Research
Notes from the field
Writing on offensive tradecraft, cloud security, threat intelligence, and what it actually takes to run a security program that survives contact with real attackers.
Unmasking eBPF Rootkits: Kernel Telemetry and Detection Artifacts
Learn how offensive eBPF intercepts kernel calls to hide activity, and master the bpftool and kernel telemetry workflows required to detect them.
Chaining Mobile Permissions: Auditing Accessibility and Clipboard Abuse
Learn how Android accessibility services and clipboard access interact, and implement concrete developer controls like FLAG_SECURE and UIPasteControl.
Pipeline Poisoning: Auditing and Hardening GitHub Actions CI/CD Workflows
A practical guide to identifying context confusion in GitHub Actions workflows and implementing OIDC and least-privilege security controls.
Breaking and Fixing LLM Integrations: Practical Injection and Defense
Practical demonstration of direct and indirect prompt injection attacks against LLM applications, alongside architectural defenses like privilege separation.
Beyond CTF Badges: The Technical Artifacts That Actually Get You Hired in Security
Stop relying on generic certs and wrapper scripts. Here are the specific, high-signal security artifacts that prove your technical capability.
How to Land Your First Valid Bug Bounty Finding
Stop burning time on automated recon pipelines. Here is a practical, manual workflow to find and report your first valid vulnerability.
Stopping Kubernetes Escalation: Service Account Tokens and Over-Broad RBAC
Learn how default token mounts and permissive RBAC expose Kubernetes clusters, and implement the precise controls needed to block this exposure vector.
Demystifying Container Escapes: Mechanics of Privilege and How to Block Them
Understand how host mount misconfigurations and Linux capabilities enable container escapes, and learn the exact runtime controls needed to block them.
Understanding AWS iam:PassRole Misconfigurations and How SCPs Block Privilege Escalation
Learn how AWS iam:PassRole misconfigurations lead to privilege escalation and how to block them using permission boundaries and SCPs.
Writing YARA Rules That Last: Matching Families, Not Hashes
Stop writing YARA rules that break on the next build. Learn to find durable code constants and test against goodware to catch entire malware families.
Tracing Phishing Origins: Raw Email Header Analysis and Indicator Extraction
Learn how to read bottom-up Received chains, spot SPF/DKIM alignment tricks, and turn raw email headers into actionable block rules.
Stop Reversing Everything: A 30-Minute Windows Malware Triage Workflow
A fast, repeatable decision-tree workflow for triaging unknown Windows executables, pulling dynamic IOCs, and knowing when to escalate to deep reversing.
No posts match your search.