The network for creativity
Join 1.25M professional creatives like you
Connect with clients, get discovered, and run your business 100% commission-free
Creatives on Contra have earned over $150M and we are just getting started
Back to feedPost
Comprehensive web application penetration test, API endpoint analysis, and vulnerability assessment for a production-facing infrastructure ecosystem.
The Objective:
An enterprise client required a full-scope security assessment to evaluate their external attack surface, verify strict alignment with the OWASP Application Security Verification Standard (ASVS Level 3), and uncover critical server-side and business logic flaws before deploying a major code release.
The Approach:
I executed a hybrid security assessment combining automated reconnaissance with deep manual exploitation across the application layer and its integrated APIs. Every vulnerability was manually validated using Burp Suite Professional, SQLmap, and Postman to eliminate false positives and scored using standard CVSS 3.1 metrics.
From a single comprehensive audit, I uncovered 24 reproducible findings:
2 High Severity: Broken Object Level Authorization (BOLA/IDOR) on critical billing endpoints and a SQL injection flaw in the primary authentication pathway.
5 Medium Severity: Faulty session management allowing session fixation, missing Rate Limiting on public API routes, and Cross-Site Scripting (XSS) via un-sanitized comment inputs.
7 Low Severity: Lax CORS configuration rules, missing secure flag attributes on cookies, and verbose server error disclosures.
10 Informational: Exposure of outdated software banners and missing HTTP security headers (such as Content-Security-Policy).
The network for creativity
Join 1.25M professional creatives like you
Connect with clients, get discovered, and run your business 100% commission-free
Creatives on Contra have earned over $150M and we are just getting started
Related posts
This project focused on building and testing a practical AI security assessment lab for evaluating LLM defenses against prompt injection and jailbreak attacks.
I integrated Spikee by Reversec with a locally hosted cybersecurity model running through LM Studio, then added NVIDIA NeMo Guardrails to compare model behavior under three conditions: no guardrails, input filtering, and combined input/output protection.
The work included configuring the local model environment, building a custom FastAPI gateway, integrating NeMo Guardrails, troubleshooting model latency and timeout issues, creating a reusable Spikee target, and analyzing attack results using Spikee’s built-in reporting tools.
The project also explored different adversarial testing approaches, including prompt injection datasets, obfuscation, encoded attacks, Best-of-N testing, synthetic canary leakage tests, and structured benchmark comparisons.
The objective was to measure how much the guardrails reduced successful attacks while keeping the model, dataset, and testing conditions consistent.
Tools used: Spikee, NVIDIA NeMo Guardrails, LM Studio, Python, FastAPI, PowerShell, Parrot OS, local LLMs, JSONL datasets, and custom security testing scripts.
This project demonstrates a hands-on approach to LLM red teaming, AI safety testing, prompt-injection assessment, and guardrail validation for organizations deploying generative AI systems.
pretty cool tbh. testing the same attacks with different guardrail setups makes the results way more interesting.
Built a controlled Kiso Secure AI red teaming lab using Promptfoo to test a local RAG application for prompt injection, system prompt leakage, indirect prompt injection, and sensitive data exposure. The setup used AnythingLLM with a Kiso Secure knowledge base, automated adversarial testing, and a hardened workspace to compare security behavior before and after remediation.
Running Promptfoo to hunt prompt injection saves a lot of manual probing and gives clear before and after metrics
Designed and implemented a hands-on AI red teaming environment using Microsoft PyRIT to evaluate the security of a local Retrieval-Augmented Generation application. The project connected a Parrot OS testing environment to a Windows-based AnythingLLM RAG application, with DeepSeek running locally through LM Studio.
I configured PyRIT to communicate with the AnythingLLM workspace through a custom HTTP target and used controlled adversarial objectives to examine how the application handled requests involving financial records, customer information, payroll data, and restricted credentials. The testing workflow included API connectivity validation, isolated Python environment setup, automated prompt execution, response collection, and evidence review.
The lab was built entirely around fictional Kiso Secure business data, allowing realistic sensitive-data disclosure scenarios to be tested without using real customer information or credentials. The resulting workflow demonstrates how automated AI red teaming can be used to identify potential data leakage, retrieval-boundary weaknesses, and unsafe handling of sensitive information in AI-powered applications.
The custom HTTP target that ties PyRIT into the AnythingLLM workspace makes the adversarial testing loop feel very tight.