Curated security research, vulnerabilities, advisories and tools for practitioners.

labs.cognisys.group

Security coverage collected from labs.cognisys.group.

1.

Breaking Tenant Boundaries, When Path Traversal Isn't About the Filesystem

blog | 2026-05-26 12:45 | labs.cognisys.group | original ↗ | #data-exposure | #path-traversal | #saas

2.

Keys to the Kingdom Live Stripe Credentials Exposed via Unauthenticated OAuth Endpoint

blog | 2026-05-12 11:55 | labs.cognisys.group | original ↗ | #information-disclosure | #api-security | #oauth

3.

Beyond the Perimeter How an On-Premises Domain Admin Compromise Unlocked the Cloud

research | 2026-04-17 11:55 | labs.cognisys.group | original ↗ | #cloud | #cloud-security | #active-directory

4.

Citrix Breakout When Restricted Means Nothing

blog | 2026-04-14 14:10 | labs.cognisys.group | original ↗ | #windows | #red-team | #citrix

5.

Turning Email Template Injection into Remote Code Execution

vulnerability | 2026-03-23 14:10 | labs.cognisys.group | original ↗ | #rce | #pentesting | #web-security

6.

The Golden Role How a Simple API Logic Flaw Unlocked an Entire SaaS Platform

blog | 2026-03-17 09:10 | labs.cognisys.group | original ↗ | #pentesting | #access-control | #privilege-escalation

7.

When JavaScript Chunks Become Keyholes to the Cloud

blog | 2026-03-11 09:10 | labs.cognisys.group | original ↗ | #cloud | #cloud-security | #pentesting

8.

Apache Proxy Paradox CVE-2021-40438

vulnerability | 2026-03-06 09:10 | CVE-2021-40438 | labs.cognisys.group | original ↗ | #cloud | #pentesting | #apache

9.

Supabase Leaks, What We Found

blog | 2026-02-02 09:10 | labs.cognisys.group | original ↗ | #cloud-security | #pentesting | #account-takeover

10.

Deep Analysis of the Malicious AppleScript Payload (MacSync Stealer)

blog | 2026-01-08 09:10 | labs.cognisys.group | original ↗ | #threat-intelligence | #macos | #malware-analysis

11.

Certified Red Team Operator Certificate Review

blog | 2025-07-10 09:10 | labs.cognisys.group | original ↗ | #active-directory | #certification | #red-team

12.

OffSec Web Expert (OSWE) - Review

blog | 2025-06-10 09:45 | labs.cognisys.group | original ↗ | #certification | #code-review | #web-security

13.

Exploring HTB Prolab Dante - A Technical Review + Tips

blog | 2024-07-01 09:45 | labs.cognisys.group | original ↗ | #pentesting | #red-team | #training

14.

How to Decompile a Hermes React Native Binary (Android Pentest)

blog | 2024-05-22 03:04 | labs.cognisys.group | original ↗ | #pentesting | #android | #reverse-engineering

15.

Breaking Custom Encryption Using Frida (Mobile Application Pentesting)

blog | 2024-04-17 04:00 | labs.cognisys.group | original ↗ | #pentesting | #android | #mobile-security

16.

Burp Suite Certified Practitioner Exam (BSCP) Review

blog | 2023-09-14 04:00 | labs.cognisys.group | original ↗

17.

Breaking Login Pages

blog | 2023-08-31 04:00 | labs.cognisys.group | original ↗

18.

Securing the Insecure Objects

research | 2023-08-23 01:00 | labs.cognisys.group | original ↗ | #pentesting | #access-control | #web-security

19.

An Interesting XSS-Bypassing WAF

vulnerability | 2023-07-26 10:04 | labs.cognisys.group | original ↗ | #pentesting | #web-security | #xss

20.

Advanced Module Stomping & Heap/Stack Encryption

blog | 2023-07-25 04:40 | labs.cognisys.group | original ↗ | #windows | #red-team | #memory-encryption

21.

Writing your first Frida script for Android

blog | 2023-07-19 08:45 | labs.cognisys.group | original ↗ | #android | #mobile-security | #tutorial

22.

Combining Indirect Dynamic Syscalls and API Hashing

blog | 2023-07-13 03:40 | labs.cognisys.group | original ↗ | #windows | #red-team | #evasion