Advantage Offensive Security

Web application penetration testing

Manual testing of web apps and APIs for the flaws automated scanners miss: broken access control, authentication weaknesses and business-logic abuse.

Every finding comes with the exact request that proves it, the impact in plain language, and a fix your developers can act on.

Email contact@advantageoffsec.com
Broken object-level authorization High

Request, signed in as customer A

GET /api/v2/invoices/10418 HTTP/2
Host: app.example.com
Authorization: Bearer eyJhbGciOi…(customer A)

Response

HTTP/2 200 OK
Content-Type: application/json

{
  "invoice_id": 10418,
  "customer": "customer B",
  "total": 4820.00
}

The API confirms the token is valid but never checks that invoice 10418 belongs to its owner. Changing one number exposes every customer's invoices.

Illustrative example. Not from a real engagement.

What I test

Web applications and APIs

Hands-on testing guided by the OWASP Web Security Testing Guide and the OWASP API Security Top 10. Automated tools help with coverage, but the work is manual.

  • Access control and authorization, including IDOR and privilege escalation
  • Authentication, session handling and password reset flows
  • Business-logic flaws in checkout, approval and multi-step workflows
  • Injection, including SQL, command and template injection
  • Server-side request forgery and file handling
  • Cross-site scripting and client-side issues

Hardware and embedded devices

A limited number of device assessments by arrangement: UART and debug interfaces, firmware extraction and review, and board-level analysis.

How I work

  • Authorized scope only

    I test only the targets in a written, signed scope, and only during the agreed testing windows.

  • Manual first

    Scanners help with coverage, but the findings that matter come from understanding how the application is supposed to work and testing where it doesn't.

  • Reproducible findings

    Each finding includes the exact requests, evidence, impact and remediation guidance, so developers can confirm it and fix it.

  • No disruption

    Denial-of-service testing is not performed, and critical findings are escalated as soon as they're confirmed.

About

Founder, OSCP+

I hold the OSCP+ certification and perform web application penetration tests as a subcontractor to an established security firm.

Before security, I spent twelve years as a dealership technician and shop foreman. Diagnosing faults in complex systems and proving the root cause before replacing anything turns out to be good training for finding vulnerabilities. On my own time I do automotive and embedded security research on hardware I own.

  • OSCP+ (OffSec Certified Professional Plus)
  • Web application and API penetration testing
  • Hardware: UART, CAN bus, embedded devices

Contact

Engagements and general questions
contact@advantageoffsec.com
Reporting a vulnerability in this site
security@advantageoffsec.com