The Attack Handbook

How we find what others miss.

Field notes from real engagements, written the way we work: find, prove, fix. Anonymised, technical, and organised by the class of bug so you can go straight to what matters. This is the thinking behind every Imperon Labs report.

Broken access control

The print button that skipped the bouncer

A BOLA hiding behind an export feature that never checked ownership.

BOLA

An employee who read the whole directory

Function level authorization missing on an admin only endpoint.

BFLA

The privilege escalation that wasn't

Why a promising bug was refuted, and what that discipline is worth.

privesc
Injection, SSRF & RCE

SSRF that actually matters

From a fetch primitive to cloud metadata and internal reach.

SSRF

Hunting RCE in modern stacks

Where remote code execution still hides in current frameworks.

RCE

HTTP request smuggling

When front end and back end disagree about where a request ends.

smuggling
Authentication & client side

Stored XSS to account takeover

A support widget that carried a payload straight to the admin.

XSSATO

A note from an employee, a cookie from the boss

Session and trust boundaries that did not hold.

session
Business logic & architecture

Business logic flaws

The bugs no scanner has a signature for.

logic

Reviewing a fintech architecture

Walking a payment platform end to end, every seam where money and trust cross.

architecture

Securing fintech payments

Where value moves, and where it can be diverted.

fintech

Threat modeling that ships

Threat models engineers actually use, not a diagram in a drawer.

threat model
Mobile

A mobile app testing methodology

How we take a mobile app apart, from binary to backend.

mobile

Auditing a React Native binary

Pulling logic and secrets out of a shipped app bundle.

React Native
Network & infrastructure

From a locked down Citrix desktop to a domain shell

Breaking out of a restricted environment into the wider network.

networkAD
Method & craft

Fuzzing that finds bugs

Making fuzzing productive instead of noisy.

fuzzing

Retesting a fixed program

Why proven closure, not a green tick, is the real deliverable.

retest
Find out before they do

Want this on your product?

This is how we test. Point us at the asset that keeps you up at night and we will get to work this week.

Start a hunt