Blog
Technical write-ups from our testers — offensive-security methodology, written to be useful to the defenders on the other side of it.
A full walkthrough of how we use BloodHound on engagements to turn a single low-privileged foothold into Domain Admin — and, for every step, how blue teams detect and close the path.
Across web, mobile, cloud, internal and red-team work, the same handful of root causes show up again and again. Here are the patterns we see most — and what they say about where to spend your security budget.
Hardcoded secrets, weak at-rest encryption and one-line jailbreak bypasses — a tour of what a mobile app actually gives away once you reverse-engineer the shipped build, and how to stop it.
A single container compromise shouldn't end with read/write to every tenant's data. Here's how an over-privileged database account turns a contained foothold into a full breach — and how to cap the blast radius.
Scanners are useful — but buying a scan branded as a penetration test leaves real risk on the table. Here's the difference, and how to tell which one you're actually getting.
Insecure direct object references are the least glamorous bug in the book — and still one of the most common serious findings we report. Why they persist, and how to design them out.