Browse categories
English
$
USD
Connect to your AI
I will do manual rest and graphql API security testing with report
OSCP Certified Penetration Tester and VAPT Expert
I'm an OSCP and CEH (Practical) certified penetration tester and ISO 27001 Lead Auditor with nearly 5 years of hands-on experience securing banking, government and SaaS applications. I perform manual ...
About this Gig
Manual API penetration testing by an OSCP-certified tester, not an automated scan with a report attached.
I'm an OSCP and CEH (Practical) certified penetration tester and ISO 27001 Lead Auditor with nearly 5 years of experience testing banking, government and SaaS applications.
WHAT I TEST
- REST and GraphQL APIs against the OWASP API Security Top 10
- - Broken object level authorization (BOLA/IDOR) and broken authentication
- - JWT and OAuth 2.0 flaws, mass assignment, rate limiting
- - Injection and business logic issues that scanners miss
WHAT YOU GET
- A clear PDF report with an executive summary
- - Every finding with CVSS severity, proof of concept and step-by-step fixes
- - A free retest after you fix the issues (Premium package)
- - NDA on request
TOOLS: Burp Suite Pro, Postman
Message me with your API docs or scope before ordering, and I'll confirm the right package, timeline and price.
Testing platform:
Website testing
Device:
PC
•
Mac
•
Linux
My Portfolio
FAQ
Is this a manual test or an automated scan?
Manual. I use Burp Suite Pro and Postman to support the work, but every finding is verified by hand and false positives are removed. You get a CVSS-rated PDF report with proof of concept and fix steps.
What do you need from me to start?
API documentation (OpenAPI/Swagger or a Postman collection), test accounts for each role, and confirmation that you own the API or have written permission to test it. Message me before ordering to confirm scope.
Do you retest after I fix the issues?
Yes. The Premium package includes a free retest after you fix the issues, so you know they are really closed. For Basic and Standard, message me and I will quote a retest.
Will you sign an NDA and keep my data private?
Yes, NDA on request. Your findings and data stay confidential. I only test systems you own or have written permission to test, and I avoid destructive tests and denial of service.
