Author · Sumrite
Niyaz Khan, Senior Consultant at Sumrite.
Niyaz Khan is a Senior Consultant at Sumrite.
RoleSenior Consultant
Articles18
Based inNew Delhi, India
About Niyaz Khan
Niyaz Khan is a Senior Consultant at Sumrite. He works on web application, API and infrastructure security testing, and on the hardening guidance that follows each engagement.
- Role
- Senior Consultant, Sumrite
- Company
- Sumrite, New Delhi (legal name Summit Printrite Private Limited)
- Focus
- Web application and API penetration testing; Infrastructure and network testing; Server and header hardening
Articles by Niyaz Khan (18)
Threat ResearchSaudi Arabia Cybersecurity Market 2026: Size, Growth and Where Demand Is Heading NCA's latest figures, explained by Sumrite.The National Cybersecurity Authority puts the Saudi cybersecurity market at SAR 16.3 billion. Growth, who spends, products vs services, workforce and what comes next.Threat ResearchAI-Powered Phishing in Saudi Arabia: Spotting and Testing for It A field guide from Sumrite.How AI-written lures and WhatsApp impersonation are hitting Saudi organisations, what NCA ECC asks for, and how to run a phishing simulation that measures real risk.Threat ResearchRansomware in Saudi Arabia: Who Is Being Hit and How to Prepare Threat research from Sumrite.Saudi ransomware victims rose from 17 to 31 in a year, per Naif Arab University. Which groups and sectors are involved, and how to test your readiness.Threat ResearchPHP2Shell: two critical PHP flaws allow unauthenticated RCE. What is affected and how to patch, from Sumrite.Two CVSS 9.2 memory-safety bugs in the PHP engine allow unauthenticated remote code execution. Fixed versions, who is most exposed and what to do before you can patch.Security HardeningHow to remove the AWS ALB server header and stop advertising your stack: Sumrite's fix.The server: awselb/2.0 header tells attackers what you run. One listener attribute removes it. Console, CLI and Terraform steps.VAPT GuidesCloud penetration testing on AWS, Azure and GCP The rules, the scope and what Sumrite tests.What AWS, Microsoft and Google actually allow, what gets you in trouble, and where cloud pentests find the issues that matter: identity, storage and exposed services.Security HardeningHost header injection and open redirection When a redirect trusts the wrong hostname: a Sumrite find.If an app builds a redirect from the Host header, an attacker who changes that header can send users to their own domain. How it happens and how to fix it.VAPT GuidesAPI penetration testing checklist Sumrite's checklist, built on the OWASP API Top 10.A practical API penetration testing checklist mapped to the OWASP API Security Top 10: what to test for each risk, how to scope an API test and what a good report shows.VAPT GuidesInternal vs external penetration testing Sumrite on what each tests, and why you need both.External tests the attacker at your perimeter; internal tests the attacker already inside. What each covers, when to choose which, and why you usually need both.ComplianceNIS2 penetration testing requirements Sumrite on what the directive asks, and what it does not.NIS2 does not name penetration testing as mandatory, but its risk and effectiveness duties make testing the practical way to comply. What the rules say and who is covered.CompliancePCI DSS 4.0 penetration testing requirements Requirement 11.4, line by line, with Sumrite.What PCI DSS 4.0.1 Requirement 11.4 asks for: methodology, annual internal and external tests, segmentation checks, retests and the evidence a QSA expects.Security HardeningCSP unsafe-inline and unsafe-eval risks Sumrite on how they quietly undo XSS protection.A CSP with 'unsafe-inline' or 'unsafe-eval' looks like protection but leaves the door open. What each keyword permits, why it matters and how to replace it.ComplianceDORA TLPT vs penetration testing Sumrite on what EU financial entities actually need.Every DORA firm needs yearly resilience testing. Only some must run threat-led penetration testing every three years. What each involves and how to tell which applies.VAPT GuidesVulnerability Assessment vs Penetration Testing: Which Does NCA ECC Require? Both, and why, explained by Sumrite.A vulnerability assessment finds known weaknesses; a penetration test proves what an attacker can do with them. NCA ECC-2:2024 requires both, under 2-10 and 2-11.Security HardeningHow to remove the IIS Server header including Microsoft-HTTPAPI/2.0, a Sumrite guide.Microsoft-IIS/10.0 and Microsoft-HTTPAPI/2.0 both reveal your stack. They come from different layers and need different fixes. Here are both.VAPT GuidesBlack box, grey box and white box testing across web, mobile, API, network and cloud, by Sumrite.Black, grey or white box? What each approach means, how it changes for web, mobile, API, network and cloud testing, and which one to choose.Security HardeningSecure, HttpOnly and SameSite cookies: which flags Sumrite sets and why.Secure, HttpOnly, SameSite Strict, Lax or None: what each flag does, which one each cookie should use, and how to set them in your stack.Security HardeningYour API reflects any Origin in Access-Control-Allow-Origin. Here is how Sumrite fixes it.We sent Origin: evil.com and the API echoed it back with credentials allowed. Why that matters and how to fix it in every common stack.
Other authors
Want an expert to look at your application?
Fixed-scope quote, expert-led testing, retest included.