Pentest · Morocco & remote
Penetration testing
A full penetration test of what you actually expose — external perimeter, internal network, web applications, APIs and the cloud account behind them. Manual, chained and evidence-backed: the deliverable is a report your team can work from, not a scanner export with a logo on it. I've run tests across multiple platforms and hunted bugs since 2020 for companies including Apple and TrendMicro. Based in Morocco, available on-site and remote.
01 · What I test
The attack surface, end to end.
An engagement is scoped to your risk, not to a fixed package. These are the surfaces I test, in whatever combination fits what you're protecting and the time we have.
EXT
External perimeter
Everything reachable from the internet: exposed services, forgotten hosts and subdomains, default and reused credentials, and the misconfigurations that open the first door.
WEB
Web applications
Authenticated testing of your applications against the OWASP classes — access control, authentication, injection, logic — for every user role in scope.
API
APIs & integrations
REST and GraphQL endpoints, mobile and SPA back ends, webhooks and third-party integrations — often the least-tested and most-exposed part of a stack.
INT
Internal network
What an attacker does after the first foothold: lateral movement, privilege escalation, credential reuse, segmentation that doesn't hold, and the path to domain or data.
CLOUD
Cloud & identity
IAM misconfiguration, over-permissive roles, exposed storage and metadata-service access in AWS and equivalent environments.
CHAIN
Attack chaining
Stringing medium findings into one real compromise — the difference between a list of issues and proof of what they add up to.
Methodology grounded in PTES, the OWASP WSTG and MITRE ATT&CK, scored with CVSS.
02 · How an engagement runs
Scoped, manual, reproducible.
Scope & rules of engagement
Targets, timing, testing windows and limits agreed in writing before anything starts, with a named contact and a clear stop condition.
Reconnaissance
Mapping the real attack surface — hosts, services, subdomains, applications and exposed credentials — because the asset nobody remembered is usually the way in.
Exploitation
Manual exploitation of what recon surfaced, verified rather than theoretical. Every finding is proven, and anything disruptive is agreed first.
Post-exploitation & chaining
From a foothold: escalate, move laterally, and show how far the compromise actually reaches — bounded by the agreed scope.
Report, readout & retest
A risk-ranked report with evidence and reproduction steps, a walk-through with your team, and a retest of the fixes once they're in.
03 · What you get
A report you can act on.
- An executive summary that a non-technical reader can act on
- Technical findings with evidence, CVSS scoring and reproduction steps
- Attack chains showing what the findings add up to together
- Prioritised remediation guidance, ordered by real risk
- A readout call with your team and a free retest after the fixes
04 · Standards & who runs it
Grounded in the frameworks that matter.
- PTES
- OWASP WSTG
- MITRE ATT&CK
- CVSS 3.1
I've delivered penetration tests for multiple platforms as detailed reports with clear remediation steps, then worked through them with the teams doing the fixing. That sits on a software and application security engineering role at Invygo — 50+ vulnerabilities closed in production — plus bug-bounty work since 2020 for Apple, TrendMicro, JustLife and others, a Certified AppSec Practitioner certification and TCM Academy's Practical API Hacking.
05 · FAQ
Questions worth asking first.
- What is a penetration test?
- An authorised simulated attack on your systems to find the weaknesses a real attacker would use, and to prove what they would reach. It's manual work against agreed targets, and it ends in a report that ranks what you should fix first.
- What does a penetration test cost, and how long does it take?
- It depends on scope: the number of applications, hosts and user roles, and whether internal and cloud testing are included. Most small to mid-sized engagements run one to two weeks of testing plus reporting. Send me the scope and you'll get a fixed quote and timeline before anything starts.
- Will testing disrupt our production systems?
- Testing is designed around availability. Anything potentially disruptive — denial-of-service style checks, destructive exploits — is either excluded or run only in an agreed window with your contact available, and there's a stop condition throughout.
- What do we need to provide before you start?
- Written authorisation, the target list, test accounts for each user role, and a technical contact. For internal or cloud testing, access or a read-only role in the environment. I'll send a scoping questionnaire that covers all of it.
- Do you provide a report we can show clients or auditors?
- Yes. The deliverable includes an executive summary written for non-technical readers alongside the technical findings, and a retest confirmation once the fixes land — which is usually what a client or auditor is asking for.
- Do you work with companies in Morocco?
- Yes. I'm based in Morocco and available on-site across the country, and remote for clients anywhere. Reporting can be delivered in English or French.
Find out what's reachable before someone else does.
External, internal, application, API or cloud — scoped to your risk and proven, not guessed. Tell me what you want tested and I'll come back with a scope and a quote.