Blogs
Collection of my thoughts on various topics
21 posts
- 13 min minutes
Nothing to Detonate: A Phishing PDF Whose Payload Was Only Pixels
Nov 03, 2026An empty email with a 51 KB attachment. The PDF had no JavaScript, no OpenAction, no embedded files and not a single link annotation, because the only malicious address in the whole message existed as a 150 by 150 pixel image. - 14 min minutes
Reversing DexGuard String Encryption: Three Layers and One Structural Mistake
Oct 08, 2026A commercial Android obfuscator can hide strings behind a difference table, withhold the decryptor from the DEX files entirely, and wrap every call-site argument in framework arithmetic. All three come apart, and the reason is the order the layers are stacked in. - 13 min minutes
509 Spaces: How a Backdoor Hid in a Delivered Codebase
Oct 02, 2026A config file that should have been 100 bytes arrived at 32,404. Behind 509 spaces on line 11 sat an obfuscated loader that pulled its command and control address off the Ethereum blockchain and ran on every build. - 7 min minutes
HTB Cyber Apocalypse CTF 2026 - zlib runes
Jul 29, 2026A crypto writeup from HTB Cyber Apocalypse CTF 2026: recovering a hidden Adler-32 target via checksum composition, then forging a single number whose Adler-32 and CRC-32 both collide with it. - 11 min minutes
HTB Cyber Apocalypse CTF 2026 - words_from_the_past
Jul 29, 2026A pwn writeup from HTB Cyber Apocalypse CTF 2026: chaining single 5-byte relative branches through a two-state RWX-page machine to land a posix_spawn one_gadget with no libc leak. - 10 min minutes
HTB Cyber Apocalypse CTF 2026 - CorpSyncAudit
Jul 29, 2026A reverse engineering writeup from HTB Cyber Apocalypse CTF 2026: recovering a deterministic anti-analysis XOR key to decode shellcode hidden inside a replication log's timestamp fields. - 10 min minutes
How I Found and Fixed a Panic Bug in go-redis by Fuzzing the RESP3 Parser
Jul 10, 2026A first-timer's walkthrough of fuzzing the RESP3 reply parser in go-redis, from a five-second crash to disclosure with Redis's security team and a four-line fix merged into a library with millions of downloads. - 11 min minutes
Teaching an LLM to Reason Over BloodHound Instead of Just Querying It
Jul 10, 2026BloodHound already holds the answer in the graph; the operator has always been the one reasoning over it. pathhound-mcp is a read-only MCP server that hands that reasoning to the model, grounded in a graph you already collected. - 2 min minutes
BlackHat MEA Quals 2025 - File101
Oct 08, 2025A medium pwn writeup from BlackHat MEA Quals 2025: abusing scanf into libc's FILE structures to leak libc and pull off a File Stream Oriented Programming (FSOP) attack for a shell. - 9 min minutes
CM CTF 2025 - Hope
Jul 24, 2025A medium pwn writeup from CM CTF 2025: using a negative out-of-bounds index write to overwrite a pointer and redirect execution to the win function. - 4 min minutes
CRTA - Exam Review
Apr 13, 2025My review of CyberWarFare Labs' Certified Red Team Analyst (CRTA) exam: my prep, what the assessment demanded, and honest tips for passing it. - 4 min minutes
eJPT - Exam Review
Jan 08, 2025My review of INE's eJPT (Junior Penetration Tester) exam: my prep timeline, what the exam covers, and the resources I leaned on to pass. - 2 min minutes
PCC Quals 2024 - Counter
Oct 19, 2024A crypto writeup from PCC Quals 2024: breaking an AES-CTR challenge with keystream reuse and a crib-dragging attack to recover the flag. - 2 min minutes
CSAW CTF - Mini Golfing
Sep 20, 2024A pwn writeup from CSAW CTF 2024: leaking an address through a format-string bug to defeat PIE and ASLR, then redirecting execution to the win function. - 5 min minutes
Kypo OpenStack Deployment
Aug 22, 2024A step-by-step guide to deploying the KYPO Cyber Range Platform on OpenStack: the prerequisites, configuration files, and gotchas in one place. - 3 min minutes
ICCA - Exam Review
Jul 06, 2024My review of INE's Certified Cloud Associate (ICCA) exam: how I prepared, what the exam was like, and the notes and resources that got me certified. - 3 min minutes
Royal Elementor Addons Vulnerability
Apr 24, 2024A Deep Dive into the Royal Elementor Addons Plugin Vulnerability and How to Protect Your WordPress Site. - 1 min minutes
AirTech CTF 2024 - ttcccppp
Mar 02, 2024A network forensics writeup from AirTech CTF 2024: spotting the flag smuggled one byte at a time inside the SYN packets of the TCP handshake. - 1 min minutes
AirTech CTF 2024 - Back To The Bases
Mar 01, 2024A network forensics writeup from AirTech CTF 2024: following a TCP stream in Wireshark, carving a file out of FTP traffic, and brute-forcing its cipher down to the flag. - 6 min minutes
My Guide To Attack And Defense CTFs
Jan 19, 2024Tips, tricks, and tooling I use to move fast in Attack & Defence CTFs, from patching vulnerable services to spotting other players on the box. - 1 min minutes
Cyber Quest CTF 2023 - Crypto
Dec 22, 2023A crypto writeup from Cyber Quest CTF 2023: a simple but time-consuming chain of base conversions and a rotation cipher to decode the flag.