핵심 요구사항
- 그레이박스 방식(소스코드+제한 문서 제공)으로 외부 공격자 관점 진단
- SQL 인젝션, XSS, 데이터 전송 구간 MITM 취약점 명시적 점검
- 재현 가능한 방법론(Burp/ZAP/Kali/커스텀 스크립트) 사용
- 각 발견 사항을 OWASP Top 10/CWE에 매핑
- PoC 페이로드·재현 절차·스크린샷·개선안 포함
Required stack
필요 기술
Burp SuiteOWASP ZAPKali LinuxMySQLLinuxPenetration TestingWeb SecurityNetwork Security
Project brief
프로젝트 내용
Our production web application needs a comprehensive gray-box penetration test that evaluates its overall security posture. Source-code access and limited internal documentation will be provided, yet I still expect the perspective of an external attacker.
The assessment must explicitly explore:
• SQL injection vectors
• Cross-site scripting (XSS) risks
• Possibilities for man-in-the-middle attacks on data in transit
Feel free to use your preferred toolkit—Burp Suite, OWASP ZAP, Kali Linux modules, custom scripts—so long as the methods are reproducible.
Deliverables
• A concise executive summary in plain English outlining high-level findings and business impact
• A detailed technical report that maps each finding to OWASP Top 10/CWE, includes proof-of-concept payloads, reproduction steps, screenshots, and suggested remediations
• A retest plan so I can verify fixes internally
The engagement is complete when every critical or high-severity issue is either resolved or has a documented mitigation path that we both agree on.
The assessment must explicitly explore:
• SQL injection vectors
• Cross-site scripting (XSS) risks
• Possibilities for man-in-the-middle attacks on data in transit
Feel free to use your preferred toolkit—Burp Suite, OWASP ZAP, Kali Linux modules, custom scripts—so long as the methods are reproducible.
Deliverables
• A concise executive summary in plain English outlining high-level findings and business impact
• A detailed technical report that maps each finding to OWASP Top 10/CWE, includes proof-of-concept payloads, reproduction steps, screenshots, and suggested remediations
• A retest plan so I can verify fixes internally
The engagement is complete when every critical or high-severity issue is either resolved or has a documented mitigation path that we both agree on.
지원 기회 분석
지원 전에 볼 것
예상 산출물
- 경영진용 요약 보고서(비즈니스 영향 중심)
- 상세 기술 보고서(OWASP/CWE 매핑, PoC, 재현 절차, 개선안)
- 내부 수정 검증용 재테스트 계획
매력 포인트
- 명확한 스펙과 산출물 정의
- 합리적 예산 구간($3,000~$5,000)
- 완료 조건이 명확(크리티컬/하이 이슈 해결 또는 완화 합의)
확인할 점
- 대상 애플리케이션 규모·범위(엔드포인트 수) 정보 부재로 견적 편차 발생 가능
- 기간 미명시로 일정 협의 필요
Client signal
클라이언트 정보
플랫폼에서 상세 정보를 확인하세요.