Research, methodology, and teardowns from our operators. Techniques and checklists we use hunting — targets anonymized, methods in full.
Most reported SSRF is a screenshot of a callback. The bugs that pay chain that callback into cloud metadata, internal services, and real impact. Here's how we hunt it.
Web · MethodologyNo scanner flags a coupon you can apply twice or a refund that runs before the charge. Logic bugs live in the gap between what the code does and what the business meant. Here's how we find them.
Web · MethodologyFront-end and back-end disagreeing on where a request ends is still one of the highest-impact web bugs of the decade. Detection, the modern variants, and how to prove it without breaking production.
Methodology · ArchitectureMost threat models are a diagram no one reads and a STRIDE table no one actions. A useful one is short, adversarial, and produces a ranked list of things to fix. Here's the model we run.
Fintech · ArchitecturePayment systems fail in ways generic web apps don't — idempotency, reconciliation, webhook trust, and money-movement authorization. The checklist we run against fintech, from the attacker's side.
Web · MethodologyCommand injection in a query string is mostly gone. Today's remote code execution hides in deserialization, template engines, dependency confusion, and file-processing pipelines. Where we look.
Mobile · MethodologyThe interesting bugs in a mobile app aren't in the app — they're in the API behind it and the trust the client wrongly assumes. Static, dynamic, and network, in the order we run them.
Fuzzing · MethodologyThrowing random bytes at an endpoint wastes everyone's time. Effective fuzzing is structured, coverage-guided, and aimed at a hypothesis. How we fuzz web APIs, parsers, and protocols.
Case Study · BFLAOn a workforce-management platform, a standard low-privilege employee account could read every colleague's full record — home address, phone, and hourly pay — through an API that enforced authorization on writes but not reads.
Case Study · MobileA static and dynamic teardown of a production React Native app: certificate pinning that fell to a one-line hook, backups left enabled, and a secure-storage flag that quietly disabled device authentication.
Case Study · MethodologyMass-assignment testing looked like it granted admin — until we verified server-side. A case for proving impact instead of trusting the response, and why a rejected finding is still good work.
Case Study · MethodologyA client had fixed a prior round of findings. The patches held — insecure storage, an IDOR delete, and a broken message authorization were all genuinely closed. But the fix pattern revealed a class of bug the patches never addressed.