nandsec

Penetration testing for
web applications

nandsec is an Australian security research and engineering lab. We analyse and test your environments, and design and build secure software, systems and infrastructure.

Invoice
requestBurp Repeater
GET /api/v2/invoices/7301 HTTP/1.1
Host: app.example.com
Authorization: Bearer [session of user 1042]
Accept: application/json
response200 OK
{
  "id": 7301,
  "customer_id": 1042,
  "customer": "Your company Pty Ltd",
  "total": "1240.00",
  "currency": "AUD",
  "bank_ref": "XXXX-4411"
}
Expected behaviour. Your own invoice is returned.

Our services

All services
Penetration Testing 10 services Penetration testing of web applications, APIs, cloud infrastructure, networks, mobile applications, wireless networks and thick clients. Security Architecture and Advisory 12 services We analyse your organisation's attack surface, design domain-specific threat models and build a secure architecture. AI and Agent Security 5 services We secure the AI coding tools and agents your organisation uses, and test their attack surfaces, such as prompt injection through untrusted input, excessive tool permissions and data leakage. Red Teaming and Forensics 4 services nandsec performs red and purple team engagements that simulate attacks against your organisation, to test what your defences detect and stop. We also perform forensic and malware analysis when you suspect a breach. Embedded and Firmware Security 5 services Firmware, kernel and driver security testing for embedded devices and Linux platforms. Security Engineering 6 services Secure computing environments: hardened Linux systems and workstations, Secure Boot, secure CI/CD pipelines, and remediation of findings from testing. Software Design and Engineering 7 services nandsec is focused on full-stack and systems programming, which enables us to build secure software using Rust, Go, Python, TypeScript and C. Applied Research 3 services nandsec is focused on security research in different domains, such as operating system security, memory safety, malware, firmware and AI agents.

About nandsec

nandsec has contributed fixes to the Linux kernel and reported a memory corruption vulnerability that led to remote code execution in a vendor's Android client. Current projects cover AI agents, full-stack development and Android.

About Sinan Turunc

Recent workAll research

Talk to us

Email [email protected] with what you need tested, built or reviewed, and your timeframe. We reply with a scoping outline. For sensitive discussions, or if you prefer, message us on Signal or SimpleX.