100+ production websites taught me how the web is put together, and exactly where it comes apart.
Passive and active reconnaissance, OSINT and enumeration: mapping the attack surface before touching a single port.
Vulnerability assessment and web application security, applied with a developer's instinct for what actually ships.
Nmap, Metasploit, Wireshark, Shodan, Maltego and Nessus/OpenVAS, used hands-on rather than just listed.
The difference lives in the last quarter-inch: a header, a config, the one forgotten endpoint.
Passive recon and OSINT first: what's already public about a target, from domains and tech stack to people and exposed services. The quietest phase is often the most revealing.
$ shodan host lab.target ports 22, 80, 443, 3306 server nginx · php [!] database port reachable from the internet
Network scanning to map live hosts, open ports and running services, so nothing in scope is left unknown.
$ nmap -sV 10.0.0.0/24 22/tcp open ssh OpenSSH 80/tcp open http nginx 8080/tcp open http admin panel ← why is this exposed?
Service enumeration and vulnerability scanning, plus the part most testers skip: reading client-side code, configs and headers with 8+ years of builder's instinct.
[!] outdated component in bundle [!] missing security headers [!] stack traces on error pages
Validate findings inside scope, with evidence and without collateral damage, and watch the traffic while doing it.
msf6 > check [+] target appears vulnerable [*] proof captured · no damage done
Clear findings, real impact and fixes developers can actually ship. I've been the developer on the receiving end of a report, so I write the one I'd want to get.
$ cat report.md | head -3 critical 2 fixes included medium 5 fixes included status ready for the dev team
This is a working shell. Type help to start, or go looking for the flag hidden somewhere on this site.