Security Research & Insights

Deep dives, disclosures, and field notes from our offensive security engagements - written by the team that finds the bugs.

AI Security

Prompt Injection and the OWASP LLM Top 10: Securing AI Applications

Prompt injection sits at the top of the OWASP LLM Top 10 for a reason. Here is how direct and indirect attacks work, what they do to agentic apps, and the defenses we actually rely on.

Jun 16, 202612 min read

Read article

Active Directory

Kerberoasting Attack Explained: From a Normal AD User to Domain Admin

A Kerberoasting attack turns a single low-privilege domain account into cracked service credentials, and often into Domain Admin. Here is the full chain and the fixes that actually work.

May 6, 202612 min read

Cloud Security

From SSRF to Cloud Account Takeover: Attacking the Metadata Service

One SSRF bug in a URL fetcher can reach the cloud metadata endpoint, steal IAM role credentials, and end in full account takeover. Here is the chain, and how to break it.

Mar 27, 202611 min read

API Security

Broken Object-Level Authorization (BOLA / IDOR): the API bug we find most

A BOLA vulnerability (also called IDOR) is the single bug we report most often on API tests. Here is how we hunt it by swapping object IDs across two accounts, and how to shut it down with server-side authorization.

Feb 18, 202612 min read

Guides

What Does a Penetration Test Cost in 2026? (An Honest Breakdown)

A straight answer on penetration test cost in 2026: the real drivers behind the number, honest ranges, and the line items that quietly inflate a quote.

Jan 15, 20269 min read

Application Security

The Mobile App Pentest Checklist: OWASP MASVS in Practice

A field checklist for mobile app penetration testing built on OWASP MASVS, covering static and dynamic analysis, insecure storage, weak crypto, and cert pinning bypass, from testers who do this for a living.

Nov 20, 202511 min read

Case Studies

SOC 2 in 90 Days: How a Healthcare SaaS Passed Its First Audit

A healthcare SaaS had 90 days, a signed enterprise deal on the line, and no formal controls. Here is how we ran their SOC 2 readiness and how they cleared their first audit.

Oct 14, 202511 min read

Web Application Security

Cross-Site Scripting (XSS) in 2026: the web bug that refuses to die

Cross-site scripting has been a top web vulnerability for over twenty years and it is still one of the most common criticals we report. Here is how reflected, stored, and DOM XSS work, how we test for them, and the defenses that hold up.

Sep 12, 202513 min read

Methodology

Cloud Penetration Testing: Our Methodology for AWS, Azure, and GCP

A working walkthrough of the cloud penetration testing methodology we run against AWS, Azure, and GCP: how we abuse IAM, hunt misconfigurations and exposed storage, pivot from SSRF to instance metadata, escalate privilege, and check whether anyone was watching.

Aug 28, 202511 min read

Case Studies

Red Team Diary: From a Single Phishing Email to Domain Admin in Six Days

A representative red team assessment, told day by day: how one convincing phishing email turned into domain admin in six days, and the three controls that would have stopped us cold.

Jul 22, 202510 min read

Social Engineering

Phishing Simulations Done Right: Measuring Human Risk

A gotcha email that shames the people who click teaches nothing. Here is how we run a phishing simulation that measures human risk and moves the numbers that matter: report rate, dwell time, and repeat clickers.

Jun 27, 202510 min read

Guides

Penetration Testing vs Vulnerability Scanning: What’s the Difference (and When You Need Each)

A scanner tells you a port is open and a version looks old. A pentester tells you how someone chains three “medium” findings into a full account takeover. Here is the real difference between penetration testing and vulnerability scanning, and how to know which one you actually need.

May 20, 202510 min read

Compliance

SOC 2 and Penetration Testing: What Auditors Actually Expect

A pentest is not a checkbox your auditor stamps and forgets. Here is what SOC 2 penetration testing actually needs to prove, how it maps to the Common Criteria, and the report details auditors ask for.

Apr 15, 20259 min read

Case Studies

How a Series-B Fintech Closed 23 Critical API Flaws Before Their Next Raise

A Series-B fintech booked an API penetration test six weeks before due diligence. We found 23 critical issues, most of them authorization flaws no scanner would ever catch. Here is how the engagement actually ran.

Mar 10, 20259 min read

Penetration Testing

What an External Network Penetration Test Actually Finds

The big wins on external network penetration testing are rarely exotic zero-days. They are the forgotten box, the unpatched VPN, and the login that still says admin/admin. Here is what we find, and how.

Feb 19, 202510 min read

Guides

How to Choose a Penetration Testing Company (2026 Buyer’s Guide)

Most pentest reports we get asked to review are automated scans in a nice PDF. Here is how to choose a penetration testing company that actually tests.

Nov 19, 202410 min read

Methodology

The Web Application Penetration Testing Methodology We Use

The exact web application penetration testing methodology we run on engagements, from mapping the app to chaining low findings into a real breach and retesting the fix.

Aug 5, 202410 min read

Cyber SecuritySecurity Research

We Hacked GitHub for a Month : Here’s What We Found

After a long hiatus, we are back with a new write-up. Although we don’t typically participate in bug bounty programs due to other commitments, we took up the challenge of hacking GitHub for a month and are excited to share our findings. It all started when Shivam Singh (Mr. Rajput … Read more

Feb 10, 202315 min read

Security Research

How We Are Able To Hack Any Company By Sending Message – $20,000 Bounty [CVE-2021–34506]

Story Of Universal XSS (uXSS) On Microsoft Edge Hello Folks , I hope everyone is doing well in this pandemic & making full use of it for learning new stuff in their daily life . so this a story about hacking into any companies even the big ones are on list like … Read more

Jun 25, 20217 min read