PentestLab Team.
We break things for a living. 10+ years of offensive security research, red team engagements, and CVE disclosures — documented here so the community learns faster than attackers do.
Who We Are
PentestLab is a team of senior penetration testers and security researchers with a combined 30+ years of offensive security experience. We’ve broken into everything from Fortune 500 web applications to industrial IoT gateways — and we document every technique here.
Our Specialisms
| Domain | Focus Areas | Experience |
|---|---|---|
| 🌐 Web App Security | OWASP Top 10, OAuth abuse, API security, IDOR | 10+ yrs |
| 🖥️ Network / Infra | AD attacks, lateral movement, cloud pivoting | 12+ yrs |
| 🔧 IoT & Embedded | Firmware RE, UART/JTAG, BLE, radio protocols | 7+ yrs |
| 📱 Mobile Security | Android/iOS, OWASP MASVS, frida, bypass | 6+ yrs |
| 🎣 Phishing / Awareness | Red team phishing, vishing, pretexting simulations | 8+ yrs |
Why This Blog
Most security blogs either stay surface-level or hide the good stuff behind consulting fees. We disagree. Deep technical knowledge shared openly makes the entire ecosystem stronger — defenders learn the real attack paths, and attackers have fewer dark corners to hide in.
Every post here is written by practitioners who ran the attack in a real engagement or controlled lab — not aggregated from other blogs.
Get In Touch
- Twitter / X: @subliminal_web
- GitHub: github.com/subliminal-web
- HackerOne: hackerone.com/subliminal-web
- Email: hello@pentestlab.example.com (PGP key available)
- Consulting: Available for engagements — reach out
“The attacker only needs to be right once. The defender needs to be right every time. We exist to close that gap.”
Let's Work Together
Available for red team engagements, penetration tests, and security research consulting.
Get In Touch