Web Security
Testing authentication, access control and business logic across modern web apps and APIs. Focused on IDOR, broken access control and credential exposure.
offensive security · malware development · red teaming
z3vxo
I'm a security researcher working across web application security, malware development, and red team operations. I build offensive tooling, break access control, and document what I find.
01 / capabilities
What I do
Offensive security across the web layer, the endpoint, and the infrastructure behind it.
Malware Development
Building offensive tooling from the ground up — C2 frameworks, loaders and Windows internals for red team engagements.
Red Teaming
Adversary simulation from initial access through post-exploitation, including redirectors, C2 infrastructure and operational security.
02 / disclosure
Selected findings
Vulnerabilities identified during security research. Most organisations are anonymised; named findings were disclosed through official vulnerability disclosure programs.
DEWR
Department of Employment and Workplace Relations · Official VDP
Broken access control · information disclosure
- The production API returned the full account list without authentication, including names, emails, ABNs and physical addresses.
- The pre-production environment allowed open self-registration without Digital ID and granted sessions access to sensitive contact and account APIs.
- Publicly exposed CIAM API documentation revealed DEWR's identity infrastructure, including invitation, passkey and B2C tenant operations.
- Affected the Federal Safety Officer Online portal used by accredited users and companies.
Online training provider
IDOR · broken access control · hard-coded AWS keys
7.4M files
~650K users
- IDOR in the documents API exposed approximately 7.4 million files spanning 2014–2026, including resumes, assessments, voice and video uploads, USI numbers and education records.
- IDOR in the meeting and communication endpoints leaked user details and allowed arbitrary email sending.
- Hard-coded AWS keys in client-side JavaScript allowed listing and overwriting compliance documents in S3.
- Broken access control exposed the entire user base through a list endpoint.
- Affected users included welfare recipients across two platforms, approximately 650,000 accounts.
DCCEEW
Department of Climate Change, Energy, the Environment and Water · Official VDP
IDOR · authorization bypass
- IDOR in the Invoice Payment System allowed any authenticated user to retrieve other customers' invoices by changing a sequential invoice ID.
- The ownership check could be bypassed by supplying an empty accountNumber parameter.
- Exposed invoice amounts, payment status, customer reference numbers and PDFs containing company and buyer details.
- The issue was present in both production and pre-production environments.
Named findings were disclosed through official VDPs. No user data or exploit details are published.
Notes from the field
Write-ups on networking, malware development and offensive security.