Exploit Development

PentestNov 9, 20268 min read

iOS Application Security in Practice: Auditing 30 OWASP MASVS Vulnerabilities with Frida and LLDB

Hands-on iOS penetration testing and secure coding: auditing Keychain misuse, bypassing client-side biometric checks with Frida, defeating SSL pinning, and mapping 30 real-world vulnerabilities to OWASP MASVS v2.

#ios-security#mobile-security#pentest#exploit-development#methodology

Red TeamNov 9, 20268 min read

Resilient Out-of-Band C2 Pipelines: Framing, AEAD Encryption, and Covert Channels in Go

Designing fault-tolerant, out-of-band command-and-control pipelines for authorized security testing: forward error correction via XOR parity, P-256 ECDHE session encryption, and 9 covert transport protocols in ghostlink.

#red-team#exploit-development#attack-paths#detection#methodology

AI SecurityNov 9, 202614 min read

Breaking AI Agent Boundaries: From Prompt Injection to Remote Code Execution via Model Context Protocol (MCP)

How untrusted context in modern AI pipelines forces autonomous agents to execute arbitrary operating system commands through Model Context Protocol (MCP) server tools: indirect injection, ambient authority, and deterministic execution brokers.

#ai-security#exploit-development#attack-paths#methodology#access-control

Exploit DevelopmentNov 6, 20266 min read

Stack Buffer Overflow: From Segfault to RIP Control (Ret2win)

The non-AD half of the journey: a 64-byte stack buffer, an unbounded read, and the exact steps that turn a segfault into control of the instruction pointer. Compiled live in a Linux container, with the one gotcha — the return address is not where the naive math says it is.

#exploit-development#linux-security#pentest#vulnerability-research

Patch AnalysisOct 20, 202610 min read

CVE-2026-112950: Windows Backslash Traversal in @vitest/mocker

Root-cause analysis of CVE-2026-112950: on Windows, a redirect mock path containing a backslash passes the Vite allowlist check added by the first fix and then reads a file outside the project root.

#vulnerability-research#web-security#access-control#exploit-development

Patch AnalysisOct 8, 202610 min read

CVE-2026-107716: Symlink Traversal in banks Prompt Registry

Root-cause analysis of CVE-2026-107716: DirectoryPromptRegistry in banks followed symbolic links out of its prompt directory, so a link could make it read an arbitrary file through _scan() and get(), or overwrite one through set() and index.json.

#vulnerability-research#access-control#ai-security#exploit-development

Patch AnalysisSep 30, 202611 min read

CVE-2026-102994: Unbounded Token Scanning and CPU Exhaustion in pypdf

Root-cause analysis of CVE-2026-102994: before pypdf 6.18.0, a PDF with a very long object number and no whitespace made the parser read the token to its end with no limit, which can tie up a worker for a long time.

#vulnerability-research#supply-chain#exploit-development

Root Cause AnalysisSep 24, 20269 min read

CVE-2026-91117: Uncaught ValueError on a NUL Byte in ServeStatic

Why a NUL byte that survives ServeStatic's path normalization makes its containment check raise an uncaught ValueError, so the request returns a 500 and, with Django DEBUG enabled, the technical error page.

#web-security#vulnerability-research#exploit-development

Patch AnalysisSep 16, 202614 min read

CVE-2026-87772: Root Escalation Through the Pardus About Mount Helper

Root-cause analysis of CVE-2026-87772: Pardus About's passwordless Polkit action started a root helper that mounted attached disks with defaults,ro, so a setuid binary on a disk gave a local user root. Fixed in 1.2.5.

#linux-security#privilege-escalation#access-control#vulnerability-research#exploit-development