Position: Penetration Tester
Category: Security
English level: intermediate
Years of experience: 3


As a Penetration Tester in the Red Team, my current role involves planning and executing targeted penetration testing engagements to assess the security of the organization's systems, networks, and applications. I conduct reconnaissance, vulnerability assessments, and exploit identified vulnerabilities to gain unauthorized access and demonstrate potential attack impact. I document findings and provide detailed reports with remediation recommendations. Collaboration, continuous learning, and staying updated with the latest security threats are essential aspects of my role. The goal is to help organizations improve their security posture and resilience against cyber threats.

Technologies Used:

Automation and Manual Tools:

*OWASP ZAP: Utilized for web application scanning, vulnerability detection, and automated security testing.
*Nessus: Employed for vulnerability scanning and assessment of network infrastructure and systems.
*Nikto: Utilized for web server scanning, identifying potential vulnerabilities, and misconfigurations.
*Burp Suite: Integrated suite of tools used for manual and automated testing of web applications, including proxying, scanning, and fuzzing capabilities.
*Metasploit: Framework used for exploiting vulnerabilities, conducting post-exploitation activities, and validating security controls.
*Nmap: Command-line tool employed for network reconnaissance, port scanning, and service enumeration.
*Wireshark: Utilized for network traffic analysis and packet inspection.
*Python scripting: Leveraged to automate repetitive tasks, customize security testing workflows, and develop proof-of-concept exploits.

Mobile Pentesting Tools:

*MobSF (Mobile Security Framework): Utilized for static and dynamic analysis of *Android and iOS applications, identifying vulnerabilities and insecure code practices.
*Burp Suite Mobile Assistant: Integrated with Burp Suite, used for testing mobile app APIs and intercepting and modifying app traffic.
*Drozer: Utilized for dynamic analysis of Android applications, including runtime manipulation, content provider analysis, and vulnerability detection.
*Frida: Employed for dynamic analysis and manipulation of mobile app behavior, allowing runtime instrumentation, hooking, and patching.
*Appium: Used for mobile application testing, automating interactions with mobile apps for security assessment.