You will get PCI DSS External Penetration Test (SAQ-Aligned) – Report + Retest
Top Rated
Top Rated
Project details
Audit-ready external penetration testing aligned to PCI DSS v4.0 (Req. 11.4) and your SAQ. I combine commercial scanning with deep manual testing (Burp Suite Pro + custom tooling) to validate real risk—no scanner dumps. You’ll get an Executive Summary for leadership, technical findings with PoC, CVSS/CWE scores, prioritized fixes, PCI control mapping, an evidence bundle, and an attestation letter. Methodology follows NIST SP 800-115, PTES, and OWASP ASVS L2. I’ve delivered thousands of pentests for 250+ companies. Strict NDA, scope-only, production-safe methods, coordinated with your WAF/CDN and monitoring team. Live readout included; 30-day retest is included in Advanced and available as an add-on for other tiers.
Cybersecurity Assessment Type
Penetration TestingCybersecurity Expertise
Audit, Risk Assessment, Gap AnalysisTechnology Type
Firewall, IaaS, Computer Network, Data Center, Database, Operating System, SaaS, Web Application, CRM, Email System, ERP, Mobile Device, PaaSCybersecurity Regulation
NIST Cybersecurity Framework, PCI DSSWhat's included
| Service Tiers |
Starter
$499
|
Standard
$1,499
|
Advanced
$2,499
|
|---|---|---|---|
| Delivery Time | 3 days | 5 days | 7 days |
Application Audit | - | - | |
Project Plan | - | ||
Cost Estimation | - |
Optional add-ons
You can add these on the next page.
30-Day Retest (Starter tier only)
+$150
+8 Public IPs
(+ 1 Day)
+$300
Additional Web/App Target
(+ 1 Day)
+$600Frequently asked questions
8 reviews
(7)
(1)
(0)
(0)
(0)
This project doesn't have any reviews.
Aa
Amiram a.
Jan 25, 2026
Penetration Testing Company Needed for Web Application (Fast Delivery + Official Report)
It was a pleasure working with Md Shofiur.
He delivered high-quality work, maintained excellent communication, and stayed perfectly on schedule. What I appreciated most was his honesty when I requested a milestone outside his core expertise, he was upfront about it and even helped me source other freelancers to fill the gap.
His integrity and skills make him a great asset, and I look forward to hiring him again
He delivered high-quality work, maintained excellent communication, and stayed perfectly on schedule. What I appreciated most was his honesty when I requested a milestone outside his core expertise, he was upfront about it and even helped me source other freelancers to fill the gap.
His integrity and skills make him a great asset, and I look forward to hiring him again
PS
Parvinder S.
Mar 16, 2023
Test VPS Server Security Settings
PS
Parvinder S.
Feb 16, 2023
Need to Scan & Fix Bugs in Core PHP Website
HB
Hatem B.
Feb 15, 2023
Cyber security consultation
It was great working with Rahman. A true expert in cybersecurity.
Polite and with good communication skills. When I needed help removing malware, he was quick to reply and fix the issue.
Polite and with good communication skills. When I needed help removing malware, he was quick to reply and fix the issue.
WD
Willyzd D.
Dec 10, 2022
PenTest windows app
Well done
About Md Shofiur
Senior Penetration Tester | Web App - API - AI Security Testing | CEH
100%
Job Success
Dhaka, Bangladesh - 7:54 am local time
find them. My job is to find them first.
I'm Md Shofiur, a Certified Ethical Hacker (CEH) and senior penetration tester
with 8+ years securing applications and infrastructure across fintech, healthcare,
e-commerce, and SaaS. I'm Top Rated on Upwork with a 100% Job Success Score
across every engagement I've taken on.
What I test:
Web applications (OWASP Top 10 methodology)
REST and GraphQL APIs (authentication, injection, IDOR, rate limiting)
AI-powered applications and LLM systems (OWASP LLM Top 10)
WordPress, Laravel, and custom CMS platforms
Network and VPS infrastructure
PCI DSS, HIPAA, and ISO 27001 compliance environments
What makes my work different:
I don't run a scanner and call it a pentest. Every engagement starts with
manual reconnaissance, follows a structured methodology, and ends with a
report your developers can actually act on. Each finding includes a risk
rating, business impact, step-by-step proof of concept, and specific
remediation guidance — not just a list of CVEs.
AI Security Testing:
I'm one of the few penetration testers offering dedicated security assessments
for AI systems. If your company uses an LLM-powered chatbot, AI agent, RAG
system, or AI API, I test it against the full OWASP LLM Top 10 — covering
prompt injection, data extraction, insecure output handling, excessive agency,
and more.
Compliance experience:
PCI DSS v4.0 external and internal penetration testing
HIPAA security rule technical safeguard assessments
ISO/IEC 27001 security control validation
SOC 2 readiness penetration testing support
Certifications:
Certified Ethical Hacker (CEH)
API Penetration Testing
API Security for PCI Compliance
ISO/IEC 27001 Information Security Associate
Certified in Cybersecurity
What you get from every engagement:
Every report I deliver includes an executive summary for management, a
technical findings section with full proof of concept for each vulnerability,
risk ratings using industry-standard scoring, and a prioritized remediation
roadmap your team can follow immediately.
I respond within 4 hours and offer a free 15-minute discovery call before
any engagement starts. Message me with your project details and I'll tell
you exactly what I'd find and how I'd approach it.
Steps for completing your project
After purchasing the project, send requirements so Md Shofiur can start the project.
Delivery time starts when Md Shofiur receives requirements from you.
Md Shofiur works on your project following the steps below.
Revisions may occur after the delivery date.
Kickoff & Authorization
Confirm SAQ, scope (IPs/FQDNs/apps), ROE, contacts, windows.
Recon & External Scanning
Map attack surface; safe, non-disruptive discovery.