Results for “pe”

Performs a static-analysis penetration test to find exploitable vulnerabilities, providing proof-of-concept payloads and fixes. Covers injection, XSS, authentication bypass, authorization flaws, path traversal, command injection, CSRF, SSRF, hardcoded secrets, and insecure deserialization, with a full attack surface.

Conduct authorized physical penetration testing using tailgating, badge cloning, lock bypassing, and rogue device deployment to evaluate facility security controls.

Perform authorized penetration testing against AWS, Azure, and GCP cloud environments using cloud-specific tools and methodologies, with findings mapped to the MITRE ATT&CK Cloud matrix.

Discover and exploit XML External Entity injection vulnerabilities to read server files, perform SSRF, and exfiltrate data during authorized penetration tests.

Design and execute a social engineering penetration test including phishing, vishing, smishing, and physical pretexting campaigns to measure human security resilience and identify training gaps.

Performs privilege escalation assessments on compromised Linux and Windows systems to identify paths from low-privilege access to root or SYSTEM-level control.

Assess the security of WiFi infrastructure through authorized penetration testing, including weak encryption detection, handshake capture, evil twin attacks, and network segmentation validation.

Provides a comprehensive penetration testing toolchain with 20+ security tools (Nmap, Nuclei, SQLMap, FFUF, Hashcat, etc.) exposed via MCP servers for authorized vulnerability scanning, exploitation, and reporting.

Crack password hashes using Hashcat for authorized penetration testing and password policy assessment, supporting dictionary, brute-force, rule-based, and hybrid attacks.

Generate a NullPointer Studio styled PDF penetration test report from findings.json, producing a professional dark-themed PDF with executive summary, risk dashboard, per-finding cards, and remediation summary.

Systematically evaluates Kubernetes cluster security by simulating attacker techniques against the API server, kubelet, etcd, pods, RBAC, network policies, and secrets using tools like kube-hunter, Kubescape, and kube-bench.

Performs runtime dynamic analysis of Android applications using Frida, Objection, and ADB to observe behavior, intercept function calls, modify runtime values, and identify vulnerabilities missed by static analysis.

Systematically tests web applications for vulnerabilities following the OWASP Web Security Testing Guide (WSTG) methodology, covering authentication, authorization, input validation, session management, and business logic using Burp Suite and manual techniques.

Captures WPA/WPA2 handshakes and performs offline password cracking using aircrack-ng, hashcat, and dictionary attacks during authorized wireless security assessments to evaluate passphrase strength and wireless network security posture.

Simulates ARP spoofing attacks in authorized lab or pentest environments using arpspoof, Ettercap, and Scapy to demonstrate man-in-the-middle risks, test network detection capabilities, and validate ARP inspection countermeasures.

Trigger machine account authentication with PetitPotam (MS-EFSR) and Coercer across MS-RPRN, MS-DFSNM, and MS-FSRVP to feed NTLM relay into AD CS Web Enrollment (ESC8) and other relay targets.

Test JWT signature verification bypass by crafting tokens with the 'none' algorithm.

Detect and exploit SQL injection vulnerabilities using sqlmap to extract database contents during authorized penetration tests.

Performs comprehensive security assessments of IoT devices and their ecosystems by testing hardware interfaces, firmware, network communications, cloud APIs, and companion mobile applications.

Perform coverage-guided fuzzing of compiled binaries using AFL++ to discover memory corruption, crashes, and security vulnerabilities.

Extracts GraphQL API schemas through introspection attacks, identifies sensitive fields and mutations, and tests for query depth and complexity vulnerabilities.

Identify and exploit Insecure Direct Object Reference vulnerabilities during authorized penetration tests by manipulating object identifiers in API requests and URLs.

Test GraphQL APIs for depth limit vulnerabilities by sending deeply nested recursive queries to identify denial-of-service risks.

Assess GraphQL API endpoints for introspection leaks, injection attacks, authorization flaws, and denial-of-service vulnerabilities during authorized security tests.

Identifies and unpacks UPX-packed and other packed malware samples to expose the original executable code for static analysis.

Enumerate Active Directory domain objects, discover attack paths with BloodHound, exploit Kerberos weaknesses, escalate privileges via ADCS/DCSync, and demonstrate domain compromise.

Identify and test IAM misconfigurations that allow privilege escalation in AWS environments using Pacu, CloudFox, Principal Mapper, and manual analysis.

Conducts comprehensive network penetration tests against authorized target environments using host discovery, port scanning, service enumeration, vulnerability identification, and controlled exploitation following PTES methodology.

Routes security, compliance, and threat-intelligence tasks to specialized sub-skills for threat modeling, penetration testing, incident response, and vulnerability scanning.

Simulates SSL stripping attacks using sslstrip, Bettercap, and mitmproxy in authorized environments to test HSTS enforcement, certificate validation, and HTTPS upgrade mechanisms.