A practice of ITECZ Solutions

We break it before attackers do.

Offensive security from operators who think like adversaries. We find real, exploitable vulnerabilities across your web apps, APIs, mobile and cloud — prove the impact, and hand you a clear, prioritised fix for every single one.

See what we find Request a test
2,000+Vulnerabilities found
RCE→LowFull severity range
100%With a proposed fix
OWASPTop 10 & beyond
Scope

What we test

Full-stack offensive coverage — manual, depth-first testing backed by automation, never just a scanner.

Web applications

Modern SPAs, dashboards and portals — auth, sessions, access control, injection and business-logic abuse.

REST & GraphQL APIs

Broken object-level authorization (BOLA/IDOR), mass assignment, rate-limit and token flaws across every endpoint.

Mobile apps

iOS & Android — insecure storage, traffic interception, hardcoded secrets, jailbreak/root and backend abuse.

Cloud & infrastructure

AWS, Azure & GCP misconfigurations, IAM escalation, exposed services, container and network segmentation.

Source-assisted review

Grey/white-box testing — we read the code to find the flaws black-box testing alone would miss.

Thick clients & more

Desktop apps, internal tooling and integrations — wherever untrusted input meets sensitive operations.

Findings

2,000+ vulnerabilities, every class

A representative slice of what we've identified and responsibly disclosed across engagements.

Critical

Remote Code Execution

Command & code injection, unsafe deserialization and file-upload chains that hand an attacker the server.

Critical

SQL Injection

Classic, blind and second-order SQLi exposing entire databases — credentials, PII and financial records.

Critical

Authentication Bypass

Logic flaws, weak token handling and SSO gaps that let attackers log in as anyone, including admins.

High

IDOR / Broken Access Control

Object references and missing authorization checks exposing other tenants' data and actions.

High

SSRF

Server-side request forgery pivoting into internal networks and cloud metadata for credential theft.

High

Stored & Reflected XSS

Cross-site scripting enabling session theft, account takeover and admin-panel compromise.

High

Privilege Escalation

Horizontal and vertical escalation through role confusion, mass assignment and insecure defaults.

Medium

XXE & Injection

XML external entity, template, header and LDAP injection surfacing data and internal resources.

Medium

CSRF & Session Flaws

Cross-site request forgery, fixation and weak cookie/JWT handling enabling unwanted actions.

Medium

Business-Logic Abuse

Price tampering, workflow bypass, race conditions and replay that scanners simply never catch.

Low

Sensitive Data Exposure

Information disclosure, verbose errors, secrets in responses and misconfigured storage.

Low

Security Misconfiguration

Missing headers, weak TLS, default credentials and over-permissive CORS hardened to best practice.

How we work

A disciplined methodology

Aligned to OWASP, PTES and NIST — repeatable, evidence-driven, and built around clear communication.

Scope & recon

We agree rules of engagement, then map every asset, entry point and technology in your attack surface.

Manual testing

Depth-first manual exploitation across the OWASP Top 10 and beyond, backed by tooling — not a scan-and-go report.

Proof of concept

Every finding is demonstrated with a safe, reproducible PoC so impact is undeniable, not theoretical.

Severity & triage

Each issue is scored with CVSS and ranked by real business risk, so you fix what matters first.

Remediation & patch

We don't stop at "you're vulnerable" — every report ships with a concrete, developer-ready fix.

Free retest

Once you've patched, we re-test to confirm the fix holds and nothing new was introduced.

Case studies

Real findings, responsibly disclosed

A selection of vulnerabilities our team has discovered and reported through coordinated disclosure and managed bug-bounty programmes — spanning enterprise software, applied cryptography, Web3 and APIs. We withhold every client and vendor name; the security details are exactly as reported.

Critical · CVSS 9.1 Web3 Decentralised oracle network Smart contract · Solana

Missing forwarder validation let a price oracle be fed arbitrary data

Decentralised price oracles are only as trustworthy as the data path behind them. In a leading oracle network's on-chain program, the instruction that sets the “forwarder” a price feed trusts accepted any executable program without validation — so a compromised owner could route through an attacker-controlled program, bypass the oracle's signature and consensus checks, and inject arbitrary prices into every protocol downstream. Identified during smart-contract review and reported through the program's coordinated disclosure.

CVSS 9.1Rated Critical
Price feedsOracle manipulation
Sig + consensusBypassed
High · CVSS 7.1 United States Stablecoin & payments Smart contract

Revoked delegates could still burn a depositor's tokens

A major stablecoin and payments provider's on-chain wallet lets users delegate spending authority — and revoke it. We found revocation was only skin-deep: removing a delegate flipped their status to “revoked”, but the burn path still accepted them, so an address whose access had been explicitly cut off could keep burning the depositor's tokens. A second finding covered missing input validation in their cross-chain transfer code. Both reported through the program.

2Findings reported
Burn bypassRevoked delegates
Solana + StarknetPrograms reviewed
High Web3 Cross-chain bridge Smart contract

Inverted error handling in a bridge risked permanent loss of bridged BTC

A cross-chain bridge moving Bitcoin between networks — code where one inverted condition can be catastrophic. In the contract callback that finalises a mint, the success and failure paths were swapped: a deposit could be acknowledged as complete while the underlying BTC was effectively lost for good. Identified during smart-contract review and reported through the protocol's coordinated disclosure.

BTCPermanent-loss risk
Mint callbackInverted error handling
Cross-chainBridge logic
Switzerland National e-voting Cryptography review

Cryptographic flaws that could undermine ballot secrecy in a national e-voting system

In a national e-voting system, the maths is the security — ballots stay secret only if the cryptography is exact. Reviewing the protocol implementation, we found the primality testing drew its witnesses from the wrong range, collapsing effective entropy from thousands of bits to a handful, plus a missing primality check that could let an attacker weaken the encryption protecting vote secrecy. Reported through the system's public disclosure programme.

~11.6 bitsEffective entropy (from ~3072)
Vote secrecyEncryption weakened
2Cryptographic flaws
United States NFT marketplace API security

API introspection and an auth-gateway bypass exposed a marketplace's internals

A leading NFT marketplace running a large GraphQL and gRPC backend. Schema introspection was left enabled, exposing 93 mutations and leaking internal user flags — staff and reward-ban status — for any address; separately, a gasless order-cancel path bypassed the auth gateway to reach a backend gRPC service directly. We also surfaced withdrawal logic that could strand funds. All reported through the marketplace's managed bug-bounty programme.

93GraphQL mutations exposed
Auth bypassTo backend gRPC
Internal flagsLeaked per address
Medium · CVSS 5.3 United States Digital identity Smart contract

Nullifier reuse let one identity proof verify many wallet addresses

A digital-identity platform built on proof-of-personhood, where each identity should sign up exactly once. We found a verification registry that consumed its nullifier on a time-bound basis instead of permanently — so a single identity proof could verify a fresh wallet address every verification window, undermining the one-person-one-proof guarantee the whole system rests on. Rated Medium and reported through the program.

1 proofMany verifications
Nullifier reuseSybil resistance
Per-windowRe-verification
Germany File sync & share Web + API

Insecure object references exposed private drive data in a file-sync platform

An enterprise file sync-and-share platform — the kind organisations self-host to keep sensitive documents off the public cloud. Probing its web and API surface, we found an insecure direct object reference in the drive API that disclosed other users' drive information, plus a broken access-control flaw on an external-storage endpoint driven by a user-supplied identifier. Both reported through the vendor's coordinated disclosure programme.

IDORDrive data disclosure
Broken access controlExternal storage
2Findings reported
High · CVSS 7.3 United States Gaming Web app

Client-side credential exposure opened telemetry injection and flag enumeration

A major game developer's web application quietly leaked its own attack surface. The frontend exposed third-party service credentials — an error-tracking DSN and a feature-flag client-side ID — inside a global JavaScript object, letting an attacker inject misleading telemetry into the company's monitoring and enumerate internal feature-flag configuration without authentication. Rated High (CVSS 7.3) and reported through the program.

window objectLeaked credentials
TelemetryInjectable, unauthenticated
Feature flagsEnumerable
Web3 DeFi yield Smart contract

An unbounded fee could brick vault withdrawals and lock user funds

A multi-chain DeFi yield protocol where users lock assets in vaults to earn. In the vault fee logic, a flat fee with no upper bound meant an admin — or a misconfiguration — could set a fee large enough to make every withdrawal revert, bricking the vault and trapping user funds inside it. Surfaced through source-level smart-contract review and reported to the protocol.

Unbounded feeBricks withdrawals
User fundsLocked in vault
Vault fee logicReview finding

A note on confidentiality. We never name the organisation behind a finding. Where it sharpens the picture we give the sector and region only — and any severity ratings shown are the ones assigned during triage.

Beyond the report

We don't just find it — we tell you how to fix it.

Anyone can run a scanner and hand you a wall of red. For every vulnerability we identify, we deliver the root cause, a working proof of concept, the business impact, and a developer-ready remediation — the exact code-level or configuration change that closes it. Then we retest, free, to prove it's gone.

Find out what an attacker would.

Tell us what you'd like tested — a web app, an API, your cloud, or the whole stack. We'll scope it and get started.

support@itecz.com.au ITECZ Solutions