Web Application Penetration Test

A client needed a pre-release security assessment of a customer-facing web application handling sensitive data.

Conducted a manual penetration test complemented by automated scanning, covering OWASP Top 10, authentication, authorization, and API endpoints.

Reconnaissance (Nmap, Amass) → Automated Scan (OWASP ZAP, Nikto) → Manual Exploitation (Burp Suite) → Privilege Escalation → Reporting & Debrief.

Identified exploitable vulnerabilities with reproducible steps and severity ratings, enabling the team to fix issues before launch.