Web Application Pentesting
Manual-first web application testing — authentication, access control, injection and the business-logic flaws scanners miss.
What I deliver
- Black, grey and white-box web app testing
- OWASP WSTG methodology, ASVS-mapped findings
- Auth, session, access control and multi-tenant isolation
- Business logic abuse: pricing, workflow and race conditions
- CVSS-scored report with PoCs and free retest
Step by step
- 01
Map every page, role and workflow
- 02
Test authentication and session handling
- 03
Test access control across roles and tenants
- 04
Hunt injection, XSS and business-logic flaws
- 05
Report with PoCs, fixes and a free retest
Selected engagements
From my work at BERRY9 IT Services, as a freelancer, at CRIS InfoTech and Hacktr Technologies, and my own tools and research.
BERRY9 IT Services — manual Burp-driven web testing: broken access control, business-logic flaws, insecure deserialization and auth bypass
CRIS InfoTech — end-to-end web engagements from scoping and rules of engagement to retest and sign-off
Top bugs I hunt — and the steps
The recurring weaknesses I see in this domain, with the repeatable workflow I run from discovery to fix.
- STEP 1Map every role and object ID with two test accounts
- STEP 2Replay requests across accounts and tenants
- STEP 3Measure what data or actions leak
- STEP 4Fix: server-side ownership checks on every request