Results for “authorization-testing”

Conducts security testing of REST, GraphQL, and gRPC APIs to identify vulnerabilities in authentication, authorization, rate limiting, input validation, and business logic using the OWASP API Security Top 10 framework.

Authorized security assessment of REST, GraphQL, WebSocket, and SOAP APIs covering discovery, authentication, authorization, rate-limiting, and CI/CD integration.

Perform authorized penetration testing against AWS, Azure, and GCP cloud environments using cloud-specific tools and methodologies, with findings mapped to the MITRE ATT&CK Cloud matrix.

Systematically test web applications for broken access control vulnerabilities including privilege escalation, missing function-level checks, and insecure direct object references.

Detect and test for OWASP API3:2023 Broken Object Property Level Authorization vulnerabilities including excessive data exposure and mass assignment attacks.

Guides authorized Wi-Fi security assessments including handshake capture, PMKID collection, rogue AP detection, and offline password policy evaluation using aircrack-ng, hashcat, and Wireshark.

Test WebSocket implementations for authentication bypass, cross-site hijacking, injection attacks, and insecure message handling during authorized security assessments.

Guides authorized Active Directory security research covering Kerberos attacks, AD CS vulnerabilities, BloodHound path analysis, NTLM relay, and domain privilege escalation techniques.

Conduct authorized AWS penetration testing using Pacu to enumerate IAM configurations, discover privilege escalation paths, test credential harvesting, and validate security controls through systematic attack simulation.

Assess GraphQL API endpoints for introspection leaks, injection attacks, authorization flaws, and denial-of-service vulnerabilities during authorized security tests.

Execute OAuth 2.0 device-code and illicit-consent phishing attacks against Microsoft Entra ID to steal access and refresh tokens, bypass MFA, and pivot across Microsoft 365 services during authorized red-team engagements.

Systematically tests web applications for vulnerabilities following the OWASP Web Security Testing Guide (WSTG) methodology, covering authentication, authorization, input validation, session management, and business logic using Burp Suite and manual techniques.

Discover hidden directories, files, APIs, and administrative interfaces by enumerating URLs and testing authentication enforcement during authorized security assessments.

Conduct authorized security assessments of LLM applications and AI agents, covering prompt injection, tool abuse, RAG exposure, memory poisoning, and model supply-chain risks.

Tests OAuth 2.0 and OpenID Connect implementations for security flaws including authorization code interception, redirect URI manipulation, CSRF in OAuth flows, token leakage, scope escalation, and PKCE bypass.

Executes authorized attack simulations against Active Directory environments to identify misconfigurations, weak credentials, dangerous privilege paths, and exploitable trust relationships that could lead to domain compromise.

Authorized OT/ICS security assessment covering Purdue model zoning, PLC/SCADA exposure, industrial protocol discovery, and safe passive-first evaluation.

Authorized security testing framework for desktop thick clients covering local storage, IPC, update channels, traffic interception, and client-side trust boundaries.

Performs authorized database security assessments across PostgreSQL, MySQL, MSSQL, MongoDB, and Redis, checking exposure, authentication, authorization, dangerous configurations, and exploit paths.

Performs a static-analysis penetration test to find exploitable vulnerabilities, providing proof-of-concept payloads and fixes. Covers injection, XSS, authentication bypass, authorization flaws, path traversal, command injection, CSRF, SSRF, hardcoded secrets, and insecure deserialization, with a full attack surface.

Routes API security testing into recon, authorization, token abuse, or hidden-parameter workflows based on observed endpoint characteristics.

Identify and exploit Insecure Direct Object Reference vulnerabilities during authorized penetration tests by manipulating object identifiers in API requests and URLs.

Tests APIs for excessive data exposure where endpoints return more data than the client application needs, relying on the frontend to filter sensitive fields. Maps to OWASP API3:2023 Broken Object Property Level Authorization.