Pentesting & Recon

Test detection gaps from log clearing and timestamp tampering in red team drills

Find API business logic abuse and GraphQL batching flaws in authorized tests

Test REST, gRPC and WebSocket APIs against the OWASP API Security Top 10

Test Bluetooth Low Energy devices for unauthenticated GATT access and pairing flaws

Test Bluetooth Classic devices for SDP exposure, PIN weaknesses and profile abuse

Test web and mobile apps for workflow bypass, coupon stacking and price tampering

Deploy and configure C2 frameworks like Cobalt Strike and Sliver for red teams

Test CI/CD pipelines for GitHub Actions injection, Jenkins flaws and token overreach

Test CI/CD environments and vaults for exposed secrets and misconfigured stores

Test AWS, Azure and GCP for credential theft and IAM privilege escalation paths

Test containers for breakout paths through mounts, sockets and capabilities

Test applications for padding oracles, ECB flaws and other crypto implementation bugs

Test data exfiltration paths like DNS tunnels and cloud dead drops in red teams

Run authorized deauth tests on 802.11 networks, including PMF-aware checks

Test package registries for dependency confusion and npm scope namespace gaps

Test insecure deserialization in Java, PHP, .NET, Python and Node.js apps

Run authorized evil twin and KARMA access point tests with captive portal checks

Fuzz targets with AFL++, libFuzzer and syzkaller, from harness to crash triage

Test GraphQL APIs for introspection abuse, auth bypass and batching attacks

Test IoT devices from UART and JTAG recon to firmware extraction and analysis

Test JWT implementations for algorithm confusion, weak secrets and header injection

Test Kubernetes clusters for stolen service account tokens and RBAC escalation

Test WPA2 supplicants for KRACK and FragAttacks key reinstallation flaws

Test lateral movement with pass-the-hash, NTLM relay and remote execution protocols

Test Linux hosts for privilege escalation through SUID, capabilities and sudo

Test LoRaWAN joins and sub-GHz remotes for replay and key reuse weaknesses

Pentest Android and iOS apps with static analysis, Frida and pinning bypass

Use NetExec for authorized AD enumeration and protocol-level post-exploitation

Run network attacks like ARP spoofing and LLMNR poisoning in internal assessments

Gather recon from domains, code leaks, Shodan and breach data for authorized tests

Test Windows and Linux persistence mechanisms like scheduled tasks and WMI subscriptions

Run authorized phishing campaigns with domain, DNS and email authentication setup

Write pentest and red team reports with risk-led summaries and CVSS scoring

Write position-independent shellcode and loaders for authorized red team work

Run authorized social engineering tests, including pretexting and vishing

Test for SQL injection across error, blind, out-of-band and NoSQL variants

Test template engines for server-side template injection and code execution

Test software supply chains for dependency confusion and malicious package injection

Audit TLS setups for downgrade attacks and misconfigurations like POODLE and DROWN

Find TOCTOU race conditions in files, kernels, web apps and containers

Assess Wi-Fi networks for handshake capture, WPA3 downgrades and enterprise EAP flaws

Survey airspace with monitor mode, fingerprint networks and map clients for tests

Test Windows hosts for privilege escalation via token impersonation and service abuse

Test WPA-Enterprise 802.1X setups for EAP method flaws and RADIUS impersonation

Test WPA2 passphrases with handshake and PMKID capture and GPU cracking

Test WPA3 SAE networks for transition-mode downgrades and Dragonblood flaws

Test WPS-enabled routers for PIN weaknesses, including Pixie Dust offline attacks

Test Z-Wave smart home networks for S0 key derivation flaws and replay exposure

Test Zigbee, Thread and Matter mesh networks for Touchlink and replay weaknesses