owning.systems

The bug your last
pentest missed.

Two people, testing by hand. Web, API, mobile, AI, cloud, network and red team engagements, run by hackers who find real bugs for a living. You get exploits your engineers can reproduce, not a scanner export with the severities turned up.

Start an engagement Read what we have published

Vulnerabilities found and reported to

Services

What we test.

Every engagement is manual and scoped to your system. You get a report your engineers can act on, and a retest once you have fixed things.

  1. 01

    Web applications

    Multi-tenant platforms. Every role tested against every tenant.

  2. 02

    APIs & GraphQL

    BOLA, BFLA, mass assignment, and the endpoints your docs forgot.

  3. 03

    Mobile, iOS & Android

    The binary, and the backend it actually talks to.

  4. 04

    AI systems

    Prompt injection, tool abuse, and the blast radius afterwards.

  5. 05

    Cloud

    IAM paths to privilege, and what one leaked key really reaches.

  6. 06

    Network & infrastructure

    Perimeter and internal segments. What is exposed, and what chains.

  7. 07

    Red teaming

    Goal-driven. Tests whether anyone notices, not just whether a bug exists.

  8. 08

    Source code review

    White-box, alongside the test. The bug classes traffic never surfaces.

Retest after your fix is included in every engagement, not billed separately.

Who you work with

You get both of us, on every engagement.

No account manager, and no junior running a scanner while a senior signs the report. The two of us do the testing, write the findings, and sit on the call when your engineers have questions about them.

Vulnerabilities found and reported to

Reported through bug bounty and coordinated disclosure programmes. The reports are not public; we can walk you through the details under NDA.

Writings

AllResearchAnecdotes

We publish what we find, once it is fixed.

FeaturedMobile[Date]14 min

Bypassing certificate pinning in a Flutter app without patching the binary

Dart ships its own TLS stack and its own trust store, so the system proxy and the usual hook scripts both miss it. Here is where the verify function actually lives, and how to find it by anchor instead of by a borrowed signature.

Your empty-body API sweep is not an authorization test

API

A broken object-level check that only shows up on the second request

Web

What an LLM agent does with a tool you forgot to scope

AI

How just signing up on a bug bounty platform led to a four-digit bounty

Anecdote
All writings →

Contact

Tell us what to break.

A rough scope is enough to start. We will come back with what we would test, how long it takes, and a price. If we are not the right people for it, we will say so.

pentest@owning.systems

PGP   [KEY FINGERPRINT]

NDA before scope, always.

We reply within [N] business days.

Opens your email client.
Nothing is submitted by this site.