Web & API Pentesting
Manual testing of web apps and REST / GraphQL APIs: authentication and session handling, authorization (IDOR / BOLA), business-logic abuse, injection, SSRF and multi-step attack chains.
Athan Sec · Independent research
Independent Offensive Security Research & Vulnerability Discovery
Manual, adversarial testing of web applications, APIs, cloud environments and smart contracts — looking for the flaws that automated scanners miss.
Every engagement ends with reproducible evidence, clear impact and concrete remediation, and every finding is handled through coordinated disclosure.
Services
Focused, scoped engagements. Testing starts only after written authorization and an agreed scope.
Smart Contract & Web3 Auditing
Review of Solidity / EVM contracts and the off-chain components around them: access control, accounting and rounding, reentrancy, oracle and price manipulation, upgradeability and economic attack paths.
Cloud & Infrastructure Security
Configuration and attack-path review of cloud accounts and exposed infrastructure: IAM privilege escalation, storage and secret exposure, network surface, CI/CD and supply-chain trust boundaries.
Vulnerability Research & CVD
Independent research on software and services, reported privately to the vendor under coordinated vulnerability disclosure, with CVE coordination and public write-ups only once a fix is available.
How an engagement works
-
Scope & authorization
Assets, rules of engagement, test windows and contacts are agreed in writing before any traffic is sent.
-
Reconnaissance & testing
Manual, hypothesis-driven testing supported by custom tooling; destructive or high-load actions only with explicit approval.
-
Reporting
Each finding includes severity rationale, reproduction steps, proof of concept and remediation guidance.
-
Retest & closure
Fixes are verified and the report is updated. Data collected during testing is deleted at closure.
Disclosures & recognition
Publicly verifiable work only: published reports, Hall of Fame entries and CVEs.
Findings are disclosed only with the program’s or vendor’s approval. Public reports and CVEs will be listed here as they are published.
Clients
Platform profiles
Coordinated disclosure policy
- All testing is performed under explicit written authorization or within the published scope of Bug Bounty / VDP programs.
- Vulnerabilities are reported privately to the affected party first. No details are shared publicly before a fix is available or the agreed deadline expires.
- Default coordination window: 90 days from first report, adjustable by mutual agreement when a fix is in progress.
- Only the minimum data needed to demonstrate impact is accessed; no data is retained, modified or exfiltrated beyond that.
- If you found a vulnerability in Athan Sec’s own assets, please report it to the address below — see security.txt.
Contact
For engagements, research coordination or to report a vulnerability. Please use PGP for sensitive details.
- PGP key
- Public PGP key will be published here shortly.
- RFC 9116
- /.well-known/security.txt
- Lang
- Languages: English, Español