Book a scoping call

The deliverable is the product

We don't describe our work in bullet points. We show it. Below is the structure and format of an actual engagement report, with all identifying information redacted per engagement NDA. Every finding includes the exact evidence an engineering team needs to reproduce and fix it.

Sample report. Illustrative structure, redacted. This is not a real client engagement. All assets, identifiers, and credentials have been replaced with placeholder values.

Engagement report

Ref SAMPLE, illustrative
Engagement
Web application penetration test
Scope
redacted
Duration
5 days
Date
redacted
Operator
Senior, V3X LLC
Version
Final
  • High1
  • Medium1
  • Low1
  • Total3
HIGHapi.█████.redacted

Broken Object-Level Authorization

Summary
The API did not enforce ownership checks on resource identifiers, allowing any authenticated session to read or modify another user's records by changing the object ID in the request.
Impact
An authenticated attacker could exfiltrate the full customer dataset, modify account details, or delete records belonging to any other user — no elevated privilege required.
Proof of concept

Reproduction steps (redacted)

  1. Authenticate as a normal user and capture a request to GET /api/v1/users/█████/profile.
  2. Replace the user ID in the path with a different numeric ID (█████ + 1).
  3. Observe that the response returns the target account’s profile data with HTTP 200.
  4. Repeat for PATCH /api/v1/users/█████/email — the server accepts the mutation.

All specific identifiers, endpoints, and credentials have been redacted per the engagement NDA.

Remediation
Enforce ownership at the data layer on every read and write: verify that the requesting session owns the referenced object before returning or mutating it.
MEDIUMauth.█████.redacted

Session Token Not Rotated on Authentication

Summary
The application issued a session token before login and retained the same token value after successful authentication, enabling session fixation.
Impact
An attacker who plants a known session token (via a shared link or subdomain cookie injection) gains a fully authenticated session the moment the victim logs in — without any credential.
Proof of concept

Reproduction steps (redacted)

  1. Obtain a pre-authentication session token from GET /login (Set-Cookie: session=█████).
  2. In a second browser profile, set the same cookie value manually.
  3. Authenticate normally in the first profile.
  4. In the second profile, navigate to GET /dashboard — the session is now authenticated without supplying credentials.

All specific identifiers, endpoints, and credentials have been redacted per the engagement NDA.

Remediation
Invalidate and reissue the session token immediately after any privilege change, including successful authentication. Verify the new token is set with Secure, HttpOnly, and SameSite=Strict flags.
LOWapp.█████.redacted

Verbose Error Responses Expose Stack Traces

Summary
Unhandled exceptions returned full server-side stack traces and internal path information in the HTTP response body, visible to unauthenticated users.
Impact
Stack traces reveal framework versions, internal file paths, and class names that accelerate targeted exploitation of other findings and reduce the cost of vulnerability research for an attacker.
Proof of concept

Reproduction steps (redacted)

  1. Send a malformed request to POST /api/█████ with a deliberately invalid JSON body.
  2. Observe the response: HTTP 500 with a body containing a full stack trace including internal paths such as /app/src/controllers/█████.js:██.
  3. The response also includes the framework version string (Express █.█.█) in the X-Powered-By header.

All specific identifiers, endpoints, and credentials have been redacted per the engagement NDA.

Remediation
Implement a global error handler that logs the full trace internally and returns a generic error message to clients. Disable debug mode in the production configuration.

The full redacted report is available on request during scoping.

Proprietary tooling, human judgment

Research and disclosures

Every engagement uses custom-built tooling that accelerates reconnaissance, surface mapping, and pattern recognition across large codebases and complex APIs. The tools flag; a thirty-year operator decides. The result is broader coverage in the same window — not automation replacing expertise, but automation extending it. The internals stay internal.

Book a scoping callSee services

Scoped per engagement — no standard pricing.