Case Studies
What We’ve Found – And Fixed
Every engagement is different, but the pattern is the same: we find what others miss. Below are real examples from our vulnerability research and penetration testing engagements, demonstrating the depth and impact of our work.
Vesta Control Panel – Admin Takeover via Predictable Random Number Generation
Target: Vesta Control Panel (VestaCP), an open-source hosting control panel used on thousands of servers worldwide for managing websites, databases, DNS, and email.
What we did: We reverse-engineered the password reset mechanism, focusing on how reset tokens were generated. Rather than treating the token as a black box, we analysed the exact entropy source – bash’s $RANDOM function – and built a mathematical model to predict its output.
What we found: VestaCP’s password reset tokens were generated using bash’s $RANDOM, which relies on a Linear Congruential Generator with only 32,768 possible seed values. We demonstrated that the effective seed space could be reduced by 98% using timing-based analysis, making brute-force of the admin reset token trivial. A single password reset request was enough to take over any VestaCP admin account within seconds.
Outcome: The vulnerability was responsibly disclosed and patched. The research was presented at BlueHat IL 2025 (Microsoft’s invite-only security conference in Tel Aviv), highlighting the real-world impact of weak entropy in security-critical functions.
Read the full technical advisory | BlueHat IL 2025 presentation | Services: Web App Pentesting, Network Pentesting
Feeld Dating App – Private Photos and User Data Publicly Accessible
Target: Feeld, a dating app with 2M+ users handling highly sensitive personal data including intimate photos, sexual preferences, and private messages.
What we did: We intercepted the app’s API traffic using Burp Suite and systematically tested every endpoint for access control flaws. We examined the GraphQL API, the Stream Chat integration, and the media storage endpoints – testing whether user authentication was properly enforced at each layer.
What we found: Eight critical broken access control vulnerabilities. Private nude photos and explicit videos were accessible without any authentication by manipulating API endpoint versions. We could read any user’s private messages, modify or delete other users’ messages, alter profiles, send fake likes from arbitrary accounts, and enumerate every user’s complete match list. The combination of these flaws meant an attacker could harvest intimate content and personal data at scale across the entire 2M+ user base.
Outcome: We reported all vulnerabilities to Feeld through responsible disclosure in March 2024. After repeated follow-ups over 6 months, Feeld confirmed fixes were implemented in August 2024. The research was publicly disclosed in September 2024, received significant media coverage, and was presented at DEF CON 33 in Las Vegas.
Read the full technical advisory | DEF CON 33 presentation | Services: Mobile Pentesting, API Pentesting
Concrete CMS – From File Upload to Full Server Compromise
Target: Concrete CMS, an open-source content management system used by organisations worldwide. We were engaged by PortlandLabs (the company behind Concrete CMS) for a penetration test of both the application and their hosting infrastructure.
What we did: Deep source code analysis combined with manual penetration testing. We reviewed the file upload handling, permission model, password reset flow, and server-side request handling – tracing each code path from input to execution to find exploitable weaknesses that black-box testing would miss.
What we found: Four vulnerabilities including a critical Remote Code Execution (RCE) chain (CVE-2021-22968). File extensions were validated after files were saved to disk, and the temporary directory names were predictable. By exploiting a double race condition, we achieved full server compromise from a low-privileged user account. We also found a privilege escalation that let an Editor inherit full Administrator access, an SSRF that could extract AWS IAM credentials from cloud instance metadata, and a password reset poisoning via Host header injection.
Outcome: PortlandLabs patched all vulnerabilities in versions 8.5.7 and 9.0.1, released within days of our report. Their CISO praised the engagement: “Our team was deeply impressed that the brothers identified vulnerabilities which could only have been found by a deep analysis of the source code.”
Read the full technical advisory (Part 1) | Part 2 | Services: Web App Pentesting, White Box Testing
cPanel/WHM – Stored XSS to Root-Level Server Compromise
Target: cPanel/WHM, the world’s most widely used web hosting control panel, powering millions of servers globally. A vulnerability here has massive supply-chain impact.
What we did: We tested the cPanel/WHM platform for vulnerabilities that could allow a reseller-level account to escalate to full root access. We examined the locale editor, WebSocket implementation, CSRF protections, and referrer policies – looking for ways to chain individually low-severity issues into a critical attack path.
What we found: A Stored XSS vulnerability in the locale editor that could be chained with the web terminal feature to achieve Remote Code Execution as root. We also discovered a second attack chain: by injecting a meta tag to change the referrer policy from “origin-only” to “unsafe-url”, we could leak CSRF tokens, hijack WebSocket connections to the web terminal, and achieve the same root-level compromise through a completely different path. Two independent chains to full server takeover.
Outcome: We reported all findings to cPanel. The XXE vulnerability was patched in their July update. The XSS was classified by cPanel as “intended behaviour” and remains unpatched – demonstrating why independent security testing matters even for mature platforms.
Read the full technical advisory | Services: Web App Pentesting, Network Pentesting
Monzo – Evaluating Banking App Security Against Mobile Theft
Target: Monzo and seven other UK banking apps. Someone steals a phone every 10 minutes in London – we tested what happens next. Most app pentests assume a remote attacker; we tested what a thief with physical access to an unlocked phone could do.
What we did: We simulated a one-day theft scenario across eight banking apps on iOS and Android – without jailbreaking. We evaluated authentication persistence, biometric fallback mechanisms, PIN recovery processes, and what data an attacker could access once past the lock screen. We also tested whether identity verification could be bypassed through impersonation.
What we found: Monzo’s app required re-authentication only every 90 days, meaning a stolen phone had near-permanent access. FaceID fell back to the device passcode after just one failed attempt when AppLock was enabled. Most critically, the video-based PIN recovery process was vulnerable to impersonation – we demonstrated a successful bypass using a sibling, gaining full access to the account including the ability to transfer funds.
Outcome: We disclosed the findings to Monzo in May 2024 and published the research in June 2024. The study highlighted a blind spot in most mobile security assessments: the physical theft threat model. Around 50% of people use the same PIN across their phone, apps, and bank cards – making this a real and widespread risk.
Read the full technical advisory | Services: Mobile Pentesting
Plesk – Compromising a Server Management Platform Through its REST API
Target: Plesk, a web hosting control panel with approximately 2 million installations in the US alone. Plesk holds 86.7% market share among websites using hosting panels – a vulnerability here affects a significant portion of the internet’s infrastructure.
What we did: We examined Plesk’s REST API for authentication and authorisation flaws, focusing on CORS configuration, CSRF protection, and the security of privileged API endpoints. Despite the platform’s source code being heavily obfuscated with custom PHP extensions, we identified critical weaknesses in how the API handled cross-origin requests.
What we found: Plesk’s API had a completely open CORS policy (wildcard origin), and multiple sensitive POST endpoints lacked CSRF protection. We demonstrated JSON-based CSRF attacks that could add secret authentication keys, create database users with remote access, add FTP users, upload malicious extensions, and – most critically – change the administrator password. A single malicious webpage visit by a logged-in Plesk admin was enough for full panel compromise.
Outcome: We disclosed the vulnerabilities to Plesk in May 2022. They confirmed and fixed the issues within three weeks. After a coordinated 6-month disclosure period, we published the research in November 2022.
Read the full technical advisory | Services: API Pentesting, Network Pentesting
LLM Prompt Injection and Data Leakage in Customer Support Platform
Client: AI startup that had integrated a large language model into their customer support platform, giving the LLM access to internal knowledge bases and customer records. They needed to validate security before public launch.
What we did: LLM security testing aligned to OWASP LLM Top 10, focusing on prompt injection, training data extraction, and privilege escalation through the model’s tool-use capabilities. We crafted adversarial prompts designed to bypass system prompt guardrails and access restricted data through both direct and indirect injection vectors.
What we found: We achieved indirect prompt injection through a crafted customer support ticket that caused the LLM to execute internal API calls and return other customers’ personal data. We also extracted significant portions of the system prompt, revealing internal API endpoints and access patterns that would give an attacker a roadmap for further exploitation.
Outcome: The client implemented input sanitisation, output filtering, and least-privilege API access controls. They redesigned the LLM’s tool-use permissions to follow a whitelist model and added monitoring for prompt injection patterns. The platform launched on schedule with significantly reduced risk.
Services: LLM Security Testing, API Pentesting
Every engagement includes detailed remediation guidance, developer walkthroughs, and free re-testing to verify fixes. Want to see what we’d find in your environment?
Book a Discovery Call to discuss your requirements and get a scoping estimate.
