Find the weak spot before someone else does.
Cybox1 is an Indonesian cybersecurity company. We test and monitor systems for organisations, train the people who defend them, and are building a breach checker for Indonesian data leaks.
Broken access control on invoice download
Endpoint unduh faktur tidak memeriksa kepemilikan. Pengguna yang sudah login dapat mengganti parameterid dan mengunduh faktur milik pelanggan lain.
Perbaikan. Pastikan di sisi server bahwa faktur milik pengguna pada sesi tersebut sebelum berkas dikirim.
The invoice download endpoint does not check ownership. A logged-in user can change the id parameter and download invoices that belong to other customers.
Fix. Check on the server that the invoice belongs to the session's user before returning the file.
Two kinds of work, one team.
Offensive testing and defensive monitoring for companies. Practical training for the people who will do that work next.
For organisations
Breach Check: has your data leaked in Indonesia?
Global breach checkers miss most local leaks. We are building one that tracks breaches affecting Indonesian services, checks emails, usernames, and credentials against them, and explains the risk in Bahasa Indonesia.
How Breach Check will workFrom scope to retest, nothing left vague.
- 01
Scope
We agree in writing what is in bounds, which accounts we get, and who to call if we find something critical mid-test.
- 02
Test
Manual testing backed by tooling. Logic flaws and access control issues need a person, not just a scanner.
- 03
Report
Every finding has severity, CVSS, reproduction steps, and a fix, in Bahasa Indonesia and English.
- 04
Walkthrough
We go through the report with your developers so nobody has to guess what a finding means.
- 05
Retest
After you fix, we test again and confirm the hole is actually closed.
The fastest way to learn defence is to practise attack.
Our courses run in labs where you exploit real vulnerabilities, then fix them. CTF coaching takes the same skills into competition, where time pressure and teamwork matter as much as technique.
- Students
- Build a foundation and a CTF habit before your first job.
- Professionals
- Add offensive and SOC skills to an IT or development role.
- Enterprises
- Private training for your security or engineering team, shaped around your stack.
Security research, news, and guides.
Tell us what needs testing, watching, or teaching.
Write to us in Bahasa Indonesia or English. A person on our team reads every message.