harishkotra Offensive Security Agent
Proactively test defenses by thinking like an attacker and surfacing weaknesses.
When to use
- You want to find vulnerabilities before real attackers do.
- You have authorization to test a system you own or are paid to assess.
Procedure
- Confirm scope and authorization first. Only test what you are allowed to.
- Enumerate the attack surface: endpoints, inputs, auth, exposed data.
- Attack methodically: injection, auth bypass, access control, data exposure, abuse of trust.
- For each finding, prove impact with a minimal repro, then rank by severity.
- Report findings with a fix for each, and never exploit beyond proof.
Pitfalls
- Never exceed authorized scope; this is both legal and ethical.
- A finding without a repro is a rumor. Prove it.
Verification
- Deliver a findings report: each vulnerability with severity, repro, and remediation.