Research, methodology, and teardowns from our operators. Techniques and checklists we use hunting — targets anonymized, methods in full.
Most reported SSRF is a screenshot of a callback. The bugs that pay chain that callback into cloud metadata, internal services, and real impact. Here's how we hunt it.
Web · MethodologyNo scanner flags a coupon you can apply twice or a refund that runs before the charge. Logic bugs live in the gap between what the code does and what the business meant. Here's how we find them.
Web · MethodologyFront-end and back-end disagreeing on where a request ends is still one of the highest-impact web bugs of the decade. Detection, the modern variants, and how to prove it without breaking production.
Methodology · ArchitectureMost threat models are a diagram no one reads and a STRIDE table no one actions. A useful one is short, adversarial, and produces a ranked list of things to fix. Here's the model we run.
Fintech · ArchitecturePayment systems fail in ways generic web apps don't — idempotency, reconciliation, webhook trust, and money-movement authorization. The checklist we run against fintech, from the attacker's side.
Web · MethodologyCommand injection in a query string is mostly gone. Today's remote code execution hides in deserialization, template engines, dependency confusion, and file-processing pipelines. Where we look.
Mobile · MethodologyThe interesting bugs in a mobile app aren't in the app — they're in the API behind it and the trust the client wrongly assumes. Static, dynamic, and network, in the order we run them.
Fuzzing · MethodologyThrowing random bytes at an endpoint wastes everyone's time. Effective fuzzing is structured, coverage-guided, and aimed at a hypothesis. How we fuzz web APIs, parsers, and protocols.