Freelancers using Kali LinuxFreelancers using Kali Linux
ProjectsPeople
Ahmed Khan's avatar
Ahmed Khan
Lahore, Pakistan
Cybersecurity specialist with ability to identify flaws
New to Contra
Cybersecurity specialist with ability to identify flaws
Cover image for I simulated a real-world Active
I simulated a real-world Active Directory (AD) attack to identify and exploit misconfigurations within a Windows domain environment. The goal was to practice enumeration techniques, escalate privileges to domain admin, and establish persistent access. I started with LDAP enumeration using ldapsearch to map domain users and groups. Using BloodHound, I visualized attack paths and identified a Kerberoastable service account — a weak SPN tied to an outdated service. I extracted the hash using GetUserSPNs.py (http://GetUserSPNs.py) and cracked it with Hashcat, revealing the cleartext password. I then used Pass-the-Hash to authenticate as a domain admin using PsExec. To maintain persistence, I added a domain admin backdoor account using Mimikatz. Finally, I cleared event logs to avoid detection and exported a full attack report for remediation. Tools Used: ldapsearch, BloodHound, Hashcat, GetUserSPNs.py (http://GetUserSPNs.py), PsExec, Mimikatz, eventlog (for cleanup) Deliverable: Full attack timeline with screenshots, enumeration outputs, and security recommendations.
0
19
Cover image for I conducted a complete web
I conducted a complete web application security assessment on Damn Vulnerable Web Application (DVWA) using manual and automated testing techniques. The goal was to identify and exploit OWASP Top 10 vulnerabilities. I mapped the application using Burp Suite and discovered multiple injection points. I exploited SQL Injection to bypass authentication and extract sensitive data from the database using sqlmap. I also tested for Cross-Site Scripting (XSS) with custom payloads and successfully hijacked session cookies using document.cookie injection. I chained a file upload vulnerability with a PHP reverse shell to gain remote access to the server. All findings were documented with proof-of-concept screenshots and step-by-step remediation guidance. Tools Used: Burp Suite, sqlmap, OWASP ZAP, curl, custom payloads Deliverable: A detailed report including vulnerability exploitation steps, proof-of-concept, and mitigation strategies.
0
45
Cover image for I performed a complete network
I performed a complete network penetration test on a deliberately vulnerable Linux machine (Metasploitable2) to simulate a real-world attacker scenario. The objective was to identify exploitable services, gain initial access, escalate privileges to root, and extract sensitive data. I started with reconnaissance using nmap to discover open ports and services. I identified outdated and vulnerable services including vsftpd 2.3.4 and Samba 3.0.20. Using Metasploit, I exploited the vsftpd backdoor to gain initial shell access. I then used shell_to_meterpreter to upgrade my session to a Meterpreter shell, giving me greater control. I dumped password hashes from /etc/shadow and cracked them using John the Ripper. Finally, I escalated privileges to root using the Samba usermap_script exploit and documented the entire process with screenshots. Tools Used: nmap, Metasploit, Meterpreter, John the Ripper, searchsploit Deliverable: A comprehensive report including attack timeline, exploited CVEs, and remediation recommendations.
0
39
Cover image for I discovered a stored cross-site
I discovered a stored cross-site scripting (XSS) vulnerability in a practice web application's comment section that allowed me to inject malicious JavaScript that would execute in any user's browser. By submitting a comment containing a script payload, I successfully stole session cookies from other users and could have hijacked their accounts, performed actions on their behalf, or defaced the website. This finding was documented in a comprehensive report including proof-of-concept screenshots showing cookie theft, CVSS risk scoring of 6.5 (Medium), and step-by-step remediation guidance including input sanitization and output encoding. This assessment demonstrates my ability to find client-side vulnerabilities that can compromise every user visiting the site.
0
59
Kali Linux(7)
MD MESBAUL ISLAM's avatar
MD MESBAUL ISLAM
Dhaka, Bangladesh
Certified Penetration Tester | Web, Mobile & API Sec. Expert
New to Contra
Certified Penetration Tester | Web, Mobile & API Sec. Expert
Cover image for Capture The Flag (CTF) Challenge
Capture The Flag (CTF) Challenge Development & Competition Support Designed and developed hands-on Capture The Flag (CTF) challenges for cybersecurity competitions, covering multiple domains such as web exploitation, cryptography, reverse engineering, OSINT, forensics, and binary exploitation. Assisted in planning, testing, and hosting the competition to ensure a smooth participant experience. Responsibilities: Created original CTF challenges with varying difficulty levels Developed flags, hints, and challenge validation Tested challenges for stability and fairness Assisted with competition infrastructure and event support Prepared write-ups and solutions for post-event learning Outcome: Successfully contributed to a well-organized CTF event that provided participants with practical, real-world cybersecurity challenges and an engaging learning experience.
0
24
Cover image for Mobile Application Penetration Testing (VAPT) Conducted
Mobile Application Penetration Testing (VAPT) Conducted a comprehensive Mobile Application Penetration Test to assess the security of Android/iOS applications and their backend APIs. Identified and validated multiple Critical and High-risk vulnerabilities through manual and automated testing. Scope of Work: OWASP Mobile Top 10 testing Authentication & authorization testing API security assessment Insecure data storage analysis SSL/TLS & certificate pinning validation Session management and business logic testing Professional VAPT reporting with PoC and remediation guidance Outcome: Delivered a detailed VAPT report with verified findings, business impact analysis, proof of concept (PoC), and prioritized remediation recommendations to help improve the application's security and resilience against real-world attacks.
0
25
Cover image for Web Application Vulnerability Assessment &
Web Application Vulnerability Assessment & Penetration Testing (VAPT) Performed a comprehensive Web Application VAPT to identify and validate security vulnerabilities through manual and automated testing. The assessment uncovered multiple Critical and High-risk vulnerabilities that could lead to unauthorized access, data exposure, and business impact. Scope of Work: OWASP Top 10 security testing Authentication & authorization testing API security assessment Session management analysis Business logic testing Manual exploitation and validation Professional VAPT reporting with risk ratings, PoC, and remediation guidance Outcome: Delivered an executive-level security report containing verified findings, proof of concept (PoC), business impact analysis, and actionable remediation recommendations, enabling the client to strengthen their overall security posture.
1
98
Cover image for Account Takeover (ATO) via Token
Account Takeover (ATO) via Token Vulnerability Identified a critical Account Takeover (ATO) vulnerability during web application and API penetration testing of a financial platform. By exploiting insecure token validation, I gained unauthorized access to user accounts without credentials. Key Findings: Weak token validation Missing session/device binding No token expiration or rotation Impact: Unauthorized account access, financial data exposure, and fraud risk. Outcome: Delivered a professional VAPT report with proof of concept (PoC), risk assessment, and remediation recommendations based on OWASP best practices.
0
36
Kali Linux(4)
Guilherme Farinassi's avatar
Guilherme Farinassi
São Paulo, Brazil
Penetration Tester & Security Researcher | Web, Mobile & API
New to Contra
Penetration Tester & Security Researcher | Web, Mobile & API
Cover image for Bug Bounty Research - Web
Bug Bounty Research - Web Vulnerability Discovery Conducted independent bug bounty research on public VDP and paid programs (Bugcrowd/HackerOne). Discovered and reported multiple valid vulnerabilities including IDOR exposing PII, stored XSS in user-controlled fields, SSRF via internal metadata endpoint, authentication bypass via JWT manipulation, and sensitive data exposure through misconfigured S3 buckets. Findings spanned government agencies, SaaS platforms, and financial services targets. Documented all findings with full reproduction steps, CVSS scoring, and business impact analysis following responsible disclosure guidelines.
2
89
Cover image for API Security Assessment - REST
API Security Assessment - REST and GraphQL Endpoints Performed a black-box API security assessment covering REST and GraphQL endpoints for a fintech platform. Identified BOLA/IDOR vulnerabilities allowing unauthorized access to other users financial data, mass assignment flaws exposing admin-only fields, broken function-level authorization on privileged endpoints, and GraphQL introspection exposing internal schema. Also found SSRF via webhook URL parameter and JWT algorithm confusion (RS256 to HS256). Delivered OWASP API Top 10 aligned report with curl-based PoC for each finding and remediation guidance.
2
74
Cover image for Mobile Application Pentest - Android
Mobile Application Pentest - Android Banking App Conducted a full black-box mobile penetration test on an Android banking application following OWASP MASTG methodology. Identified 17 vulnerabilities including 5 critical findings: hardcoded AES encryption keys in SharedPreferences, SSL pinning bypass via Frida instrumentation, root detection bypass via LIEF binary patching, exported Activities without permission checks, and sensitive data exposed in Logcat. Delivered MASTG-aligned report with CVSS scoring and PoC code for all critical findings.
2
90
Cover image for Web Application Pentest — Insurance
Web Application Pentest — Insurance Portal Conducted a full black-box web application penetration test on an insurance client portal. Identified 11 vulnerabilities including 3 critical findings: unauthenticated access to customer PII (CPF, phone, address), broken authentication allowing account takeover, and exposed debug endpoints with Facelets stack traces. Delivered a structured report with CVSS scoring, PoC for each finding, and prioritized remediation guidance. All critical findings were reproduced and confirmed in a retest cycle. Stack targeted: Java EE, REST APIs, JWT auth, LGPD-sensitive data.
2
101
Kali Linux(4)
Muhamed Ali's avatar
Muhamed Ali
Egypt
Versatile Cybersecurity & HR Expert
Versatile Cybersecurity & HR Expert
Cover image for Training project , Enhancing Security Awareness: Understanding t
Training project , Enhancing Security Awareness: Understanding t
0
14
Cover image for Onsite Network Pentest
Onsite Network Pentest
0
21
Cover image for Onion Circuit for a special purpose research client
Onion Circuit for a special purpose research client
0
22
Placeholder project card media
View more →
Kali Linux(3)
Nitin Yadav's avatar
Nitin Yadav
Gurugram, India
Top-Notch Cybersecurity & Penetration Testing
Top-Notch Cybersecurity & Penetration Testing
Cover image for Pen-Test for Real Estate Marketing Platform
Pen-Test for Real Estate Marketing Platform
0
5
Cover image for Security Assessment of Satellite Comm GUI System
Security Assessment of Satellite Comm GUI System
0
5
Cover image for Comprehensive Web Application Penetration Testing
Comprehensive Web Application Penetration Testing
0
3
Placeholder project card media
View more →
Kali Linux(3)
Himanshu Kumar's avatar
Himanshu Kumar
proBengaluru, India
Helping founder turn Replit MVPs into secure, scalable SaaS
$1k+
Earned
12x
Hired
5.0
Rating
41
Followers
REPLIT_EXPERT

Expert

Helping founder turn Replit MVPs into secure, scalable SaaS
Cover image for Bug Bounty Hunting & Web App Security Research
Bug Bounty Hunting & Web App Security Research
0
10
Cover image for Workflow Automation for Industrial Services
Workflow Automation for Industrial Services
2
41
Cover image for Real-time Booking Automation Platform
Real-time Booking Automation Platform
1
23
Cover image for Secure Auth & Multi-Tenant System for Industrial SaaS
Secure Auth & Multi-Tenant System for Industrial SaaS
0
16
Kali Linux(1)
Abdulbasit Ogundiran's avatar
Abdulbasit Ogundiran
Nigeria
Cybersecurity Analyst | Cloud Security & IT Operations
New to Contra
Cybersecurity Analyst | Cloud Security & IT Operations
Cover image for My lab environment, and this
My lab environment, and this is a project giving to me by a client to test my ethical hacking skill cracking an encrypted .rar file open and seeing the content inside, I was authorised and I confirmed it was his before I performed my attacks. And I successfully hacked into it. Not to be disclosed cause of what it contains and for privacy but this was when I was working on the project. So am opened to share my expertise and solving problems in whatever you bring to my table. Lekk's Forge got you covered.
0
22
Cover image for This is a project that
This is a project that I titled Low-cost AI Power theft detection that detects electricity theft, bypass of electricity, high electricity usage, with the help of TinyML integrated and trained into the esp32 and alert with the help of the buzzer and shows in a well polished web dashboard, sensor used would be communicated after the project as been finally built and ready for implementation.
0
37
Cover image for A fully functional health website
A fully functional health website for a project given to me to work on by a client but still on development stage. It shows a lot of detailed information and a graph to express the blood pressure trends, with the help of AI prediction using various models to make this possible. Will deliver soon and talk more about it when done.
0
39
Cover image for This is a project I
This is a project I titled: Development of High Blood Pressure (HBP) Prediction and Monitoring System Using CNN-BiLSTM and Fuzzy Logic in Real Time Still undergoing development: 1. The Flask backend is operational with an integrated CNN-BiLSTM prediction pipeline and a fuzzy logic module for health risk assessment, along with REST API endpoints for communication. 2. A Flutter mobile application has been developed, featuring a dashboard that displays various health metrics and successfully communicates with the backend. ‎3. Hardware development includes the successful configuration of the ESP32 microcontroller, integration of an OLED display, and testing of the MAX30102 PPG sensor for real-time waveform acquisition. 4. AI integration involves transmitting real PPG data from the MAX30102 sensor to the Flask backend, where the CNN-BiLSTM model generates blood pressure predictions, which are then returned to the ESP32 and backend. ‎5. The complete communication pipeline from sensor to monitoring dashboard has been established, confirming successful real-time signal processing for blood pressure prediction. ‎6. Ongoing work focuses on sensor stabilization, hardware integration, synchronization of live updates, alert mechanisms, power management, and final system packaging. 7. The core real-time HBP prediction system using CNN-BiLSTM is implemented and tested, with the project now in the optimization stage before final deployment. Willing to hear suggestions and getting more gigs to work with and solving of problems
0
41
Kali Linux(1)