Free Consultation
Home
VAPT Web Application PentestAPI PentestMobile App PentestInfrastructure PentestAI & LLM PentestOT / ICS PentestIoT PentestPenetration TestingAll VAPT services
Red Team Red Team EngagementAdversary SimulationAssumed BreachPurple TeamingSocial Engineering
Sectors Banking & Financial ServicesGovernment & Public SectorHealthcareOil, Gas & EnergyAviation & LogisticsRetail & E-commerceManufacturing & IndustryTelecommunicationsTechnology & SaaS
CompanyResourcesBlogFree Consultation

Field notes

The RedTeam Security blog

How engagements actually run, what UAE regulators are asking for, and the parts of this work nobody puts in a brochure. Written by the people who run the engagements.

A lone operator silhouetted at a terminal in a darkened room.

More articles

RSS
Buying adviceA glowing filament sphere wired to a row of tool sockets and a stack of indexed documents, one wire lit red where it meets a locked vault under a magnifying lens

How to buy an AI and LLM pentest: the layers to scope, what to hand over and what the proposal must say

How to scope and buy an AI and LLM pentest: the five layers to name, what to hand over, how to read the proposal and what the report must give you.

Joel Aviad OssiJoel Aviad OssiRed Team Lead, RedTeam Security
7 min read
Offensive securityA dark RedTeam Security banner with CVE-2026-24061 in large crimson text, a critical 9.8 badge, fine network traces and a restrained terminal frame.

CVE-2026-24061: GNU Inetutils telnetd root login bypass

Technical analysis of CVE-2026-24061, the GNU Inetutils telnetd authentication bypass caused by USER=-f root, including patches and detection.

Joel Aviad OssiJoel Aviad OssiRed Team Lead, RedTeam Security
9 min read
MethodologyA dark isometric scene of three smartphones at different heights, each running a thin red line to one server block; two lines end at a red barrier before the server and one passes through to a lit port.

Retesting a mobile app fix: the build the tester checked is not the build users run

A mobile app fix ships in a store build users may not install. How a pentest retest verifies the fix, the minimum version gate and the old builds left behind.

Joel Aviad OssiJoel Aviad OssiRed Team Lead, RedTeam Security
7 min read
DetectionA dark isometric scene: a smartphone on the left joined by glowing red lines to a server block on the right, where a brass listening horn and a lens inspect the incoming lines, most dim and one lit red.

What your backend should catch during a mobile app pentest

Detection during a mobile app pentest is server-side. What your API logs should show while it runs, and how to sort the gaps by cost and impact.

Joel Aviad OssiJoel Aviad OssiRed Team Lead, RedTeam Security
8 min read
MethodologyAn isometric workbench on a dark ground holding three connected objects: a sealed app package on the left, a phone in the centre opened to show storage layers, and a server block on the right, joined by thin glowing

How a mobile app pentest is run: app, device and backend

How a mobile app pentest is run, from preparing devices to static and dynamic analysis and the backend API, and what to have ready before it starts.

Joel Aviad OssiJoel Aviad OssiRed Team Lead, RedTeam Security
8 min read
Offensive securityA row of isometric objects on a dark background: a smartphone with file cards and a small database drum spilling out of it, joined by glowing red lines to a laptop holding a key, showing data moving off the phone.

What a mobile app leaves on the phone: tokens in clear text

Session tokens a mobile app writes to shared preferences or a local database in clear text can be read off the phone and replayed against the API.

Joel Aviad OssiJoel Aviad OssiRed Team Lead, RedTeam Security
8 min read
Offensive securityAn isometric row of red-lit objects: a smartphone with a broken padlock over its screen, a glowing line running to a server rack, and a document sliding out of the server back toward the phone.

Breaking the pin: reading a mobile app's API traffic

How an operator bypasses a mobile app's certificate pinning, reads the API traffic, and confirms the backend authorization flaw the app was hiding.

Joel Aviad OssiJoel Aviad OssiRed Team Lead, RedTeam Security
8 min read
Offensive securityA left to right row of isometric objects on a dark field: a workstation, a domain controller issuing a glowing red ticket, and a padlock breaking open into a key, joined by red flow lines.

Kerberoasting: cracking service accounts offline

How Kerberoasting turns one domain login into a cracked service account password, the offline attack chain step by step, and the controls that stop it.

Joel Aviad OssiJoel Aviad OssiRed Team Lead, RedTeam Security
8 min read
Offensive securityAn isometric workstation on the left joined by glowing red lines to a certificate authority server bearing a seal and a domain controller, with a small certificate document travelling back along the line toward the

ADCS ESC1: the certificate template that hands out domain admin

How an AD CS template that lets a user set its own subject turns a domain account into domain admin, how to find it, and the flag that closes it.

Joel Aviad OssiJoel Aviad OssiRed Team Lead, RedTeam Security
8 min read
Buying adviceAn isometric network in two zones: an external gateway facing the internet, and internal servers behind a segmentation wall, with a magnifying lens over a few internal hosts and red lines tracing a path between them.

How to buy an infrastructure pentest: external, internal and depth

What an infrastructure pentest buys you, how external and internal scopes differ, and what sets the price before you sign.

Joel Aviad OssiJoel Aviad OssiRed Team Lead, RedTeam Security
8 min read
Offensive securityA row of glowing isometric objects on a dark grid: a workstation, a tall domain controller rack, and a metal padlock splitting open, joined left to right by red flow lines.

AS-REP roasting: the accounts that skip Kerberos pre-authentication

How AS-REP roasting turns accounts that skip Kerberos pre-authentication into crackable hashes, sometimes with no credential, and how to stop it.

Joel Aviad OssiJoel Aviad OssiRed Team Lead, RedTeam Security
7 min read
Offensive securityA row of isometric machines joined by glowing red lines: a workstation sends a login toward an intercepting node, which forwards it on to a server, with one link along the path drawn as broken.

LLMNR poisoning to SMB relay: a login with no password cracked

How an attacker on the LAN answers Windows name lookups, captures a NetNTLMv2 response and relays it to a host without SMB signing for code execution.

Joel Aviad OssiJoel Aviad OssiRed Team Lead, RedTeam Security
8 min read

Let's talk about your security

Tell us the objective you want tested. We will come back with a scope, a timeline and a quote.

Email [email protected]
IFZA Business Park, Building A2
Nadd Hessa, Dubai Silicon Oasis
Dubai, United Arab Emirates