We break systems
before attackers do.
Vulnerability research, exploit development, and responsible disclosure across mobile, IoT, web, network and cloud.
Mobile · IoT · Web · Network · Cloud · Since 2025
$ ./lab --status[OK] advisories 1[OK] research 5[OK] publications 0[OK] disclosure coordinatedThe lab in numbers
Latest advisories
Findings we reported, and what the vendor did about them.
From the lab
Deep dives into what we found, and notes from the work around it.
A 1-Click account takeover in a Crypto app
A single tapped link hands the attacker JavaScript execution under the origin https://www.exchange.example inside the app's own authenticated in-app WebView lead to spoof origin and reads the cleartext session token localStorage.key_account_token() to attacker server
A 1-click lead remote screen capture
A bundled analytics SDK (ByteDance RangersAppLog) ships a hidden screen-streaming tool whose launcher is exported and permission-less. One tapped link sets its server via an unvalidated url_prefix, redirecting the stream to the attacker: full screenshots every ~1.4s.
A 1-Click OAuth Token Theft Chain in Bing
Bing for Android shipped four small, individually unremarkable weaknesses. Chained together, a single tap on a link from any web page or another app could steal the victim's Microsoft OAuth refresh token, access tokens, and account PII and send them to an attacker-controlled server.
What we do
How the lab works with a client. Each engagement is scoped with the researchers who will do it.
Scope an engagement
Most engagements start with a 30-minute scoping call with the people who will actually do the work. No sales funnel.