Offensive Security & Penetration Testing

Independent security research and application penetration testing. Find your vulnerabilities before someone else does — with clear, actionable reports.

Request a Pentest View Pricing
2.5+
Years in AppSec
OWASP
Top 10 Tested
CVE
Research Active
NDA
Fully Confidential
// what I test

Security Assessment Services

Comprehensive vulnerability assessment and penetration testing across your entire attack surface.

WEB_APP

Web Application Pentest

Deep-dive testing against OWASP Top 10, business logic flaws, authentication bypasses, injection vulnerabilities, and more. Full Burp Suite-assisted manual testing.

MOBILE

Mobile Security Testing

Android & iOS application security assessment including reverse engineering, runtime manipulation via Frida, insecure data storage, and API endpoint analysis.

API

API Security Assessment

REST and GraphQL API testing covering broken authentication, excessive data exposure, rate limiting, mass assignment, and BOLA/IDOR vulnerabilities.

CLOUD

Cloud Configuration Review

AWS security posture review covering IAM misconfigurations, exposed S3 buckets, EC2 attack surface, and security group analysis using ScoutSuite.

THREAT

Threat Modeling

STRIDE-based threat modeling workshops for your architecture. Identify and prioritize risks before they're built into production.

REPORT

Vulnerability Assessment Report

Standalone VA report with CVSS scoring, risk classification, evidence screenshots, and developer-friendly remediation guidance. No pentest required.

// how it works

Assessment Process

A structured, transparent engagement from first contact to final report — no surprises.

Scoping Call

We define the target scope, objectives, rules of engagement, and timeline. You sign an authorization letter — this is always step one.

Reconnaissance

Passive and active information gathering. Understanding your application's architecture, endpoints, and technology stack before any active testing begins.

Active Testing

Manual and tool-assisted vulnerability discovery. Every finding is verified — no raw scanner dumps. We exploit to confirm impact, not just flag.

Reporting

Executive summary + technical report with CVSS scores, PoC evidence, and step-by-step remediation guidance. Delivered as a signed PDF.

Remediation Support

Free consultation call post-report. We answer developer questions and clarify findings until your team understands what to fix and why.

Re-test (Optional)

Verify that fixes are effective. Included in Medium and High complexity engagements at no extra cost within 30 days of report delivery.

// scope & investment

Complexity & Pricing

Pricing is based on application complexity. Not sure which tier you're in? Describe your app in the contact form and I'll scope it for free.

Low

Low Complexity

← Add your low complexity definition here
Medium

Medium Complexity

← Add your medium complexity definition here
High

High Complexity

← Add your high complexity definition here
// low_complexity
₹20,000 starting
⏱ Approx. 10 business days
  • Full OWASP Top 10 coverage
  • Manual + automated testing
  • Executive + technical report
  • CVSS-scored findings
  • Remediation guidance
  • 1× post-report consultation call
Most Popular
// medium_complexity
₹40,000 starting
⏱ Approx. 20 business days
  • Everything in Low
  • Business logic abuse testing
  • Auth & session deep-dive
  • API endpoint enumeration
  • PoC exploit code provided
  • Free re-test within 30 days
// high_complexity
₹60,000 starting
⏱ Approx. 30 business days
  • Everything in Medium
  • Microservices / multi-app scope
  • Cloud config review (AWS/GCP)
  • Threat modeling session
  • Chain-attack scenario testing
  • Priority support & re-test

All prices are starting rates. Custom scopes are quoted after a free discovery call. Prices are exclusive of GST.

// get in touch

Request an Assessment

Let's talk about your security.

Fill in the form and I'll get back to you within 24 hours with a scoping questionnaire and a free pre-assessment call to understand your risk landscape.

All engagements are covered by a mutual NDA. No findings are shared with third parties, ever.

Email 0x5uryax1@gmail.com
LinkedIn Surya-Mathur
Based India (remote engagements accepted globally)
Response Within 24 hours
✓ Message received — I'll reply within 24 hours with next steps.

This form doesn't share your data anywhere. I'll respond personally via email.

Penetration Test Report — Sample

CONFIDENTIAL
Client
Acme Corp Pvt. Ltd.
Assessment Type
Web Application Pentest
Report Date
June 2025
Tester
Surya — NexaSec Research Labs
Scope
https://app.acmecorp.com
Risk Rating
Critical
// 01 — Executive Summary

A black-box penetration test was conducted against the client's primary web application over a period of 10 business days. The assessment identified 7 vulnerabilities across critical and high severity bands, including an unauthenticated SQL injection on the login endpoint and a stored XSS in the user profile module. Immediate remediation is strongly advised before the next production release.

// 02 — Findings Summary
Critical

SQL Injection — Login Endpoint

CVSS Score9.8 (Critical)
EndpointPOST /api/v1/auth/login
Parameterusername
CWECWE-89 — Improper Neutralization of SQL Commands
The username parameter is directly concatenated into an SQL query without sanitization. An attacker can dump the entire database, bypass authentication, or escalate to OS-level commands via xp_cmdshell. Confirmed exploitation via SQLMap and manual PoC.
High

Stored XSS — User Profile Bio Field

CVSS Score8.2 (High)
EndpointPUT /api/v1/user/profile
Parameterbio
CWECWE-79 — Cross-Site Scripting
Malicious script injected into the bio field is stored server-side and rendered unsanitized in other users' browsers. Exploitable for session hijacking, credential phishing, and account takeover at scale.
Medium

IDOR — Access Other Users' Orders

CVSS Score6.5 (Medium)
EndpointGET /api/v1/orders/{id}
CWECWE-639 — Authorization Bypass via User-Controlled Key
Order IDs are sequential integers with no ownership check server-side. Any authenticated user can enumerate and view other customers' order details including PII and delivery addresses.
Low

Missing Security Headers

CVSS Score3.1 (Low)
AffectedAll responses
CWECWE-693 — Protection Mechanism Failure
The application does not return Content-Security-Policy, X-Frame-Options, or Strict-Transport-Security headers, increasing exposure to clickjacking and protocol downgrade attacks.
// 03 — Remediation Summary

All critical and high findings require immediate patching before the next release. Use parameterized queries or prepared statements to address SQL injection. Implement output encoding and a strict Content Security Policy for XSS. Enforce server-side authorization checks tied to session identity for all object-level access. A re-test will be conducted within 30 days of fixes being deployed.

SAMPLE REPORT — NexaSec Research Labs · surya.sec · FOR DEMONSTRATION PURPOSES ONLY