Engagement Case Studies.

Challenge

A fast-growing HealthTech quick-commerce delivery platform required a comprehensive security assessment of their micro-fulfillment dark-store API backend prior to expanding across tier-1 metro hubs.

Our Approach

Executed white-box API architecture analysis and black-box dynamic endpoint fuzzing across their mobile API gateways and microservice endpoints.

Impact Found

Identified an unauthenticated API vulnerability across 195+ endpoints exposing 580,000+ customer records, live cart GPS telemetry with sub-meter accuracy, historical prescription data, and real-time operational delivery analytics.

Outcome

Following unacknowledged direct vendor outreach, SDX Shadow Labs escalated the incident to CERT-In (Indian Computer Emergency Response Team). Upon official CERT-In notification, the vendor leadership deployed application-wide authentication middleware and API gateway controls within 24 hours.

Challenge

A major audio and short video streaming platform (Target) was suffering from premium content piracy. They needed an audit of their subscription enforcement and API authentication controls.

Our Approach

Performed API attack surface mapping and black-box dynamic exploitation focusing on DRM, CDN paths, and the Firebase authentication integration.

Impact Found

Discovered an API chain that completely bypassed the paywall, exposing 1,300+ premium episodes. Additionally, found a Firebase configuration flaw allowing unlimited unauthenticated account creation (bypassing OTP) and a BFLA vulnerability leaking customer PII (including PAN and GSTIN via invoices).

Outcome

Reported via responsible disclosure. The client acknowledged the vulnerabilities, and permanent fixes have been applied.

Challenge

A large public sector organization's web portal utilized a SAML Single Sign-On (SSO) integration that exposed administrators to unauthenticated impersonation attacks.

Our Approach

Performed metadata verification and black-box signature algorithm analysis on SAML request and response handlers.

Impact Found

Identified an unpatched signature confusion vulnerability exposure (CWE-347) that allowed forging SAML assertions using the IdP's public key as an HMAC shared secret, enabling complete takeover of administrative accounts.

Outcome

Coordinated responsible disclosure via the organization's VDP. The vulnerability was mitigated by restricting signature verification algorithms to asymmetric schemes.

Challenge

An enterprise application framework providing tech support to 100+ schools suffered from multiple unauthenticated entry points, putting student tracking and personal records at risk.

Our Approach

Performed manual API flow analysis and parameter fuzzing across both the Android client application and web framework.

Impact Found

Identified 5+ distinct SQL injection vulnerabilities resulting in full database compromise, allowing complete exfiltration of live tracking data and teacher directories.

Outcome

Assisted technical lead in database query parameterization and API authorization fixes. Fully resolved within 10 business days.

Challenge

An early-stage startup required verification of their backend API security before scaling to protect 100,000+ active user records.

Our Approach

Black-box infrastructure port auditing and Redis configuration analysis.

Impact Found

Confirmed complete host takeover via unauthenticated Redis cron backup writing, achieving root privilege execution.

Outcome

Enforced local network interface bindings for database engines, enabled password authentication controls, and rotated environment variables.

Challenge

An e-learning platform's revenue model was threatened by subtle validation flaws allowing users to bypass paywalls and generate certified credentials.

Our Approach

Manual state-machine analysis of the checkout, enrollment, and certification API endpoints.

Impact Found

Confirmed unauthenticated bypass of premium course locks and zero-cost official certificate generation.

Outcome

Enforced server-side validation of enrollment state and session-token integrity. Verified during follow-up testing.

Challenge

A public university system portal housed thousands of sensitive records of students and academic staff with unknown vulnerabilities in its administrative panel.

Our Approach

Internal secure-code review and remote black-box vulnerability assessment.

Impact Found

Found Remote Code Execution (RCE) via unauthenticated upload endpoints and local lateral movement options.

Outcome

Redesigned server file upload policies, restricted internal lateral paths, and secured system databases containing PII.