Mohammed Al-Faleh

Penetration tester — web applications and APIs

Riyadh, Saudi Arabia · reports in English or Arabic · remote worldwide

How I work

The method matters more than the tool, so this is the whole of it rather than a list of acronyms.

Scope first	We agree exactly what is in scope, what authentication roles exist, and what "sensitive" means for your business, before anything is tested. Most disappointing reports come from a scope argument, not a technical one.
Manual first	Automated scanners are useful for coverage and terrible for judgement. They find what is there; they do not tell you whether it is reachable, and they cannot chain two findings into a real attack path. I use scanners for enumeration and do the testing myself.
Business logic, specifically	Access control, IDOR, broken authentication, excessive data exposure, mass assignment, workflow abuse. These are where real breaches come from, and they are the findings a scanner will not produce.
Proof, not assertions	Every finding ships with reproduction steps and evidence, not "an attacker could potentially". If I cannot demonstrate it, it does not go in the report as a confirmed issue.
Ranked by business risk	Not by CVSS. The finding that exposes other tenants' data outranks the authenticated reflected XSS that only you can trigger.
Retest included	After you fix things, I retest every finding to confirm it is resolved and that the fix did not introduce a regression. Available within 3 months at 30% of the original engagement fee.

What you get

• A ranked findings list, highest business risk first, so the team starts in the right place.
• An evidence appendix — request and response pairs, proof-of-concept code where useful.
• Remediation guidance written for your stack, not generic advice.
• A retest to confirm the fixes work.
• Delivery in English or Arabic.

Credentials

• CompTIA Security+ (CE)Baseline defensive and offensive security fundamentals
• Certified Penetration Testing SpecialistStructured penetration testing methodology
• Web App Pentester eXtremeWeb application attack surface in depth
• Certified Professional Penetration TesterProfessional engagement practice and reporting
• Junior Penetration TesterFoundational practical assessment

Public work

Claims about security work are worth very little without something to check, so here is something checkable.

I built an exploited-vulnerability triage corpus that joins CISA's Known Exploited Vulnerabilities catalog with CVSS vectors and EPSS exploitation probabilities — 545 pages, one per vulnerability, each figure linked to the source it came from. Two findings from it: 1,181 of CISA's 1,726 entries have been exploited for more than two years, and only 49 are genuinely urgent on any given day.

It is documented in full, including which figures are copied, which are arithmetic, and what none of it tells you. If you intend to use it, you should be able to check my arithmetic rather than take it on trust.

What I am not

Getting in touch

If you are not sure which engagement you need, the exposure check takes a few minutes, and the threat feed shows what is being exploited this week.