How visiting URL led to host RCE
A page searched a bounded localhost port range, found an unauthenticated editor socket, and planted a plugin that became one-click host code execution.
474554202f70776e 20485454502f312e 3120323138202020 |OWNING SYSTEMS |
373234206f776e69 6e672e7379737465 6d73203435312020 |web api mobile |
3431382070656e74 6573744070776e2e 636f6d7075746572 |ai cloud network|
3130332032303720 3232362033303820 3432352035303820 |red team |
Hacker expertise.
Accelerated by AI.
Experienced hackers lead every engagement. AI expands coverage and speeds up analysis, while human judgment validates every exploit, attack chain, and finding your engineers receive.
Independent research. Enterprise impact.
Security research recognized by Fortune 500 companies.
3 top-three finishes
at HackerOne Live Hacking Events
Vulnerabilities found and reported to
Ubiquiti
DataCamp
BrowserStack
Dell
Matillion
Bookipi
Reported through bug bounty and coordinated disclosure programmes.
Services
What we do.
Every engagement is scoped to your system. You get a report your engineers can act on, and a retest once you have fixed things.
- 01
Web applications
Multi-tenant platforms. Every role tested against every tenant.
- 02
APIs & GraphQL
BOLA, BFLA, mass assignment, and the endpoints your docs forgot.
- 03
Mobile, iOS & Android
The binary, and the backend it actually talks to.
- 04
AI systems
Prompt injection, tool abuse, and the blast radius afterwards.
- 05
Cloud
IAM paths to privilege, and what one leaked key really reaches.
- 06
Network & infrastructure
Perimeter and internal segments. What is exposed, and what chains.
- 07
Red teaming
Goal-driven. Tests whether anyone notices, not just whether a bug exists.
- 08
Source code review
White-box, alongside the test. The bug classes traffic never surfaces.
Retest after your fix is included in every engagement, not billed separately.
Who you work with
Senior expertise, close to the work.
From scoping through retesting, experienced security practitioners stay directly involved. Every finding is validated, clearly documented, and discussed with your engineers. No layers of account management get between your team and the people doing the work.
Tushar Daga
confievil · co-founder
Hardik Singh
kxddah · co-founder
Ubiquiti
DataCamp
BrowserStack
Dell
Matillion
Bookipi
Contact
Tell us what to break.
PGP [KEY FINGERPRINT]
NDA before scope, always.
We reply within [N] business days.