Home / Blog
Field notes from the engagements
Blog
What we find, how it is exploited, and what actually fixes it. Written by the people who ran the test.
API Security
When the User Supplies the Regex: One Line That Took the API Down
An advanced search field let users filter with their own regular expression, passed straight into new Regex(userInput). One catastrophic-backtracking pattern locked every worker thread.
Read itAPI Security
Why Message Queues Keep Failing Their Penetration Test
Every microservice shared one credential with publish and subscribe on every channel. One foothold, one forged message, and a refund was issued - with no authorization at all.
Read itApplication Security
Almost Every Real Penetration Test Starts by Hunting for Secrets
An API key left in git. A token embedded in an image or a PDF. A config.old.js somebody forgot to delete. Google open-sourced a secret scanner, and it…
Read itAI and LLM Security
“But We Asked the AI for Secure Code”: Five Minutes, Three Vulnerabilities
A development manager told me proudly they now build five times faster with AI. I asked about security. Five minutes later I had found three vulnerabilities in the…
Read itAuthorization and Access Control
“It’s GraphQL, It’s Typed, It’s Safe” – One Introspection Query Later
Introspection returned the whole schema. One mutation set isAdmin=true. The UI hid the field; the API never checked it.
Read itAuthorization and Access Control
They Batched Eight API Calls Into One. I Chained Three of Them Past Authorization.
A performance optimisation - one endpoint instead of eight calls. Every command was authorised on its own. Nobody had asked what happens when they run in the same…
Read itAPI Security
Rate Limiting: The Control Everyone Agrees On and Nobody Implements
A standard registration form with no limit on requests per minute. A bot fired tens of thousands, flooded the mail queue, and harvested hundreds of real usernames out…
Read itWhite Box Testing
Beyond the Password: Advanced Authentication Testing Techniques for Modern Applications
Why Authentication Needs to Evolve In today’s threat landscape, relying solely on usernames and passwords is no longer sufficient to protect sensitive systems. Authentication mechanisms have become increasingly…
Read itAPI Security
Web Services Testing: Safeguarding Your Web Applications Against XXE Attacks
As organizations increasingly rely on web services, particularly SOAP-based services, ensuring robust security through meticulous Web Services Testing has become critical. One common and significant vulnerability in these…
Read itApplication Security
The Ultimate Guide to Securing Applications Through Software Security Testing
Software application security testing is essential in safeguarding applications against vulnerabilities and potential cyber-attacks. With increasing threats, ensuring the security of applications through thorough testing is crucial for…
Read itTell us what the system does and what worries you.
If a penetration test is not what you need yet, we will say so.