Cyber Security Club
University of South Asia
TheOnion
Offensive thinking.
Defensive purpose.
Curiosity, research
& a different perspective.
The people behind the work
A Bangladesh-based cybersecurity team. We test, research, and build security skills together.
Research-led security. Human ingenuity.
Meet Black OnionOur expertise
Look closer.
Go deeper.
From your first assessment to the questions nobody has asked yet. Six ways we help teams understand their exposure and build stronger defenses.
Penetration testing
Find the weaknesses that automated scans leave behind.
A focused assessment of your web applications, APIs, and network infrastructure. We investigate how vulnerabilities connect, explain their business impact, and help your team prioritize remediation.
Explore this serviceRed teaming
Test your defenses against an adversary-minded approach.
An objective-led security engagement built around your organization. We work within explicitly authorized boundaries to help you understand exposure and evaluate detection and response.
Explore this serviceSecurity research
Go deeper into the systems your business depends on.
Focused research into application behavior, binaries, and security controls. Our interests span reverse engineering, cryptography, exploit development, and responsible vulnerability research.
Explore this serviceThreat intelligence & OSINT
Understand what your external footprint reveals.
Research into publicly accessible information to surface organizational exposure and add context to potential threats. Collection boundaries and intended use are agreed before work begins.
Explore this serviceWorkshops & training
Build security skills that stay with your team.
Practical cybersecurity workshops, seminars, and guided learning for teams and student communities. Sessions connect security concepts to hands-on exercises in authorized environments.
Explore this serviceCTF partnerships
Turn curiosity into real problem-solving experience.
Capture The Flag collaboration for cybersecurity communities and institutions. We bring experience across web security, forensics, cryptography, reverse engineering, and binary exploitation.
Explore this service
From the Black Onion archive
Security is a team sport.
The people behind the workTeam / Black Onion community archive 
Learning by doingWorkshops / Black Onion community archive 
Shared curiosityTeam / Black Onion community archive 
Out in the communityEvents / Black Onion community archive 
Ideas worth sharingEvents / Black Onion community archive 
Chasing the next flagCTF / Black Onion community archive
How we work
From a question
to a clearer picture.
Good security work is a conversation. We build the scope together, follow the evidence, and leave you with practical next steps.
Listen
01 / 05
Start with the question.
Tell us what you’re building, the decisions ahead, and what keeps you up at night. We start by understanding your environment.
Scope
02 / 05
Agree on the boundaries.
Define the assets, objectives, authorization, and rules of engagement together. A useful assessment begins with a clear plan.
Test
03 / 05
Follow the unexpected.
Manual investigation, targeted tools, and an adversary’s perspective. We look at how individual weaknesses connect.
Explain
04 / 05
Make the findings useful.
Reproducible evidence, business context, and practical remediation guidance. We work through the findings with your team.
Improve
05 / 05
Close the loop.
Prioritize the fixes, share what we learned, and agree on follow-up testing. Leave your team better informed for the next decision.
Ways to begin
A starting point.
Not a one-size-fits-all.
A few illustrative engagement packages to help you explore the possibilities. Final scope, availability, and pricing are agreed with our team.
Launch assurance
A focused starting point for teams preparing a web application release.
per application
$1,200
View packageExposure review
Understand what your public footprint reveals before deciding where to invest.
per domain group
$650
View packageTeam readiness
Connect security knowledge to practical decisions in a guided team workshop.
per workshop
$900
View package
Illustrative demo prices. No payment is taken on this site. Compare engagements
Nesar Uddin Dawood
Founder & Team Lead
Digital forensics
Md Amanat Ullah
Team Advisor
Cybersecurity engineering
MD AB Momin
Co-Founder
Penetration testing
Zabed Ullah Poyel
Red Team Lead
Offensive security
AaRiz Rahman
Web Penetration Tester
Application security
Shahriar Hasan
Web Penetration Tester
Application security
Never a one-off.
Communities and teams connected by curiosity. We learn together, exchange ideas, and make space for the next collaboration.
Team Akatsuki
Cybersecurity community
NPC Computer Club
Community collaborator
Our community
Independent minds.
Shared purpose.
Researchers, builders, students, and the people who keep asking why. We come together through workshops, security events, and Capture The Flag competitions.
- WorkshopsPractical knowledge, shared openly
- CTF collaborationLearn, compete, share the write-up
- Security researchStay curious. Work responsibly.
On the scoreboard
Curiosity, under pressure.
A few results from our competition archive. Every challenge is another reason to research, test an idea, and learn from each other.
Knight CTF
2026 / Competition archive
15thCUET StealthFlags National CTF
2025 / Competition archive
6thWTISD Hackathon
2025 / Competition archive
13thBDSec CTF
2025 / Competition archive
22ndBCS ICT FEST
2025 / Competition archive
24thBugcrowd x Black Hat CTF USA
2025 / Competition archive
27thPhoenix CTF
2025 / Competition archive
29th
Learn with Black Onion
Less theory alone.
More hands on.
Sessions shaped around your team’s experience and goals. Controlled labs, guided exercises, and room to ask the questions that matter.
- Web & APIApplication securityFor builders
- OSINTPublic-source researchFor investigators
- ForensicsFollow the evidenceFor analysts
- CTF labsPractice problem solvingFor curious minds
Useful knowledge, shared
Notes from the field.
The assessment guide
Before your first penetration test
A practical scope and authorization checklist for engineering teams.
Start with a decision
Name the decision the assessment should support: a release, an acquisition, or a remediation milestone. Identify the business workflows and data that matter most.
Define the boundary
List assets you own or are authorized to test, environments, user roles, and explicit exclusions. Obtain written permission for third-party systems before including them.
Plan the handoff
Agree on evidence handling, escalation contacts, reporting expectations, and the retest scope. Assign an owner to triage findings and coordinate fixes.
Playbook
Run a useful tabletop exercise
A discussion-based rehearsal for decisions, ownership, and escalation.
Read in the resource librarySample case study
A release-ready SaaS team
An illustrative application assessment, from scope to retest.
Read in the resource library
Good questions
Before we begin.
A little clarity goes a long way. If there’s something else on your mind, get in touch.
What types of security assessments do you offer?
Our focus includes web application and API penetration testing, network security assessments, and red teaming. We agree on the assets, objectives, and testing boundaries with you before an engagement begins.
How is the scope of an engagement agreed?
We start with your goals, the systems involved, and operational constraints. Testing begins only after scope, authorization, rules of engagement, and communication channels have been agreed.
How do you approach confidentiality?
Confidentiality requirements, evidence handling, and any NDA are discussed before work starts. Please do not include credentials, sensitive findings, or customer data in an initial inquiry.
Do you offer training and knowledge transfer?
Yes. We work with teams, institutions, and cybersecurity communities on practical workshops, seminars, and CTF collaboration. The content is shaped around the audience and their experience.
How long does an assessment take?
Timing depends on scope, complexity, access, and availability. Contact us with a high-level description of your environment so we can discuss an appropriate plan.
What happens after testing?
An engagement can include prioritized findings, remediation guidance, a technical debrief, and a retest plan. Exact deliverables and follow-up activities are agreed as part of the scope.
Let’s talk
What are you
working on?
How can we help?
Sign in to send your message, keep track of replies, and use the details already on your account.
Sign in to send a message- Based in
- Bangladesh.
Connected by curiosity. - Write to us
- theblackonion.bd@gmail.com
- Prefer a conversation?
- Plan a consultation
- Before you share
- Keep credentials, customer data, and sensitive findings out of your initial inquiry.