OSEC / ENTRY POINT
How exposed
are you?
SCROLL / DISCOVER
01
SCOPE
Define objectives, assets, boundaries and constraints.
How exposed
01 / Attack surface
Where would
you test first?
Instead of presenting a catalogue of services, start with the system. Choose the surface that matters and the relevant assessment appears in context.
01 / EXTERNAL
Outside the perimeter
Internet-facing infrastructure, perimeter controls and externally reachable services.
02 / APPLICATIONInside the application
Web applications, APIs, authentication, authorization and application logic.
03 / INTERNALBehind the boundary
Internal networks, identity environments and Active Directory attack paths.
04 / INFRASTRUCTUREUnder the system
Cloud environments, hosts, configurations and containerized infrastructure.
02 / Discovery
We don't count
vulnerabilities.
We investigate whether weaknesses form meaningful paths through a system — and what those paths could allow an attacker to achieve.
01What is visible?MAP
02What can be reached?TRACE
03What can be exploited?VALIDATE
04What is the impact?ASSESS
REPRESENTATIVE
ATTACK PATH ENTRY → ACCESS
ACCESS → IMPACT
ATTACK PATH ENTRY → ACCESS
ACCESS → IMPACT
03 / Validation
From signal
to evidence.
A rigorous engagement model designed for real-world offensive telemetry and verifiable attack vector validation.
02
DISCOVER
Map services, paths, identities and dependencies.
03
VALIDATE
Test whether weaknesses create realistic attack paths.
04
UNDERSTAND
Establish practical impact and remediation priority.
05
REMEDIATE
Give technical teams a clear route to improvement.
04 / Output
A report should
lead to action.
OSEC.uz's positioning emphasizes actionable remediation. The interface makes that outcome tangible rather than treating the report as the end of the engagement.
Critical exposurePRIORITY 01
Attack pathVALIDATED
Technical evidenceATTACHED
RemediationRECOMMENDED
ASSESSMENT / FINDING 01OSEC
High-impact exposureAttack path validated against scoped environment.
05 / Field notes & blog
Exploits, research
& tactical findings.
Technical writeups, novel tradecraft, vulnerability advisories, and defensive bypass analyses.
All Blog Posts →MediaTek BROM orqali Android Gatekeeper Pattern Extraction (Redmi 9A Forensics)
MediaTek chipsetli Android (Redmi 9A) qurilmalarida MTKClient va BROM rejimi orqali to'liq userdata.img dumpini olish, Gatekeeper credential materiallarini ajratish va offline pattern tahlili.
Gov't website has been taken down by hackers
Team_CC allegedly hacked one of the subdomains of Niger gov't website
Bypassing Modern EDR Hooks via Direct Syscalls & Synthetic Stack Frames
Analyzing user-mode API unhooking, dynamic SSN resolution via HalosGate, and synthetic stack spoofing to defeat call-stack telemetry in modern Windows endpoints.
06 / Our tribe
The people behind
the offense.
A small, focused collective of operators, researchers and exploit developers.
Meet the tribe →
Sardor G'ulomjonov
AppSec / Penetration Tester2 years of total professional experience. Currently works at Davr Bank as an AppSec / Penetration Tester.
Ibrohim Akbarov
Penetration Tester7 months as Security Developer at a consulting firm (penetration testing), a 2-month penetration testing internship at the Ministry of Internal Affairs, and 7 months as Chief Cybersecurity Specialist at the State Tax Committee.
Hack The Box Mini Pro Labs: Solar ↗
Hidoyatxon Atabaev
Vibe Hacker / DeveloperDeveloper and vibe hacker, building tooling and finding weaknesses with an AI-assisted workflow.
07 / Secure communications
Let's find
the weakness.
Discuss scope, requirements, assessment objectives or engagement timelines directly with OSEC.uz.
Services: Penetration testing · Red teaming · Attack surface validation · Vulnerability research