Browse categories
Explore
Fiverr Pro
English
$
USD
I will do web app and API penetration testing with a vapt report
PNPT Penetration Tester, Web, API and Active Directory Security
I am Khubab, a PNPT-certified penetration tester and VAPT Engineer. I help businesses find and fix security weaknesses before attackers exploit them.
What I offer:
- Web application and API penetrati...
About this Gig
Worried your web application or API has security gaps attackers could exploit? I test it the way a real attacker would and deliver a clear, actionable report.
I am a practicing VAPT Engineer and cybersecurity instructor, certified in PNPT and PJPT.
WHAT I TEST:
- OWASP Top 10: injection, broken access control, XSS, SSRF
- Authentication, sessions, and IDOR flaws
- REST and GraphQL API security
- Business logic flaws that scanners miss
- Misconfigurations and exposed data
WHAT YOU RECEIVE:
- Manually validated findings, no scanner noise
- Proof of concept and CVSS score for each issue
- Step-by-step remediation for your developers
- Executive summary and free retest (Premium)
HOW IT WORKS:
- We confirm scope and written authorization
- I map the app and test it manually (OWASP WSTG)
- You get the report, then a retest to confirm fixes
See the sample report in the gallery to check the quality before you order.
Testing is non-destructive and performed only on assets you own or are authorized to test. Message me first so we can confirm scope and timeline.
Testing application:
Web application
Development technology:
JavaScript
•
Node.js
•
PHP
•
Python
•
React
Device:
PC
•
Linux
FAQ
What do you need to get started?
Target URL(s), written authorization to test, an in-scope and out-of-scope list, test account credentials, and your preferred testing window.
Will testing break my website?
Testing is non-destructive by default. A staging environment is preferred, and any higher-risk test is run only with your approval.
What does the report include?
Each finding with CVSS severity, proof of concept, affected endpoints, and step-by-step remediation. Premium adds an executive summary for management.
Do you offer a retest?
Premium includes a free retest after you apply fixes. For Basic and Standard, a retest can be added as an extra.
Do you sign an NDA and keep my data confidential?
Yes. I sign NDAs on request. All findings and client data stay confidential and are deleted after delivery. I only test with written authorization.
Which tools and methodology do you use?
I follow the OWASP Web Security Testing Guide and OWASP Top 10. Tools include Burp Suite, ffuf, Nuclei, and sqlmap, but every finding is confirmed manually before it goes in the report.
Can the report help with SOC 2, ISO 27001, or client security reviews?
Yes. The report can serve as evidence of an independent penetration test for audits and vendor security questionnaires. It is a technical test, not a formal compliance audit or certification.
