Thorough Penetration Testing for Web App

Advanced Web Application Penetration Testing I’m looking for a highly experienced professional penetration tester to perform an in-depth security assessment of the provided website/application. This is not a request for a basic vulnerability scan or a simple “the website is secure” assessment. I need a thorough, manual, adversarial penetration test performed by someone who understands modern web application security and can investigate vulnerabilities beyond automated tooling. Scope of the Assessment The assessment should include, where applicable: Authentication and authorization vulnerabilities Broken access control / IDOR Privilege escalation Session management and authentication flaws Business-logic vulnerabilities Race conditions and concurrency issues Input-validation vulnerabilities Injection vulnerabilities XSS, CSRF, SSRF, and related web vulnerabilities API security File upload/download vulnerabilities Account takeover scenarios Password reset and recovery mechanisms Payment and transaction logic Rate-limit and anti-automation weaknesses Information disclosure Misconfigurations and exposed functionality Client-side and server-side security issues Logic flaws that automated scanners are unlikely to identify Chained vulnerabilities where multiple low-severity issues can be combined into a significant attack Any other security weakness discovered during manual testing Methodology & Transparency I want the testing process to be fully documented. For every significant finding, the report should explain: What was tested. Why it was tested. The methodology or attack hypothesis used. What requests, inputs, techniques, or test cases were attempted. What happened during testing. How the vulnerability was reproduced. The security impact and realistic attack scenario. The severity and reasoning behind the rating. Any prerequisites or limitations. Recommended remediation steps. Where appropriate, evidence demonstrating the issue without unnecessarily damaging production data or systems. I specifically want to understand what was actually attempted, including meaningful negative results. Simply reporting successful vulnerabilities is not enough—the assessment should provide enough detail to demonstrate that the application was systematically tested. Expected Deliverable The final deliverable should be a professional penetration-testing report containing: Executive summary Scope and assumptions Testing methodology Attack surface overview Detailed findings Severity ratings Reproduction steps / proof of concept Evidence and relevant request/response information Impact assessment Remediation recommendations Testing limitations Areas tested with no vulnerabilities identified Overall security assessment The goal is to obtain a deep, evidence-based security assessment, not a superficial vulnerability scan. The penetration tester will only receive the website URL and nothing else.