https://labs.cognisys.group/Welcome to the Cognisys.co.uk Technical Blog, your go-to resource for cutting-edge research, CVEs, lab write-ups, and remediation advice. Stay informed, gain insights, and fortify your cybersecurity defences. 2026-05-26T12:50:40+00:00 Cognisys Group https://labs.cognisys.group/ Jekyll © 2026 Cognisys Group /assets/img/favicons/favicon.ico /assets/img/favicons/favicon-96x96.png 2026-05-26T12:45:00+00:00 2026-05-26T12:50:15+00:00 https://labs.cognisys.group/posts/Breaking-Tenant-Boundaries-When-Path-Traversal-Isn't-About-the-Filesystem/ Rajveer

Multi-tenant SaaS applications are a tricky beast. From the outside, they look like a single product, but underneath the surface, they’re hosting data and configurations for dozens, hundreds, sometimes thousands of separate organisations. Every request that hits the backend has to know which tenant it belongs to and what data it should be allowed to touch. When that boundary is enforced cleanly...

2026-05-12T11:55:00+00:00 2026-05-12T11:55:00+00:00 https://labs.cognisys.group/posts/Keys-to-the-Kingdom-Live-Stripe-Credentials-Exposed-via-Unauthenticated-OAuth-Endpoint/ Sunand

There is a particular category of finding that stops you mid-test. Not because it is technically complex, but because of what you are looking at. A single unauthenticated GET request that returns live payment credentials for a platform processing real customer transactions is one such finding. This is the account of a critical information disclosure vulnerability identified during a black-box ...

2026-04-17T11:55:00+00:00 2026-04-17T12:23:52+00:00 https://labs.cognisys.group/posts/Beyond-the-Perimeter-How-an-On-Premises-Domain-Admin-Compromise-Unlocked-the-Cloud/ Manan

Imagine a standard Red Team engagement scenario. Where you somehow manage to compromise a single low-privileged on-premises user. You execute a series of classic post-exploitation manoeuvres: moving laterally, exploiting legacy configurations, and navigating internal network segments. Finally, the “Holy Grail” is achieved, YESS! Domain Admin privileges within the internal Active Directory fores...

2026-04-14T14:10:00+00:00 2026-04-14T14:10:00+00:00 https://labs.cognisys.group/posts/Citrix-Breakout-When-Restricted-Means-Nothing/ Pratik

Cognisys was presented with a challenge: A locked-down Citrix environment. After logging into the machine, Cognisys was dropped onto a standard Windows desktop, but with significant restrictions. The goal was simple: Open the Command Prompt. The result? A flat denial. Similarly, attempting to launch PowerShell yielded the same result, the application was blocked. Cognisys was tasked with determ...

2026-03-23T14:10:00+00:00 2026-03-23T16:43:59+00:00 https://labs.cognisys.group/posts/Turning-Email-Template-Injection-into-Remote-Code-Execution/ Rajveer

Modern web applications rely heavily on automation. Email notifications, document processing alerts, and password recovery workflows are all common features designed to improve usability and streamline operations. Behind the scenes, these features often rely on dynamic templates that allow applications to insert variables into messages before they are sent to users. While these templating mech...