About Services Process At Risk Contact

Penetration Tester · Security Consultant · Lebanon · Remote

Tony Khoriaty

|

Most organizations in Lebanon have never been tested — not because threats aren't real, but because no one has shown them what a real attack looks like.

The only way to know your exposure is to look for it the same way an attacker would.

What attackers
already know.

Breaches don't start with sophistication. They start with something nobody checked — a misconfigured service, an API returning more than it should, an access control nobody thought to question.


The exposure exists before anyone exploits it. The question is always who finds it first.


I conduct penetration tests, vulnerability assessments, and OSINT investigations across web applications, APIs, and networks — not to generate compliance reports, but to show how an attacker would actually move through an environment.

Live Systems
Production-first testing and responsible disclosure experience.
Web Applications & APIs
Focused on authentication flows, business logic, and modern attack surfaces.
OSINT & Reconnaissance
Asset discovery, exposure mapping, and external visibility analysis.
Lebanon + Remote
Independent engagements across Lebanon and remote environments.

What I do.

Every engagement is defined by what your environment actually exposes — not by a standard checklist. The scope, method, and depth are matched to real risk, not a templated package.

Penetration Testing

  • Web application & API testing
  • External network assessment
  • Vulnerability assessment & triage
  • Business logic flaw analysis
  • Detailed technical report + debrief

OSINT & Reconnaissance

  • Digital footprint mapping
  • Exposed asset discovery
  • Breach & leak investigation
  • Infrastructure exposure analysis
  • Due diligence profiling

Security Consulting

  • Security posture review
  • Risk identification & prioritization
  • Remediation guidance
  • Ongoing advisory retainer
  • Incident awareness & response

How I Work.

Every engagement follows a consistent, documented process — and nothing begins without written authorization.

01

Scoping

Define the target, asset boundaries, and rules of engagement in writing before any work begins.

02

Reconnaissance

Map the attack surface. Passive and active techniques, OSINT, infrastructure analysis.

03

Testing

Simulate what an attacker would actually do. Exploit chains, business logic, access controls.

04

Reporting

Every finding documented with impact context, reproduction steps, and CVSS scoring.

05

Debrief

Walk through findings with your team. Technical depth matched to your audience.

What real systems
actually expose.

These are examples of vulnerability classes found in real-world environments during authorized testing — the kind of weaknesses that exist quietly until someone looks for them deliberately.

Customer Data

"Your customer records."

Names, contact details, transaction history — data your customers trusted you with. A single unguarded endpoint can expose all of it. The damage isn't just technical. It's legal, reputational, and in some cases, personal.

Data Breach · High Business Impact

Authentication Layer

"Your login system."

Every application has one. Most have never been tested under real attack conditions. A bypassed login doesn't just expose one account — it can expose everything behind it, including data that was never meant to be accessible at all.

Unauthorized Access · High Business Impact

API Surface

"Your API."

If your application has a dashboard, a mobile app, or a third-party integration — it has an API. What that API returns, and to whom, is often never checked. The gap between what the interface shows and what the backend actually exposes can be significant.

Silent Exposure · Often Undetected

Admin Access

"Your admin panel."

Most applications have one — a place where everything can be managed, changed, or accessed. How it's protected, who can reach it, and whether it's even properly restricted from the outside is rarely verified. For an attacker, it's the highest-value target on the surface.

Full System Access · Critical Exposure

A penetration test costs a fraction
of what a breach costs.

Testing before an incident is a choice. Testing after is damage control.

Let's talk about
your exposure.

No two situations are the same. The conversation starts with yours — what you have, what's at risk, and where the gaps are. The work follows from there.

Available for new engagements
All engagements begin with a scoping conversation and a signed agreement. No work begins without written authorization. Confidentiality is standard, not optional.
Email
tony@tkhoriaty.com
WhatsApp
03 699 793
LinkedIn
Tony Khoriaty