OWASP Certified Pentesting, Manual Approach

Require a manual pen test covering the OWASP Top 10 (not relying solely on automated scans).
Requesting a sample pen test report before beginning work
Must have a recognised certification

PENETRATION TEST REQUIRED — WEB APPLICATION
(ST4S Compliant — Australian Education Sector)

ABOUT THE ENGAGEMENT
I require a manual web application penetration test for a multi-tenant SaaS platform operating
in the Australian education sector. The pen test must satisfy the requirements of the Safer Technologies 4 Schools (ST4S) assessment framework, which is the national security assessment standard for software used in Australian schools.

Full details of the application, architecture, and access credentials will be provided to the successful applicant only after engagement is confirmed.

This is a paid engagement. I am looking for an affordable, certified independent ethical hacker or cybersecurity professional who can deliver a quality pen test report suitable for submission to the ST4S assessment team.

ABOUT THE APPLICATION (HIGH LEVEL)

The application is a multi-tenant SaaS web application with the following general characteristics:

- React frontend hosted via a managed cloud platform
- PostgreSQL database with row-level security enforcing multi-tenant data isolation
- Cloud-hosted authentication system
- Role-based access control with multiple user roles
- File upload functionality
- API-driven backend with serverless edge functions
- Hosted on AWS in Australia
- Custom domain

The pen test may be conducted on a test/staging environment that mirrors production. Full architectural documentation and access will be provided upon engagement.

SCOPE OF WORK

The pen test must cover the web application as experienced by authenticated end users, including all components that make up the solution. The test must NOT be limited to the public-facing pages only — it must cover the authenticated application and all its components.

At minimum the pen test must cover the
OWASP Top 10 vulnerabilities:

1. Broken Access Control
2. Cryptographic Failures
3. Injection
4. Insecure Design
5. Security Misconfiguration
6. Vulnerable and Outdated Components
7. Identification and Authentication Failures
8. Software and Data Integrity Failures
9. Security Logging and Monitoring Failures
10. Server-Side Request Forgery (SSRF)

Additional areas that must be tested:

- Multi-tenant data isolation — attempt to
access data belonging to another tenant
- Role-based access control — attempt to
access features or data outside of the
assigned role
- File upload security — attempt to upload
malicious or unexpected file types
- Authentication bypass — attempt to access
authenticated pages without valid credentials
- API endpoint security — test backend
API endpoints and serverless functions
- JWT token security — test for token
manipulation or privilege escalation
- SQL injection via PostgreSQL layer
- Cross-site scripting (XSS)
- Cross-site request forgery (CSRF)

DELIVERABLE — PEN TEST REPORT

The report must include:

1. Tester credentials and business details
(name, certification number, ABN or
registered business details)

2. Executive summary of the engagement

3. Scope and methodology — frameworks
and standards followed (e.g. OWASP
Web Application Security Testing Guide)

4. Description of each test undertaken
including screenshots or logs showing
the exercise was completed

5. List of findings with:
- Description of the vulnerability
- Risk rating (Critical, High, Medium,
Low, Informational)
- Evidence (screenshot, log output)
- Recommended remediation

6. Overall summary of results

Sensitive information such as IP addresses and server names may be redacted in the
final report. The report must be detailed and comprehensive — brief or limited scope reports will not be accepted by the ST4S assessment team.

---

REQUIREMENTS FOR APPLICANTS

You MUST meet ALL of the following criteria:

1. BUSINESS REGISTRATION
Must trade under a registered business

2. QUALIFICATIONS
Must hold a relevant qualification or minimum 2 years industry experience in cybersecurity.

3. PENETRATION TESTING CERTIFICATION: Must hold at least ONE of the following recognised certifications:

- CEH (Certified Ethical Hacker) — EC-Council
- OSCP (Offensive Security Certified
Professional)
- OSCP+
- OSEP (Offensive Security Experienced
Penetration Tester)
- CompTIA PenTest+
- GPEN (GIAC Penetration Tester)
- eCPPT (eLearnSecurity Certified
Professional Penetration Tester)
- CREST Registered Penetration Tester (CRT)
- Or equivalent — please provide details
and I will confirm acceptability

Your certification number must be verifiable on the official issuing authority's website.

---

HOW TO APPLY

Please include ALL of the following
in your proposal:

1. Your certification name and number so I can verify it on the official issuing authority's website

2. Your registered business details

3. A sample pen test report from a previous engagement — client and application details may be fully
redacted, but the report must demonstrate your methodology, the depth of testing conducted, and your reporting style

4. A brief description of your proposed methodology and approach for a multi-tenant SaaS web application

5. Your quoted price and estimated timeframe to complete and deliver the report

Full details of the application will
be shared only with the selected
applicant after engagement is confirmed
and any necessary confidentiality
arrangements are in place.
---

IMPORTANT NOTE

This pen test will be submitted to a formal
government-recognised security assessment
body in Australia. The assessors will review
both the report content and the tester's
credentials as part of their process.

Automated scanning tools marketed as
penetration tests will not be accepted —
this must be a genuine manual pen test
conducted by a certified person following
a recognised methodology such as the
OWASP Web Security Testing Guide.

If you have questions about the specific
requirements before quoting, please ask.