PRINCIPLE 01
Led by people, assisted by tools
Scanners find the obvious. Our operators chain low-severity issues into the critical attack paths automated tools miss.
WHAT YOU RECEIVE
CYBERSECURITY ECOSYSTEMSINCE 2019
One ecosystem. The whole cyber security cycle.
Community, academy, offensive services and a platform - run by one company. The operators who train your team are the same operators who break into real systems, always with written authorisation.
TRUSTED ACROSS REGULATED SECTORS
Banking, telco, state-owned enterprises and government. Practitioners from these organisations have grown with our ecosystem; engagement client names stay confidential under NDA.
Close findings in weeks, not quarters - the retest is included in every engagement.
Learn how14days
RETEST SLA - ALWAYS INCLUDED
Prove what your defenders saw with a scorecard mapped to MITRE ATT&CK.
See red team operations100%
OF KILL-CHAIN STEPS MAPPED TO ATT&CK
Talk directly to an operator, then get a written scope after the scoping call.
Request a scoping call2days
TO WRITTEN SCOPE, TIMELINE AND FEE
service commitments as of August 2026 · contractual SLAs confirmed at scoping
01 · THE ECOSYSTEM'S OPERATING MODEL
Four parts. One loop.
Most vendors sell one layer of security. Linuxhackingid runs the whole cycle under one legal entity - so talent, methodology and evidence flow unbroken from the community to the platform.
- legal entity
- 1
- subcontractors
- 0
- integrated units
- 4
UNIT
ROLE
The source of talent and research
Shaping operators
Proving exposure
Continuous validation
SCALE
40,000+members across Indonesia & ASEAN
12,000+practitioners trained
180+engagements delivered
SynapseCTEM · automated pentesting
FOR WHOM
Practitioners, students and independent researchers
Individuals, engineering teams, SOCs and corporate L&D
CISOs, security leads, risk & compliance teams
Security & engineering teams that ship regularly
OFFER
Community channels, 102 free tools, TempMail, public advisories
Online classes, the Bug Bounty Bootcamp and corporate training tracks
Penetration testing, red teaming, 0-day research, secure code analysis
Automated pentesting, SAST, a PoC generator, automated bug bounty hunting
OUTPUT TO THE NEXT STAGE
TalentMembers train in the academy
OperatorsThe best graduates run engagements
Field researchEvery engagement sharpens the platform
Open toolsBack to the community
The loop returns to the community. 102 free tools, advisories and the research we publish flow back to 40,000+ members - the source of the next generation of talent.
02 · APPROACH
Scanners report possibilities. An attacker only needs one proven path.
Linuxhackingid is offensive by design. Our operators prove what can really be exploited, write it up in language both leadership and engineers understand, then make sure the fix holds.
Learn our methodologyFrom separate findings to an attack pathILLUSTRATION
SCANNER OUTPUT
- User enumerationLOW
- Sequential order IDsLOW
- Read-only IDORMEDIUM
- Reset token reuseMEDIUM
LINUXHACKINGID OPERATOR
- Enumerate customer emails through the reset endpoint
- Guess the sequential order IDs
- Read customer PII through the IDOR
- Reuse the reset token that never expires
Full account takeoverCRITICAL
HOW WE WORK
Four principles we do not compromise on.
The same standard for a one-off pentest and an annual programme.
ENGAGEMENT STANDARD
PRINCIPLE 02
Evidence, not probability
Every finding is reproduced and documented with request-level evidence. No unverified scanner output.
WHAT YOU RECEIVE
PRINCIPLE 03
Mapped to frameworks
The methodology follows recognised standards, so the results feed straight into your risk and compliance programme.
WHAT YOU RECEIVE
PRINCIPLE 04
Built for remediation
Findings arrive with severity, business impact and fix guidance for the engineers who will apply it.
WHAT YOU RECEIVE
SERVICE COVERAGE
Three outcomes, one methodology.
Choose the entry point that fits your security programme's priorities.
- 01 · SecureSecureFind and close the gaps attackers go for first.Penetration testingsecure code0-day research
- 02 · DetectDetectProve whether your team and tooling see an intrusion in progress.Red team emulationpurple team
- 03 · RespondRespondRehearse the response against realistic adversary behaviour.Executive tabletopincident response
ALIGNED WITH
Mapped to recognised standards.
The results go straight into your risk and compliance programme.
- OWASPWSTGWeb application testing
- OWASPMASTGMobile application testing
- OWASPAPI Top 10API security risks
- OWASPASVSApplication verification standard
- PTESPenetration Testing Execution StandardThe pentest execution flow
- NISTSP 800-115Technical testing guide
- MITREATT&CKAdversary tactics & techniques
- FIRSTCVSS v4.0Severity scoring
03 · ENTERPRISE SERVICES
Every engagement ends in evidence, not a PDF.
Penetration Testing
Manual-first. Proven with an exploit.
Finding vulnerabilities in applications, APIs, networks and cloud - tested to industry standards, with every risk prioritised by its business impact.
COVERAGE
- WEBWeb ApplicationAuth, access control, business logic and injection.
- MOBMobile ApplicationiOS & Android apps, local storage and backend APIs.
- APIAPIAuthorisation and abuse across REST, GraphQL and gRPC.
- EXTExternal NetworkThe perimeter, services and edge devices exposed to the internet.
- ADActive DirectoryAssumed-breach paths to domain admin and critical data.
- CLDCloudIdentity and misconfiguration across AWS, Azure and GCP.
METHODOLOGYSTAGE 01 / 05
Deliverables
- Executive summaryRisk posture and business impact in language leadership understands.
- Technical findingsCVSS v4.0 scores, reproduction steps and request-level evidence.
- Remediation & retestPrioritised fix guidance and verification of every finding closed.
Red Team Emulation
Test detection and response, not just the application.
A simulated cyber attack that tests your people, processes and technology - every vector a real adversary would use, run as one objective-based operation.
- FULL-SCOPE RED TEAM
- ASSUMED BREACH
- PURPLE TEAM
- PHISHING & SOCIAL ENGINEERING
OPERATION LIFECYCLE · MAPPED TO MITRE ATT&CK
- TA0043Threat IntelligenceProfiles of the actors targeting your sector; the plan is built from their real tradecraft.
- TA0001Initial AccessPhishing, exposed services or the supply chain - whatever a real adversary would use.
- TA0003 · TA0011Foothold & C2Persistence and covert command-and-control while evading your controls.
- TA0004Privilege EscalationAbusing misconfigurations and credentials for administrative control.
- TA0008Lateral MovementMoving towards crown-jewel systems as a real intruder would.
- TA0040Objective & ImpactReaching the agreed objective and documenting every step.
Detect · Respond
- Purple-team debriefThe attack timeline replayed against your telemetry - every detection gap becomes a detection rule.
- ATT&CK scorecard100% of kill-chain steps mapped to MITRE ATT&CK for your SOC.
- Objective reportThe full path from initial access to the objective, with control recommendations.
0-Day Vulnerability Research
Found first. Disclosed responsibly.
Research that hunts for new vulnerabilities nobody has found yet - in the products you build or rely on, and in your internal infrastructure.
- 42 CVES & 0-DAY FINDINGS
COVERAGE
- PRDProducts & appliancesThe software, devices and platforms you ship or rely on.
- INFInternal infrastructureCustom systems and in-house services public scanners cannot reach.
- DSCCoordinated disclosureA private advisory first; nothing is published without your consent.
Deliverables
- Technical advisoryRoot cause, affected versions and the severity of every flaw.
- Proof-of-conceptA safe exploit your engineers can reproduce.
- Fix verificationPatches and code fixes retested before release.
Secure Code Analysis
Secure before release.
Identifying critical security flaws in source code and binaries before your application is deployed - with the false positives already removed.
- OWASP ASVS
- CWE TOP 25
- CI/CD GATE
COVERAGE
- SRCSource code reviewManual review backed by SAST, across your languages and frameworks.
- BINBinary analysisCompiled applications, SDKs and third-party components.
- FIXLine-level fixesEvery finding pinned to a file and line, with fix guidance.
Deliverables
- Line-level findingsFile, line, root cause and a fix ready to merge.
- Standards mappingCoverage mapped to OWASP ASVS and the CWE Top 25.
- CI/CD gateA gate design so the fixes hold in the next release.
Corporate Training
Capability that stays with your team.
Practitioner-led programmes that build security capability across engineering, defence and leadership - tailored to your stack, taught by people who do the work every day.
TRACK · AUDIENCE · OUTCOME
- T1Secure Code & SDLCDevelopers & engineering leads - fewer exploitable bugs.
- T2Offense for DefendersSOC, blue team, IR - recognise attacker tradecraft in your telemetry.
- T3Web & API ExploitationAppSec & QA - test like a pentester, in-house and in-sprint.
- T4Cloud Attack & DefenseCloud & DevOps - harden identity, close misconfigurations.
- T5Awareness & PhishingAll staff - reduce human-layer risk with realistic simulations.
- T6Executive TabletopLeadership & crisis teams - rehearse breach decisions before one happens.
Delivery format
- On-site or live virtualAt your office or online, in English or Indonesian.
- Private cohortOne class just for your team, with labs built on your own vulnerable patterns.
- Custom curriculumMaterial built from engagement findings in your systems.
04 · PROOF
See exactly what you receive from every engagement.
Evidence, not probability. Every finding is reproduced, documented at request level and closed through a retest. Walk through an illustrative sample in the same report format.
Penetration Test Report · Sample
REPORTTECHNICAL APPENDIXF-07
FINDING 7 / 14P. 23 / 61
F-07WEB & APIREPORTED ON DAY 0
IDOR → full account takeover
- SEVERITY
- High
- CVSS V4.0
- 8.6 / 10
- AV:N · PR:L · UI:N
- STATUS
- ✓ Verified fixed
- RETEST ON DAY 11
- TIME TO FIX
- 11 days
- HIGH SLA · 14 DAYS
EXECUTIVE SUMMARY
Order IDs are sequential integers and the endpoint does not verify ownership. Any authenticated user can read and change another customer's order by changing one number in the request.
KEY RECOMMENDATION
Enforce object-level authorisation on the server and replace the sequential IDs with unguessable UUIDs.
FINDING ATTRIBUTES
- Asset
- Customer portal · order history APIapi.████.co.id/v2/orders/{id}
- Category
- OWASP API1:2023Broken Object Level Authorization
- Weakness
- User-controlled keyAuthorisation bypassed through an object ID in the request
- Environment
- Production · grey-boxTest accounts provided by the client
REPRODUCTION STEPS
- 01Sign in as user A (customer role) and open the order history.
- 02Intercept GET /v2/orders/:id and replace A's ID (100491) with 100492.
- 03The server answers 200 OK with user B's data - no error and no alert.
GET /v2/orders/100492 HTTP/2Host: api.████.co.idAuthorization: Bearer ████████Accept: application/json
HTTP/2 200 OKcontent-type: application/json{ "order_id": 100492, "owner": "user_B", "email": "b•••@████.id" }
EVIDENCE E-07.2 · HOST, TOKEN & PII REDACTED
CVSS V4.0 BASE SCORE
8.6 / 10HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
- Attack Vector
- Network · AV:N
- Attack Complexity
- Low · AC:L
- Attack Requirements
- None · AT:N
- Privileges Required
- Low · PR:L
- User Interaction
- None · UI:N
- Confidentiality
- High · VC:H
- Integrity
- High · VI:H
- Availability
- None · VA:N
BUSINESS IMPACT
Mass disclosure of customer PII and invoices, and undetected changes to orders. A data protection failure that must be reported.
REGULATION & CONTROL MAPPING
- UU PDP 27/2022Article 46
- Notification of a data protection failure within 3×24 hours.
- ISO/IEC 27001:2022Annex A 8.3
- Information access restriction
- PCI DSS v4.0Req. 6.2.4
- Preventing attacks on access control mechanisms
REMEDIATION PLAN
- 01Enforce object-level authorisation on the server for every order request.Owner: Backend · client✓ VERIFIED
- 02Replace the sequential order IDs with unguessable UUIDs.Owner: Backend · client✓ VERIFIED
- 03Log and alert on cross-account object access.Owner: SecOps · client✓ VERIFIED
AUDIT TRAILClosed on day 11 of a 14-day SLA
- DAY 0 · 09:12Found & confirmedReproduced from two test accounts.
- DAY 0 · 11:40Escalated to the client's ownerWithout waiting for the final report.
- DAY 9Fix deployedObject authorisation + UUIDs live.
- DAY 11Retest: verified fixedThe same request now returns 403.
Results from real engagements
Sectors anonymised under NDA · named references with client consent
- TIER-1 DIGITAL BANK4 hops
from phishing e-mail to domain admin during a red team op. Nine control gaps closed in six weeks.
- NATIONAL LOGISTICS PLATFORM31 findings
across API and mobile, 6 critical. Full remediation validated before the peak-season freeze.
- SAAS VENDOR · 0-DAY RESEARCH3 CVEs
in an appliance shipping to 40+ enterprises, disclosed and patched under embargo.
05 · PLATFORMSYNAPSE CTEM · EARLY ACCESS · DESIGN PARTNER PROGRAMME
Validate exposure every day, not once a year.
Synapse is Linuxhackingid's authorised automated pentesting platform. It keeps mapping the attack surface, proves exposure through safe, signed exploitation, then sends verified fixes to the engineering team.
CONNECTS TO
Exposure overviewSAMPLE DATA
- Assets in scope
- 1,284
- Validated exposures
- 37
- Awaiting retest
- 9
LATEST EXPOSURES
- CRITICALSSRF to the cloud metadata endpointapi-gw · prodVALIDATED
- HIGHIDOR on /v2/orders/:idportal · prodFIX PR OPEN
- HIGHCredentials exposed in a repositorygithub · org/appRETEST PASSED
- MEDIUMWeak TLS configuration at the edgecdn · edgePRIORITISED
SYNAPSE MODULES01 / 04
MODULE 01
Automated Pentesting
Scoping, scanning and exploitation of signed-off targets - authorised, 24/7, within the guardrails you approve.
CTEM COVERAGE3 / 5 STAGES
MAPPED TO
MODULE 02
SAST
Static analysis of source code and binaries, connected to your repositories, with false positives removed before they reach an engineer.
CTEM COVERAGE2 / 5 STAGES
MAPPED TO
MODULE 03
PoC Generator
Proves every finding with a safe, reproducible proof-of-concept - tickets open only for proven exposure.
CTEM COVERAGE1 / 5 STAGES
MAPPED TO
MODULE 04
Automated Bug Bounty Hunting
Hunts bug-bounty-class vulnerabilities continuously, then verifies and de-duplicates every finding before routing it to its owner.
CTEM COVERAGE3 / 5 STAGES
MAPPED TO
CTEM STAGES5-STAGE CYCLE
- ScopingAgree on the assets that matter; sign off the targets that may be touched.COVERED
- DiscoveryInventory assets from code, the cloud edge, IP ranges and API specs.COVERED
- PrioritizationRank by exploitability and the path to the crown jewels.
- ValidationProve impact through authorised exploitation.COVERED
- MobilizationRoute fixes, send PRs, verify through a retest.
BUILT-IN GUARDRAILS
- Signed-off targetsOnly the assets you authorise are touched.
- Scope & rate limitsAgreed limits, with a kill switch.
- A full audit trailEvery run is recorded and reproducible.
- Operator sign-offCritical findings are triaged by a person first.
Synapse evidence supports compliance controls; Synapse is a testing platform, not a certification. The interface above is an illustration with sample data.
06 · TRUST & ASSURANCE
Built for procurement.
A registered entity with written contracts, controlled evidence handling and reporting structured for your auditors' and regulators' review - in English, Indonesian or both.
A · ENTITY
- LEGAL ENTITY
- PT Linuxhackingid Cyber Security
- REGISTERED OFFICE
- IDX Tower 1, Level 3, Unit 304, Jl. Jend. Sudirman Kav 52-53, Jakarta 12190
- FOUNDED
- 2019 · Indonesia & ASEAN
- OFFICE HOURS
- MON-FRI - 09:00-18:00 WIB - PGP ON REQUEST
- CONTRACTS
- NDA · statement of work · rules of engagement
- REPORTING
- English, Indonesian or both
B · TEAM ASSURANCE
- engagements subcontracted
- 0
- team certifications
- 61
KEY CERTIFICATIONS
CEH · PenTest+ · CRTA
Named operators with background checks.
YOUR EVIDENCE, FROM START TO FINISH
- BEFORE & DURING TESTINGNDA & rules signedNothing is touched before both are signed.
- BEFORE & DURING TESTINGEncrypted evidenceEncrypted in transit and at rest.
- DELIVERY & AFTER THE RETESTControlled reportingEncrypted channels; a PGP key is available.
- DELIVERY & AFTER THE RETESTEvidence destroyedDestroyed once the retest closes the engagement.
C · TRUST CENTER
Documents for procurement, legal and risk teams.
Documents marked NDA are sent once the NDA is signed.
D · REPORTING & COMPLIANCE
- 2022 · Annex A.8.8ISO/IEC 27001Evidence for technical vulnerability management.
- v4.0 · Req. 11.4PCI DSSInternal and external penetration testing.
- POJK 11/POJK.03/2022OJKCyber security testing based on vulnerability analysis and scenarios, for bank IT reporting.
- UU 27/2022UU PDPImpact framed against data protection obligations, fully in force since October 2024.
Alignment statements describe the standards our engagements and reports are measured against; they are not a claim of third-party certification.
07 · ENGAGEMENT MODEL
From the first call to a verified fix.
The same six steps on every engagement. Each ends in a recorded artefact, so procurement, legal and your auditors know exactly where you stand.
ENGAGEMENT FLOW
SERVICE FINDER
Which service fits?
Pick what you need and we show you the engagement and the format that fit.
RECOMMENDATIONORGANISATION
Penetration Testing
A fixed-scope engagement on the OWASP and PTES methodologies, reported in English and Indonesian, with a retest after remediation.
- Need
- Validate an application, API or network before a release or an audit
- Format
- Fixed-scope project
Different commercial models, one delivery standard.
Compare the models in detail| MODEL | Project | Retainer | Programme | Self-serve |
|---|---|---|---|---|
| DURATION | 4-12 WEEKS | 12-MONTH TERM | 6-12 MONTHS | INSTANT ACCESS |
| BEST WHEN | You have a deadline, an audit or a single system to clear. | You ship often and want the same operators all year. | You need the capability to stay in-house afterwards. | Individuals and small teams starting today. |
| STRUCTURE | One fixed-scope engagement with an agreed start and end date, priced up front. | A quota of testing days per quarter, drawn down against your release calendar. | Test, train, measure, repeat - services and training run as one plan. | Online courses and the free tools platform, with no procurement cycle at all. |
| Request a scoping call | Discuss a retainer | Design a programme | Browse courses |
- TESTING COVERAGE ·
- Web · Mobile · API · Network · Cloud · Source code · Identity · People & process · OT & appliances
- STANDARDS FOLLOWED ·
- PTES · OWASP ASVS · MITRE ATT&CK · NIST SP 800-115
- EVERY MODEL INCLUDES ·
- Named operators · same-day critical escalation · reporting in EN & ID · retest within 14 days
08 · ACADEMY
An academy that shapes the next operators.
Training is not a side line - it is our talent pipeline, taught by pentest and red team operators who work real engagements every week.
- practitioners trained since 2019
- 12,000+
- live sessions per bootcamp cohort
- 20
- corporate training tracks
- 4
- Corporate TrainingCurriculum built from findings in your own systems. Onsite or remote, delivered in English or Bahasa Indonesia.
- Batch 01 - November 2026Bug Bounty Bootcamp20 live online sessions from zero to advanced, with real-case labs, a 700+ page ebook and mentor-reviewed reports.
- Online Courses20+ hands-on courses, instant LMS access, team learning paths with seat management.
09 · COMMUNITY & OPEN TOOLS
Back to the community, where it all began.
40,000+ members since 2019. The tools born from our real engagements go back out for free, and our research is published for Indonesia's security teams.
FREEtools.linuxhackingid.comOpen
Security Tools
A public automation platform: 102 offensive and defensive tools behind 24 workflows you can run without an account. Session-only by default, with optional encrypted reports for 24 hours.
FREEMIUMmail.linuxhackingid.comOpen
Temp Mail
Disposable inbox infrastructure for isolated registration, verification flows and privacy-preserving testing. Addresses are created only when you ask for one, and expire on their own.
RESEARCH & ADVISORY
Research you can use, not brochures.
Advisories, threat landscape reports and playbooks from the field. One email when something genuinely matters - no drip campaigns, and one click to unsubscribe.
All publicationsFOLLOW OUR COMMUNITY
10 · CONTACT
Talk to an operator, not a sales desk.
Tell us what needs protecting. We recommend the right engagement - with scope, schedule and cost in writing within 2 working days.
WHAT HAPPENS NEXT
- SCOPING CALLA scoping call with an operatorObjectives, assets and limits are discussed directly with an operator - not sales.
- BEFORE THE ENGAGEMENTNDA & rules of engagementSigned before anything is touched.
- ≤ 2 WORKING DAYSA written proposalClear scope, schedule and cost.
- [email protected]
- +62 878-1204-2020
- OFFICE
- IDX Tower 1, Level 3, Unit 304, Jl. Jend. Sudirman Kav 52-53, Jakarta 12190
- OFFICE HOURS
- MON-FRI - 09:00-18:00 WIB - PGP ON REQUEST