Regular Expressions for Source Code Analysis
Some codebases are stunningly large. Because there's no way to ever read over every line of code, I use complex search queries to look for interesting, potentially vulnerable code.
School-Sponsored Extracurriculars are a Waste of Time
I made a big mistake in high school and felt like writing about it.
uftpd - Buffer Overflow and Directory Traversal Writeup
This post is an informal writeup about multiple vulnerabilities in uftpd FTP server, some of which could lead to remote code execution.
U.S. Department of Defense - Info Disclosure and SQLi Writeup
This is a short writeup about a critical severity vulnerability that led me to discover another high severity vulnerability in a Navy website covered by the Department of Defense's HackerOne program.
Exploiting Prepared Statements
This post is about a little-known type of vulnerability in which the attacker manipulates the parameters bound to prepared statements with malicious goals such as bypassing access control.
Building a Silent 6 GPU Ethereum Mining Rig
This blog post documents the construction and operation of a silent 6 GPU Ethereum miner I built for fun.
Mythic Beasts - XSS+CSRF Writeup
This is a technical writeup about a vulnerability in Mythic Beasts that led to total account compromise, and why being able to chain XSS with CSRF is so dangerous.
This was written to help some friends of mine who are becoming interested in cybersecurity to be able to learn. It explains web vulnerabilities including XSS, CSRF, SQLi, IAC, and window.opener.