u z a i r

Web Application Penetration Tester & Security Analyst

LinkedIn • Freelance

Aug 2023 - Present • 3 yrs 2 mos

Freelance Web Application Penetration Tester & Security Analyst | Self-Employed Delivered 150+ security assessments for web applications across e-commerce, SaaS, fintech, and healthcare industries. Specialized in identifying critical vulnerabilities and providing actionable remediation guidance aligned with OWASP Top 10 and SANS CWE Top 25. Key Responsibilities: • Conducted black-box, grey-box, and white-box penetration tests on web apps, APIs, and authentication mechanisms. • Performed manual and automated assessments using Burp Suite Pro, OWASP ZAP, Nmap, SQLmap, Nuclei, and custom Python scripts. • Identified and exploited SQL Injection, XSS, CSRF, IDOR, SSRF, XXE, auth bypass, privilege escalation, and business logic flaws. • Assessed RESTful and GraphQL API security including BOLA, excessive data exposure, and rate-limiting weaknesses. • Reviewed session management, JWT implementation, and MFA configurations for security gaps. • Delivered detailed reports with PoC screenshots, CVSS scoring, and prioritized remediation steps. • Retested fixes and collaborated with dev teams to validate patches. Key Achievements: • Completed 150+ assessments with 100% client satisfaction and repeat business. • Discovered critical flaws that could have led to full database compromise and account takeover. • Maintained 5-star rating through on-time, high-quality delivery and post-assessment support. Tools & Frameworks: Burp Suite Pro, OWASP ZAP, Nmap, SQLmap, Nikto, Metasploit, Postman, Nuclei, Kali Linux, Docker, OWASP Top 10, OWASP ASVS, OWASP API Top 10, SANS CWE Top 25, PTES, NIST SP 800-115 Core Skills: Web App Penetration Testing • API Security Testing • Vulnerability Assessment • Manual Exploitation • Security Report Writing • Risk Assessment • Remediation Guidance • Client Communication