Research and write-ups
Practical guidance and notes from engagements and independent work.
A Defense-in-Depth Approach to Securing Production VPS Infrastructure
A full defense-in-depth model for hardening a production VPS, layer by layer, followed by an honest look at what current security research still hasn't proven about whether that model actually works as a system.
RTA’s Infrastructure: How Mateos Built the Infrastructure Behind It
Background & Origins How did you end up building a red team company if your role leans backend engineering? RTA needed real infrastructure to be credible: a bounty aggregator, a…
Inside the Mind of a Red Teamer: A Conversation with Orgito, Co-Founder & Security Researcher at…
Inside the Mind of a Red Teamer: A Conversation with Orgito, Co-Founder & Security Researcher at RTA Red Team Albania (RTA) is a new offensive security company built in Tirana,…
Red Team Albania: Building the Western Balkans’ Offensive Security Frontline
A Region Under Siege, and Why That Matters The Western Balkans is no longer a peripheral concern in the global cybersecurity conversation. It is a live battlefield. In the first…
I Built an AI-Powered Bug Bounty Assistant That Understands APIs Instead of Just Scanning Them
GitHub Link: https://github.com/orgito1015/APIScope-AI Every bug bounty hunter has experienced it. You open a new target, discover hundreds of API endpoints, import the…
Auditing Secure Firmware: The Concepts and the Discipline
Abstract Secure firmware — ARM Trusted Firmware-A (TF-A), TF-M, hypervisor monitors, boot ROM successors — sits at the top of a device’s privilege hierarchy and is one of the…
Vulnerability Testing — A Practical Guide to the Core Bug Classes and Advanced Techniques
Once reconnaissance is complete, the application has been mapped, and interesting endpoints have been flagged in Burp Suite, the real work of a bug bounty engagement begins:…
Horizontal vs. Vertical Privilege Escalation: A Practical Breakdown
Introduction Privilege escalation is the process by which an attacker (or a legitimate tester, in the context of authorized security assessments) gains access to resources,…
Cloudflare, WAF, and CDN Security: The Complete Picture
Part I covers what Cloudflare/CDN edge security is and how it works. Part II covers WAF classification mechanics, authorized assessment methodology, defensive tuning, and the…
CWE-918: SSRF — Advanced Techniques & Exploitation
1. VULNERABILITY OVERVIEW 1.1 What is CWE-918? Server-Side Request Forgery (SSRF) is a critical web security vulnerability where an attacker can induce the server-side application…
Authentication Vulnerabilities & Account Takeover in Bug Bounty Programs
Contents The ATO Attack Surface Credential-Based Attack Vectors Session Management Flaws Password Reset & Recovery Chains Multi-Factor Authentication Bypasses OAuth 2.0 / SSO…