Portfolio
Our track record
Real results from real assessments. All client details are kept confidential.
Findings
Sample discoveries
These are real vulnerability types we have found. Client names and details are hidden for privacy.
Authentication Bypass in Web Portal
Found a way to bypass login and access admin panel without any credentials. This could have allowed attackers to take full control of the application.
Stored XSS in User Dashboard
Discovered a stored cross-site scripting vulnerability that let attackers inject malicious scripts into other users sessions and steal their data.
SQL Injection in Search API
Found a SQL injection flaw in the search endpoint that allowed extracting the entire database, including user passwords and personal information.
IDOR in File Management
Discovered that changing a file ID in the URL let users download other users confidential documents without any authorization check.
Expertise