Engagement Case Studies.

Challenge

A large public sector organization's web portal utilized a SAML Single Sign-On (SSO) integration that exposed administrators to unauthenticated impersonation attacks.

Our Approach

Performed metadata verification and black-box signature algorithm analysis on SAML request and response handlers.

Impact Found

Identified an unpatched signature confusion vulnerability exposure (CVE-2026-15013) that allowed forging SAML assertions using the IdP's public key as an HMAC shared secret, enabling complete takeover of administrative accounts.

Outcome

Coordinated responsible disclosure via the organization's VDP. The vulnerability was mitigated by restricting signature verification algorithms to asymmetric schemes.

Challenge

An enterprise application framework providing tech support to 100+ schools suffered from multiple unauthenticated entry points, putting student tracking and personal records at risk.

Our Approach

Performed manual API flow analysis and parameter fuzzing across both the Android client application and web framework.

Impact Found

Identified 5+ distinct SQL injection vulnerabilities resulting in full database compromise, allowing complete exfiltration of live tracking data and teacher directories.

Outcome

Assisted technical lead in database query parameterization and API authorization fixes. Fully resolved within 10 business days.

Challenge

An early-stage startup required verification of their backend API security before scaling to protect 100,000+ active user records.

Our Approach

Black-box infrastructure port auditing and Redis configuration analysis.

Impact Found

Confirmed complete host takeover via unauthenticated Redis cron backup writing, achieving root privilege execution.

Outcome

Enforced local network interface bindings for database engines, enabled password authentication controls, and rotated environment variables.

Challenge

An e-learning platform's revenue model was threatened by subtle validation flaws allowing users to bypass paywalls and generate certified credentials.

Our Approach

Manual state-machine analysis of the checkout, enrollment, and certification API endpoints.

Impact Found

Confirmed unauthenticated bypass of premium course locks and zero-cost official certificate generation.

Outcome

Enforced server-side validation of enrollment state and session-token integrity. Verified during follow-up testing.

Challenge

A public university system portal housed thousands of sensitive records of students and academic staff with unknown vulnerabilities in its administrative panel.

Our Approach

Internal secure-code review and remote black-box vulnerability assessment.

Impact Found

Found Remote Code Execution (RCE) via unauthenticated upload endpoints and local lateral movement options.

Outcome

Redesigned server file upload policies, restricted internal lateral paths, and secured system databases containing PII.