A community for researchers, by Researchers

With more than 15 years of vulnerabilities and disclosures experience, we see our community as a long-term investment. We provide the tools, knowledge and experience required to find more vulnerabilities/advanced attack vectors and discover innovative ways to exploit them.

Quick handling

When a vulnerability is found, it needs to get into the right hands quickly. Our team of experts are always standing by to help friendly hackers disclose vulnerabilities to any organization.

Generous rewards

We believe researchers efforts should be compensated with higher rewards. Even if a vendor doesn’t accept disclosures, we are still interested in acquiring the vulnerability and reporting it.

Done discreetly

We take the privacy of our researchers very seriously and will never disclose any information to third parties (Customers included). A lot of our researchers also choose to stay anonymous.

What We Do

Designed by researchers, for researchers, SSD provides the quick handling needed to get zero-day vulnerabilities responsibly reported to vendors and be generously rewarded- all done discreetly. We help researchers get to the bottom of vulnerabilities affecting major operating systems, software or devices.

image for site (1)

Our Scope

Our targets of interest include various Operating systems, Web browsers, Readers, Web Hosting Control Panels, CMS, Network Management Systems, Mailservers, Git Servers and many others

Operating systems:
Windows
Linux (RCE and PE)

Mobile Applications:
Facebook
Whatsapp
Facebook Messenger
Instagram
And many others

Mobile: 
iOS (PE from within the Sandbox)
Android

CMS:
WordPress
Joomla
Drupal
Confluence

Web Browsers:
Chrome (RCE or SBX)
Safari
Firefox (RCE)

Web Hosting
Control Panel:
cPanel
Plesk
DirectAdmin
Webmin
And many others

Our full scope

Our Story

Advisories

Explore our latest disclosures

SSD Advisory – MTS HW Driver Escalation of Privileges

September 24, 2022

A vulnerability in Marvin Test’s driver allows local users to use it to write arbitrary data to sensitive areas of the kernel’s memory, this can be exploited to gain elevated privileges. As the driver is digitally signed, this can also be used to do post-exploitation privilege escalation.

Read More

SSD Advisory – Linux CLOCK_THREAD_CPUTIME_ID LPE

September 20, 2022

A vulnerability in the way Linux handles the CLOCK_THREAD_CPUTIME_ID allows local attackers to reach a race condition and use this to elevate their privileges to root.

Read More

SSD Advisory – Linux CONFIG_WATCH_QUEUE LPE

September 5, 2022

A vulnerability in the way Linux handles the CONFIG_WATCH_QUEUE allows local attackers to reach a race condition and use this to elevate their privileges to root.

Read More
Full Archive

Submit your disclosure

Ready to Join the SSD disclosure community? Click below to join the team or submit your vulnerability anonymously

Submit now
FAQ

Get in Touch

Any questions? Interested in our services? We'd love to hear from you.

    We believe that researchers want to share their research, discovery and experience with all security enthusiasts: so we created an all offensive security conference just for that!

    TyphoonCon focuses on highly technical offensive security issues such as vulnerability discovery, advanced exploitation techniques and reverse engineering.  

    TyphoonCon 2022 has been announced and will take place 20-24th of June, 2022.

    Typhooncon.com