Extract an IPA from an iPhone in one command
getIPA pulls an app off your own jailbroken iPhone and packages it as a decrypted IPA in one command. What you need, how to use it and why decryption matters.
Blog
Practical security notes
One practical note a week on application security, cloud, Active Directory and compliance, from the Rudranetra Research Team.
Kerberoasting explained for engineering managers
What Kerberoasting is, why it keeps showing up in Active Directory assessments, and the practical fixes engineering managers can prioritise this quarter.
Mobile apps storing secrets locally: why it matters
Anything a mobile app stores or ships can be read by someone holding the device. How secrets leak from iOS and Android apps, and safer ways to handle them.
JWT mistakes we see in real APIs
JSON Web Tokens are easy to adopt and easy to get wrong. These are the common JWT mistakes in APIs, why they matter, and how to fix each one properly.
What "retest included" should actually mean
Many pentest proposals promise a free retest. Here is what a useful retest covers, when to ask for it, and what evidence you should get back afterwards.
Why scanners miss broken authorization (and how testers find it)
Automated scanners rarely catch broken authorization. Here is why access control flaws slip past tools, and how a manual tester finds them instead.
Five things to fix before your first pentest
Five quick fixes that help your first penetration test focus on the issues that matter, from security headers to test accounts and secrets in code.
IDOR in multi-tenant SaaS: a plain-English explainer
What IDOR is, why it hits multi-tenant SaaS products so hard, and the practical steps engineering teams can take to stop one customer reading another's data.
Need a pentest for an audit, a customer, or peace of mind?
Tell us what you need tested. You’ll get a fixed-fee proposal with tester-days and timeline stated, usually within a few days of the scoping call.