Penetration Testing for Cloud, Container Environments, Web and APIs

6+ years finding exploitable weaknesses and helping teams fix them in production

I deliver scoped security assessments from exploit discovery to verified remediation, with clear reporting for engineering and leadership teams.

manoj@security:~

$ About Me

I help organizations identify and close high-impact security gaps across applications, cloud platforms, and Kubernetes workloads.

Penetration testing for web, API, cloud, and containerized systems.
Attack-path validation with practical proof-of-risk and business impact.
Remediation guidance and retesting to verify fixes actually hold.

200+

Penetration Tests Completed

75+

Cloud Security Engagements

40+

Container Security Reviews

$ Services

Each engagement is outcome-driven: identify real risk, fix it fast, and validate closure.

Penetration Testing

Web, API, and infrastructure adversarial testing.

Kubernetes Security

Cluster hardening, policy controls, and runtime defense.

Cloud Security

Posture assessment, IAM security, and cloud architecture hardening.

DevSecOps Security

Practical CI/CD security gates with developer-friendly workflows.

Container Security

Image, runtime, and workload security controls.

$ Case Studies

Anonymized IAM Platform API Security Assessment 12 critical/high vulnerabilities identified Outcome: Full admin takeover path demonstrated and critical flaws remediated.

Scope Security assessment of an enterprise Identity & Access Management (IAM) platform focusing on API authentication, authorization controls, and user management workflows.

Findings Unauthenticated administrative APIs, RBAC bypass, bulk user data exposure, and file download path traversal allowing sensitive system file access.

Execution Performed manual API security testing, request manipulation, and authorization bypass testing to demonstrate full administrative takeover.

Burp Suite OWASP ZAP Custom Python Scripts API Request Manipulation

Outcome Full administrative account creation achieved, user database exposure identified, and critical authorization flaws remediated.

Anonymized SaaS Kubernetes Hardening 65% misconfig reduction Outcome: High-risk misconfigurations reduced by 65% across production clusters.

Scope Multi-tenant Kubernetes environment used by customer-facing workloads.

Findings Overprivileged service accounts, permissive network policies, and weak workload security contexts.

Execution Built hardening baseline, enforced admission policies, and tuned runtime detections for noisy clusters.

Kyverno Falco Trivy kube-bench

Outcome 65% reduction in high-risk misconfigurations and risky deployments blocked at admission.

Anonymized Cloud Container Security Review 48 exploitable paths removed Outcome: 48 exploitable cloud/container attack paths removed with guardrails added.

Scope AWS workloads using containers across EKS, CI/CD, and registry pipelines.

Findings Weak IAM trust policies, exposed secrets in pipelines, and unscanned base images in production builds.

Execution Prioritized exploitable attack paths, introduced preventive controls, and reran validation after fixes.

Pacu ScoutSuite Trivy Prowler

Outcome 48 exploitable cloud/container paths removed and guardrails added for ongoing prevention.

$ Blogs

Loading latest Medium posts...

Please wait while we fetch recent blogs.

$ Training & Workshops

Loading events...

Preparing training and workshop highlights.

$ Testimonials

$ Contact

If you need a trusted partner to test, break, and secure cloud-native systems, let's discuss your environment.