Testing playbooks
Repeatable, detection-first workflows with preconditions, evidence checkpoints, tools, and source links.
Full Recon Methodology
End-to-end attack-surface mapping: from a root domain to a prioritized list of live, interesting hosts.
beginnerSubdomain Takeover
Find dangling DNS records pointing to de-provisioned cloud services you can re-claim.
intermediateIDOR & Broken Access Control
Systematically test whether one user can reach another user's objects or actions.
advancedAccount Takeover
Chain weaknesses in auth, reset, and session flows to seize another user's account.
intermediateAPI Hunting Methodology
Discover, understand, and abuse API surface - usually where the real vulns hide.
advancedAI / LLM Application Testing
Test LLM-backed features the way 2026 programs scope them: prompt injection (direct and indirect), insecure output handling, and over-privileged agents/tools. Aligned to the OWASP LLM Top 10 (2025).
advancedSSRF Hunting
Find server-side request forgery, then pivot to metadata and internal services.
advancedHTTP Request Smuggling
Exploit disagreements between a front-end proxy and back-end server on where one request ends, to poison the connection of the next user.
advancedWeb Cache Poisoning & Deception
Get a malicious response cached and served to other users, or trick the cache into storing sensitive pages.
advancedPrototype Pollution (client & server)
Inject properties into Object.prototype to change app behavior - client-side DOM XSS or server-side RCE via gadget chains.
advancedOAuth & SSO Misconfiguration
Abuse loose redirect and state handling in OAuth flows to steal tokens and take over accounts.
intermediateJWT Attacks
Forge or tamper JSON Web Tokens by abusing weak verification.
intermediateCORS Misconfiguration
Abuse permissive cross-origin policies to read authenticated responses from a victim's browser.
intermediateXXE Injection
Abuse XML external entity parsing to read files, perform SSRF, or exfiltrate data out-of-band.
intermediateFile Upload to RCE
Turn a file upload into code execution by defeating type/extension checks.
intermediateGraphQL Abuse
Enumerate and attack GraphQL: schema recovery, authorization gaps, and resource abuse.
advancedRace Conditions (single-packet attack)
Exploit small timing windows where the app checks-then-acts, to double-spend, bypass limits, or over-redeem.
intermediateBusiness Logic Flaws
Break the intended rules of a workflow - the bugs scanners never find.
advancedDependency Confusion & Supply Chain
Discover internal package names and (with authorization) demonstrate how a public look-alike could be pulled into builds.
intermediateGit & CI/CD Secret Recon
Find leaked credentials and internal detail across code, git history, and exposed CI artifacts.
advancedScaling: Automation & Monitoring
Move from one-off scans to continuous coverage that pings you when a target's attack surface changes.