/root/jankesec :: pentest + vuln research

Notes from the unauthorized-looking side of authorized research.

Field logs for web application pentesting, vulnerability research, exploitability boundaries, and practical validation without the conference gloss.

Read posts About the site

Latest Drops

Write-ups, methodology notes, and vulnerability analysis from the lab.

Operating Areas

Precise, repeatable notes for work that happens below the glossy layer.

WEB_INTRUSION_NOTES Authentication, authorization, business logic, client-side flaws, and API attack paths. VULN_RESEARCH Root-cause notes, variant analysis, exploitability boundaries, and patch diffing. EXPOSURE_MAPS Asset discovery, cloud-native misconfiguration, identity paths, and external attack surface. FIELD_LOGS Reusable checklists, heuristics, tooling workflows, and lessons from authorized testing.

Projects

Open-source tools and research code.

evilcorp-ios

Intentionally vulnerable iOS application for mobile security training — 30 challenges across OWASP MASVS categories

ghostlink

Covert C2 channel over legitimate platforms — stealthy command and control for authorized red team ops

driftnet2

Network traffic interception and analysis toolkit — passive recon and protocol inspection

Latest CVEs

Vulnerabilities discovered during authorized security research.

CVE-2025-6577 9.8

SQL Injection (SQLi) — Akıllı Ticaret E-Commerce Website

CVE-2025-7744 9.8

SQL Injection (SQLi) — Dolusoft Omaspot

CVE-2025-7743 9.6

Cleartext Transmission of Sensitive Information — Dolusoft Omaspot

Index

Browse the archive by lane

Stay Updated

New research, straight to your feed.

Subscribe via RSS for vulnerability research, pentest methodology, and technical write-ups. Longer-form analysis also available on Substack.

Subscribe via RSS Substack