Web Recon & Attack Surface Mapping
20%
Content discovery, auth flow mapping, API and role-model understanding.
Input Validation & Injection
25%
SQLi, command/template injection, deserialization and related data-flow flaws.
Authentication, Session & Access Control
25%
Broken auth, session handling, IDOR/BOLA, privilege boundary failures.
Business Logic & Modern Web Risks
15%
Race conditions, abuse paths, workflow manipulation, OAuth/JWT pitfalls.
Reporting & Patch Verification
15%
Clear PoC chains, risk contextualization, mitigation and validation guidance.