Offensive security notes — binary exploitation, exploit development, mobile pentesting, and red team research. Three tracks, written as practical runbooks.
Stack smashing, DEP/NX & ASLR bypass, ret2libc, shellcode, CTF writeups.
A detailed lab note on turning Prototype Pollution into code execution through Pug's AST/code-generation path: vulnerable merge, prototype chain behavior, debugger observations, exploit shape, trigger conditions and defenses.
2026-05-17A deep dive into CVE-2026-35616 — the FortiClient EMS authentication bypass. The Django CertChainAuth middleware blindly trusts the X-SSL-CLIENT-VERIFY HTTP header, so any unauthenticated client can spoof a verified-client-certificate state and walk straight past the auth gate. Full root-cause analysis, a 401→500 detection oracle, an unauthenticated 225 KB data-disclosure endpoint, a read-only enumeration PoC, and remediation.
2026-05-13A full breakdown of CVE-2025-54309 — the CrushFTP zero-day exploited in the wild in July 2025. A logic flaw in loginCheckHeaderAuth() lets a crafted AS2-To header skip authentication entirely, after which an attacker creates an admin account, remaps the Virtual File System to the OS root, drops a malicious Java plugin and reaches remote command execution. Root cause, the bypass-to-RCE kill chain, detection IOCs and remediation.
2025-08-02Android HTTPS interception: cert injection, root & SSL pinning bypass, Frida tooling.
The big picture: a BurpSuite + Frida workflow for intercepting HTTPS traffic and bypassing security controls on rooted Android, and how the rest of this series fits together.
Android · 2026-03-07Why your proxy CA strategy depends entirely on the Android version: the three breakpoints — user-store trust (≤6), system-store-only (7+), read-only root (9–10), and APEX (14+) — that decide whether you need root and how you inject the cert.
Android · 2026-03-07The foundation every later technique depends on: ADB over USB/Wi-Fi, port forwarding, and getting frida-server running with the correct version and architecture.
Android · 2026-03-07Cyber kill-chain research: OSINT recon & enumeration, Windows host persistence, lateral movement, insecure deserialization.
A defensive analysis of ToolShell, the SharePoint Server on-premises RCE chain tracked as CVE-2025-53770: root cause, execution flow, attacker artifacts, indicators of compromise, hunting ideas, and remediation guidance.
2025-07-29A full attack chain against a lab target: leaking a .git directory, finding an unsanitized system() call, then abusing the GCP instance metadata service to mint an OAuth token for a cloud-platform-scoped service account and exfiltrate a protected object from Cloud Storage.
2024-03-18A researcher-style deep dive into insecure deserialization through ASP.NET ViewState and CVE-2020-0688: serialization concepts, ViewState integrity, Exchange static validation keys, exploit prerequisites, ysoserial.net payload construction, forensic artifacts, detection logic, and remediation.
2022-09-24