Offensive security,reconstructed from evidence.
Advanced pentest field notes and independent CVE analysis across web, identity, mobile, and wireless systems. Clear conditions, visible evidence, defensible impact.
Five systems. Five evidence-led casefiles.
Chosen for original evidence, negative controls, reproducible method, and surface diversity—not recency or publishing volume.
The Flow Is Standard. The Bypass Is in the Half You Skipped.
OAuth 2.0 and OIDC vulnerabilities are almost never in the specification. They are in the parts implementations leave out — state, PKCE, exact redirect matching, audience validation — and the flow runs perfectly while each omission sits there waiting.
Android App Links: The Link Was Verified. The Action Was Not.
A field methodology for Android App Links that separates domain ownership, route validation, application state, and server-side authorization before calling a deep link secure.
The Handshake Was Captured. The Network Was Not.
A Wi-Fi assessment methodology that separates radio visibility, network identity, authentication, client trust, and post-association access before calling a wireless test successful.
BloodHound Path Triage: The Shortest Path Is Usually the One That Expires First
BloodHound draws every edge the same width, but a DACL lasts for years and a session lasts for minutes. Shortest-path queries are biased toward exactly the edges least likely to still be there when you walk them.
CVE-2025-32463: How a User-Controlled Chroot Loaded Code as Root
A reader-first root-cause analysis of CVE-2025-32463: how sudo entered an attacker-controlled filesystem before authorization completed, why NSS could then load a library as root, and what 1.9.17p1 changed.
Responsible Disclosures
Firms contacted through authorized reporting channels during personal security research. No endorsement, employment, or client relationship is implied.
$ gdb -q ./authd --core core.4412 Program terminated with signal SIGSEGV, Segmentation fault. #0 0x0000000000401e6c in parse_session_hdr (h=0x7ffd9c40) at session.c:214 214 memcpy(ctx->token, h->token, h->token_len); rip 0x0000000000401e6c rsp 0x00007ffd9c40 rax 0x4141414141414141 rdi 0x00000000004052c0 $ checksec --file=./authd RELRO Partial Canary absent NX enabled PIE no [+] token_len unbounded — 72 bytes reach saved RIP [+] no canary, no PIE — control transfer is one gadget away
A finding should survive the handoff.
The useful part is not the screenshot. It is the chain from observable behavior to root cause, bounded impact, and a fix the receiving team can verify independently.
- 01 Reproduction with stated preconditions
- 02 Negative controls and exploitability boundaries
- 03 Defender-ready remediation and retest criteria
Three areas, one standard.
Each note carries the same burden of proof: reproducible steps, stated preconditions, demonstrated impact.
Web application attacks
Authentication bypasses, business logic flaws, API attack paths, and client-side validation gaps — tested with reproducible steps.
Auth · APIs · business logicVulnerability research
Root-cause analysis, variant hunting, exploitability boundaries, and patch diffing from authorized engagements.
Root cause · variants · exploitabilityAttack surface analysis
Asset discovery, cloud misconfiguration chains, identity paths, and external attack surface enumeration at scale.
Cloud · identity · external surfaceWrite-ups
Full write-ups: how the bug was found, why it works, and what it takes to trigger it.
Three False Alarms in a Privileged Helper Sweep
Seven third-party helpers run as root on this Mac. I checked whether each one authenticates the process talking to it, was wrong three times in a row, and found nothing. The interesting part is why each cheap method failed.
The Container Was Non-Root. The Node Was Still One Mount Away.
A container security methodology that measures mounts, runtime authority, kernel controls, and workload identity instead of treating a non-root UID or a passing policy check as proof of isolation.
AI Vulnerability Discovery: One Frontier Model or Three Specialists?
A reproducible benchmark design for the decision security teams actually face: spend the same research budget on repeated runs of one strong model, or on a diverse model team—and count only vulnerabilities that survive root-cause review, reproduction, and a fixed-version negative control.
Complete series
Start at part one and follow one problem from first signal to defensible conclusion.
01 Complete seriesExternal Perimeter Intelligence
External Perimeter Intelligence
- 01The External Perimeter Is a Graph. The Port List Is Only One View.
- 02The Domain Resolved. Ownership Was Still a Hypothesis.
- 03The Vendor Was Out of Scope. The Trust Boundary Was Not.
- 04The Service Was Observed. The Application Was Still Unknown.
- 05The Login Page Was Public. The Identity Boundary Was Somewhere Else.
02 Complete seriesmacOS Security Boundaries
macOS Security Boundaries
03 Complete seriesATM Security Assessment
ATM Security Assessment
04 Complete seriesBrowser-to-Native Trust Boundaries
Browser-to-Native Trust Boundaries
05 Complete seriesWhen Access Checks Fail
When Access Checks Fail
06 Complete seriesTesting the Ransomware Playbook
Testing the Ransomware Playbook
07 Complete seriesInternal Network Triage
Internal Network Triage
Published CVEs
Found during authorized testing, reported through coordinated disclosure.
Interactive Simulators
Zero-dependency security decision engines running directly in your browser. Test authorization boundaries, resolve Kerberos delegations, and verify policy logic in real time.
macOS Entitlement Evaluator
Simulate XPC IPC boundaries, SecRequirement signing logic, PID reuse races, and Hardened Runtime escape conditions.
AD Delegation Risk Resolver
Model Unconstrained, Constrained, S4U2Self, and RBCD attack paths with real-time Protected Users and MachineAccountQuota defenses.
AI Pentest Execution Broker
Policy enforcement engine gating autonomous agent actions: scope bounds, reversible canary checks, and multi-tier approval states.
Projects
Private products and public tooling built around problems I actually hit.
XRAY ASM
A private, evidence-driven attack surface management workbench for discovering, relating, and prioritizing external exposure without confusing candidates with verified findings.
GothamCity
A private adversary-emulation and detection-validation platform that turns ATT&CK techniques, Atomic Red Team tests, LOLBAS tradecraft, and controlled agents into measurable defensive coverage.
agentmordor
Evidence-backed authority mapping for AI agents — see which identity, tool, data, and external action are connected before deployment.
Methodology
A private operator knowledge system spanning 22 security domains, with one shared contract for authorization, evidence quality, false-positive review, proof of impact, and reporting.
ghostlink
Multi-channel Out-of-Band (OOB) covert C2 and data exfiltration framework over legitimate platforms, for authorized red team operations.
evilcorp-ios
Intentionally vulnerable iOS benchmark application mapped to OWASP MASVS v2 & MASWE.
driftnet2
High-performance packet capture and credential extractor leveraging eBPF/XDP.
mcpbait
Red teaming framework for AI agents and Model Context Protocol (MCP) integrations — probes tool-use boundaries and prompt-injection paths.
New research, straight to your feed.
No newsletter, no tracking, no sign-up. Just the feed — or a direct line for disclosure and collaboration.