Gaming Platform Security & API Audit
Budget / Salary₹1,500–12,500
TypeFreelance project
LocationRemote
Posted3 hours ago
I need a seasoned security specialist to dive into our authorised test instance of an online gaming platform that serves casino and cricket gaming IDs. The priority is crystal clear: uncover and eliminate any way a user—or an insider—could manipulate balances or points when funds are added or removed.
You will be granted temporary credentials plus API documentation so you can:
• Trace every “add funds” and “deduct funds” call end-to-end, confirming signatures, rate limits, and tamper resistance.
• Stress-test the relevant database tables for integrity breaches such as double-spend, race conditions, and roll-back exploits.
• Probe the public and internal APIs with tools like Burp Suite, OWASP ZAP, Postman, or your preferred arsenal, then document each finding with reproducible steps.
• Validate that the game-result processor cannot be coerced into writing incorrect balances, even under abnormal loads or crafted packets.
Deliverables
1. A concise penetration test report that ranks vulnerabilities by impact and likelihood, with proof-of-concept payloads or queries.
2. Remediation guidance that my development team can action quickly (code snippets, config changes, or WAF rules).
3. A retest summary showing all high- and medium-risk issues closed, plus a clean bill of health for the “add/remove funds” flow.
Ethical hacking experience, prior casino or sportsbook audits, and any relevant certifications (OSCP, CEH, GWAPT, etc.) will weigh heavily in selection. Share links or redacted samples of past work so I can gauge fit.
Testing must stay within the sandbox environment I supply; no live-user interaction is authorised. If this focus run goes smoothly, we can expand into transfers, bonus engines, and full API hardening next.
You will be granted temporary credentials plus API documentation so you can:
• Trace every “add funds” and “deduct funds” call end-to-end, confirming signatures, rate limits, and tamper resistance.
• Stress-test the relevant database tables for integrity breaches such as double-spend, race conditions, and roll-back exploits.
• Probe the public and internal APIs with tools like Burp Suite, OWASP ZAP, Postman, or your preferred arsenal, then document each finding with reproducible steps.
• Validate that the game-result processor cannot be coerced into writing incorrect balances, even under abnormal loads or crafted packets.
Deliverables
1. A concise penetration test report that ranks vulnerabilities by impact and likelihood, with proof-of-concept payloads or queries.
2. Remediation guidance that my development team can action quickly (code snippets, config changes, or WAF rules).
3. A retest summary showing all high- and medium-risk issues closed, plus a clean bill of health for the “add/remove funds” flow.
Ethical hacking experience, prior casino or sportsbook audits, and any relevant certifications (OSCP, CEH, GWAPT, etc.) will weigh heavily in selection. Share links or redacted samples of past work so I can gauge fit.
Testing must stay within the sandbox environment I supply; no live-user interaction is authorised. If this focus run goes smoothly, we can expand into transfers, bonus engines, and full API hardening next.
Apply on Freelancer →
Project sourced from Freelancer.com. Applications happen directly on the original platform — we never collect your data.