Pentesting & Recon

Hunt CI/CD pipeline flaws in GitHub Actions, Jenkins and GitLab runners

Hunt clickjacking gaps caused by missing frame protections on sensitive pages

Hunt CORS misconfigurations that allow credentialed cross-origin reads

Hunt cross-site request forgery including SameSite bypass and GraphQL via GET

Hunt insecure deserialization in Java, PHP, Python, .NET and Ruby applications

Pick and load the right attack skill set for a target after the mode is chosen

Hunt DOM clobbering, postMessage, service worker and CSS injection flaws

Hunt malformed-input bugs that leak stack traces or fail open

Hunt file upload bypasses that lead to webshells, stored XSS or XXE

Hunt fintech GraphQL flaws in money movement, idempotency and ledger queries

Hunt password reset flaws like token leaks, replay and username enumeration

Hunt GraphQL bugs like IDOR, batching DoS and mutation auth bypass

Hunt gRPC flaws like open reflection, missing auth and proto file leaks

Hunt Host header injection, cache poisoning and routing-based SSRF

Hunt HTML injection where unsanitised input renders as markup in responses

Hunt HTTP request smuggling from CL.TE, TE.CL and HTTP/2 desync bugs

Hunt IDOR and broken object-level access control in web apps

Hunt JWT forgery through alg none and RS256 to HS256 key confusion

Hunt Laravel flaws like exposed debug mode, Telescope access and Ignition RCE

Hunt LDAP and XPath injection for auth bypass and attribute exfiltration

Hunt file inclusion and path traversal, including log poisoning to RCE

Hunt prompt injection and data exfiltration bugs in LLM-powered features

Hunt MFA and 2FA bypasses like OTP brute force and token replay

Hunt miscellaneous web vulnerabilities drawn from 225 public bounty reports

Hunt Next.js flaws in server actions, middleware auth and image optimization

Hunt Node.js flaws like prototype pollution, SSTI and child_process injection

Hunt NoSQL injection in MongoDB, CouchDB and Redis for auth bypass

Hunt NTLM info leaks from internet-facing IIS, SharePoint and Exchange

Hunt OAuth flaws that let attackers take over accounts

Hunt open redirects and chain them into OAuth token theft

Hunt race conditions like double-spend coupons using HTTP/2 single-packet attacks

Hunt poisoning and cross-tenant leaks in RAG vector stores and embeddings

Hunt remote code execution bugs drawn from 67 public bounty reports

Hunt SAML and SSO attacks like signature wrapping and signature stripping

Hunt session flaws like fixation and weak logout invalidation

Hunt shadow and zombie APIs by mapping old versions and undocumented specs

Hunt on-prem SharePoint farms for anonymous access and login bypass

Hunt leaked source maps, .env and .git files and hardcoded build secrets

Find hidden backend APIs in a single-page app bundle and test their access control

Hunt Spring Boot Actuator exposure, SpEL injection and H2 console RCE

Hunt SQL injection including ORM raw-fragment and second-order bugs

Hunt SSRF to cloud metadata endpoints and internal services

Hunt server-side template injection across Jinja2, Twig, ERB and more

Hunt subdomain takeovers on cloud hosts, help desks and SaaS providers

Hunt TLS, HSTS, SPF and DNS misconfigurations that enable spoofing

Hunt WebSocket flaws like cross-site hijacking and missing origin checks

Hunt cross-site scripting across reflected, stored and DOM sinks

Hunt XML external entity bugs in SOAP, SAML and Office file uploads

Run an iOS red-team pipeline from IPA extraction to Keychain secret hunting