse engineering iOS and Android apps to uncover insecure storage and transport.
Reviewing AWS, Azure and GCP environments for IAM misconfigurations and exposed data.
Infrastructure audits across firewalls, servers and IoT, plus Wi-Fi attack simulation.
Adversary simulation with full kill-chain execution, backed by open-source intelligence.
// gallery
The kinds of engagements I run, from first recon to final report.