x2r0 lab eXploit → Root ∅

$ cat /about

About

x2r0 lab is the independent research home of x2r0 — a security professional with 10+ years in the field, working primarily in offensive security and vulnerability research.

I started out in security research, including peer-reviewed published work, then moved into consultancy — running offensive engagements and vulnerability research across regulated, high-stakes industries: telecommunications, energy, and insurance. Alongside breaking systems, I've built the other side too: standing up security programs and strengthening cyber resilience for organizations that can't afford to get it wrong. Today I work in-house securing an emerging European fintech.

x2r0 lab is separate from all of that. It's my personal project for independent vulnerability research — the bugs I find on my own time, the techniques worth writing down, and the small tools that come out of the work. Opinions and findings here are my own and not those of any employer.

What I work on

Over the years I've worked across most of the stack:

  • Web & API application security — auth, access control, business logic.
  • Source-code auditing & patch-gap analysis — reading the code, diffing the fix.
  • Cloud & infrastructure — misconfiguration, identity, container and platform security.
  • Reverse engineering & protocol internals — binary analysis, low-level and protocol weeds.
  • Telecom security — the networks and protocols underneath everything else.

The through-line is offensive: finding the thing that shouldn't be reachable, and proving it.

What you'll find here

  • Write-ups — vulnerabilities walked end-to-end: root cause, exploitation path, fix.
  • Research notes — shorter digs into a primitive, a protocol quirk, or a tool.
  • Tools — small, focused utilities that fall out of the research.

Contact

PGP

For sensitive reports, encrypt to my PGP key — /pgp.txt:

DE51 B04D CDFE 7565 6A18 6784 387E DC88 663A 8F29

Disclosure

If you've found something exploitable in anything I publish here (this site, a tool, a project), please report it responsibly to security@x2r0lab.com (PGP-encrypted preferred) before public disclosure. Standard 90-day timeline; faster if it's actively exploitable. A machine-readable contact is also published at /.well-known/security.txt.