OWASP Certified Pentesting, Manual Approach

@geologistt

Hello, We can deliver a manual penetration test for your multi-tenant SaaS platform, in a report format suited to ST4S assessors. Who will do the testing: Eill be disclosed in DM, a certified penetration tester. Certification: CEH, will be shared via DM Experience: 4+ years in web application testing Our approach (manual, not scanner-based): Scope review and rules of engagement, following the OWASP Web Security Testing Guide. Manual testing of all OWASP Top 10 areas, including broken access control, injection, XSS, CSRF, SSRF, and authentication failures. Focus on your key risks: tenant data isolation (including PostgreSQL row-level security), role-based access, JWT manipulation, file upload abuse, and API and serverless function security. Testing on staging as an authenticated user, with each test backed by screenshots and logs. Report: Tester credentials, executive summary, scope and methodology, evidence for each test, findings rated Critical to Informational with fixes, and an overall summary. We will include a free re-test of fixed issues Sample report: Will be shared via DM Price and Timeline: Will provide detailed financial proposal with milestone breakdown and timeline via DM We are happy to sign an NDA before receiving any application details. Kind regards,

@engkarimismail

As an ethical hacker with a strong background in network security, I am confident in my ability to conduct the comprehensive manual pen test you require. I have extensive experience in application security and am versed in the methodologies outlined by OWASP, which are critical to meet your Safer Technologies 4 Schools (ST4S) standards. At Nanoq LLC, our emphasis on secure architecture mirrors your priority for safeguarding students and teachers. We specialize not only in pen testing but also in secure development practices. This means I will not only identify vulnerabilities but propose practical remediation strategies to mitigate them. Lastly, our report offering is second-to-none. It comprises a thorough executive summary, an explicit scope and methodology following industry-recognized standards (e.g., OWASP Web Application Security Testing Guide), detailed vulnerability findings with risk ratings and recommended remediations. Confidentiality is integral to our work; sensitive information will be properly redacted. In short, hiring me for this project guarantees a meticulous and high-quality web application pen test that meets your ST4S requirements. So let me strengthen your system's defenses against the OWASP Top 10 and beyond - giving you confidence in your infrastructure's security moving forward.

@kajal1992

Hello, I can conduct a genuine manual web application penetration test for your multi-tenant SaaS platform, aligned with the OWASP Web Security Testing Guide and OWASP Top 10, rather than relying solely on automated scanners. I hold EC-Council Certified Ethical Hacker (CEH) certification and have extensive hands-on experience in Web/API VAPT, authentication/authorization testing, multi-tenant isolation, JWT security, SQL Injection, XSS, CSRF, file-upload testing and cloud-hosted applications Proposed Approach * Manual OWASP Top 10 assessment * Multi-tenant isolation and IDOR/BOLA testing * RBAC and privilege-escalation testing * Authentication/session/JWT security * API and serverless function testing * SQL Injection, XSS, CSRF and SSRF * File-upload security * Security misconfiguration and exposed components * Business-logic and insecure-design testing * Evidence-based validation with screenshots/request-response logs * Risk rating and practical remediation recommendations Deliverable A detailed professional penetration-testing report suitable for ST4S review, including methodology, scope, tester credentials, test cases performed, evidence, risk ratings, remediation recommendations and executive summary. I can provide a redacted sample penetration-test report demonstrating the depth and reporting style before commencement. Regards Kajal Majhi

@AITSoft

Hi, I understand you need a manual penetration test covering the OWASP Top 10, with testing based on real validation rather than relying only on automated scans. I will review the application carefully, confirm exploitable findings, explain the business impact, and provide clear steps to fix each issue. The report can include evidence, severity ratings, affected areas, reproduction details, and practical remediation advice. I can also share a redacted sample report before starting, so you can check the quality and level of detail. My approach will keep testing controlled and avoid unnecessary impact on your live systems. Which application environment, test scope, and recognised certification standard should I use for the engagement? I can provide recognised certification details and align the testing scope with your required rules and reporting format. Regards

@shammij2

Hi I see you need a manual pen test focusing on the OWASP Top 10 without relying only on automated tools. This project calls for a deep understanding of web vulnerabilities where tools like Burp Suite are paired with manual verification to ensure thorough testing. I am OWASP certified and have substantial experience in conducting these types of assessments. For instance, I recently completed a detailed manual pen test for a financial service client using a similar approach, successfully identifying and mitigating high-risk vulnerabilities. I appreciate your requirement for a sample report, and I'm happy to provide one from a non-confidential project similar to yours. Manual testing is indeed the way to go for comprehensive security, and that's exactly where I excel. Let's delve into your specific needs and see how I can help secure your systems. Thanks, Hercules

@joshuagoossen

Hi, I’m interested in conducting the manual penetration test for your multi-tenant SaaS platform. I’m a CISSP-certified cybersecurity professional with ~20 years of experience across financial services, pharmaceutical/medical device, cloud, and enterprise environments. I also hold CRTP and CARTP offensive-security certifications and can provide verification details. My testing would follow the OWASP Web Security Testing Guide and OWASP Top 10, with an emphasis on manual testing rather than automated scanning. For your platform, I would specifically test cross-tenant isolation, horizontal/vertical privilege escalation, RBAC, authentication/session controls, JWT manipulation, API/serverless endpoints, IDOR/BOLA, SQL injection, XSS, CSRF, SSRF, file uploads, and business-logic vulnerabilities. The final report would include scope/methodology, tests performed, evidence/screenshots, severity-rated findings, remediation guidance, executive summary, and overall results suitable for ST4S review. I can provide a redacted sample report. I operate through a registered U.S. cybersecurity business. Before bidding, please confirm whether CRTP/CARTP qualify under your “or equivalent” certification provision. Estimated timeframe: 4–6 working days, depending on application size and number of roles/endpoints. Joshua Goossen CISSP | CRTP | CARTP DeviantSec