Research, methodology, and teardowns from our operators. Techniques and checklists we use hunting — targets anonymized, methods in full.
The login page was hardened, the session cookie was HttpOnly, and the whole app looked buttoned up. Then a help button loaded a third party support widget, and a guardian's own name turned into running JavaScript.
Case Study · BOLAThe main endpoint checked your tenant on every request and returned nothing you were not allowed to see. Its little sibling, the print action, did not check at all. One query parameter later I was reading every district on the platform.
Case Study · Mobile · Stored XSSA shift scheduling app let the lowest privileged employee leave a note. When a manager opened that note in the web console, the note ran code in the manager's browser. A field for text became a channel for privilege escalation.
Case Study · Red TeamThe Citrix environment was supposed to be a sealed glass box. No command prompt, no C drive, no way out. It took an address bar, a leftover RDP file, and the Run dialog to walk straight through the glass into a domain joined shell.
Case Study · BFLAOn a workforce-management platform, a standard low-privilege employee account could read every colleague's full record — home address, phone, and hourly pay — through an API that enforced authorization on writes but not reads.
Case Study · MobileA static and dynamic teardown of a production React Native app: certificate pinning that fell to a one-line hook, backups left enabled, and a secure-storage flag that quietly disabled device authentication.
Case Study · MethodologyMass-assignment testing looked like it granted admin — until we verified server-side. A case for proving impact instead of trusting the response, and why a rejected finding is still good work.
Case Study · MethodologyA client had fixed a prior round of findings. The patches held — insecure storage, an IDOR delete, and a broken message authorization were all genuinely closed. But the fix pattern revealed a class of bug the patches never addressed.
Web · MethodologyMost reported SSRF is a screenshot of a callback. The bugs that pay chain that callback into cloud metadata, internal services, and real impact. Here's how we hunt it.
Web · MethodologyNo scanner flags a coupon you can apply twice or a refund that runs before the charge. Logic bugs live in the gap between what the code does and what the business meant. Here's how we find them.
Web · MethodologyFront-end and back-end disagreeing on where a request ends is still one of the highest-impact web bugs of the decade. Detection, the modern variants, and how to prove it without breaking production.
Methodology · ArchitectureMost threat models are a diagram no one reads and a STRIDE table no one actions. A useful one is short, adversarial, and produces a ranked list of things to fix. Here's the model we run.
Fintech · ArchitecturePayment systems fail in ways generic web apps don't — idempotency, reconciliation, webhook trust, and money-movement authorization. The checklist we run against fintech, from the attacker's side.
Web · MethodologyCommand injection in a query string is mostly gone. Today's remote code execution hides in deserialization, template engines, dependency confusion, and file-processing pipelines. Where we look.
Mobile · MethodologyThe interesting bugs in a mobile app aren't in the app — they're in the API behind it and the trust the client wrongly assumes. Static, dynamic, and network, in the order we run them.
Fuzzing · MethodologyThrowing random bytes at an endpoint wastes everyone's time. Effective fuzzing is structured, coverage-guided, and aimed at a hypothesis. How we fuzz web APIs, parsers, and protocols.