-
FreeBSoD: Leveraging Language Models to Find and Exploit Kernel Bugs (Part 2 of 2)
Part two of the FreeBSoD series walks through two LLM-assisted exploit chains that escape a FreeBSD jail — a stack overflow paired with a stack infoleak to beat canaries and KASLR, and a heap overflow paired with pipe-file type confusion to defeat SMEP/SMAP — plus the staged L0-L4 pipeline that made the model effective.
read more → -
FreeBSoD: Leveraging Language Models to Find and Exploit Kernel Bugs (Part 1 of 2)
Part one of a two-part series on AI-assisted kernel vulnerability research. Covers the methodology used to find roughly eight FreeBSD kernel vulnerabilities with Claude Code, including deep research for bug patterns, CodeQL and semgrep variant hunting, a KASAN feedback loop, and the stack overflow that became CVE-2026-3038.
read more → -
Centurion: Bring Your Own Execution Environment
How we built a custom virtualized loader with its own ISA, PE loader, TLS stack, and software crypto coprocessor in about a week using LLM-assisted development — and what the BYOEE model means for offensive tooling.
read more → -
Et Tu, RDP? Detecting Sticky Keys Backdoors with Brutus and WebAssembly
How we built automated RDP sticky keys backdoor detection into Brutus using WebAssembly to embed IronRDP, a Rust RDP library, into a single statically-linked Go binary.
read more → -
Living on the Edge: How I Ditched WordPress for a Fully Static Site on Cloudflare's Global Network
I moved my blog from a managed WordPress host to a fully static site built with Astro, KeyStatic, and Jekyll, deployed on Cloudflare Pages. Here's why going static and serving from 330+ edge locations beats a traditional CMS and costs nothing.
read more → -
Et Tu, Default Creds? Introducing Brutus for Modern Credential Testing
Introducing Brutus, a multi-protocol credential testing tool written in Go that ships as a single zero-dependency binary. Covers why Hydra falls short of modern JSON reconnaissance pipelines, compiled-in known-compromised SSH key collections, spraying recovered private keys across segmented networks, and experimental LLM-driven credential discovery.
read more → -
Domain Fronting is Dead. Long Live Domain Fronting!
We discovered that domain fronting still works against Google's infrastructure, enabling covert C2 traffic through services like Google Meet, YouTube, and GCP. This research demonstrates how attackers can tunnel traffic through domains too critical for organizations to block.
read more → -
Beyond the Last Mile: How Internet Routing Shapes Red Team Ops
Understanding how internet routing infrastructure impacts red team operations, particularly for traffic tunneling and data exfiltration. Exploring why routing paths, international transit, and peering relationships often matter more than raw connection speeds.
read more → -
Ghost Calls: Abusing Web Conferencing for Covert Command & Control (Part 2 of 2)
Part two of the Ghost Calls series details how we tunnel real-time C2 traffic through Zoom and Microsoft Teams TURN infrastructure using WebRTC — covering the approaches we evaluated, the WebRTC protocol suite, our SCTP-based implementation, and a walkthrough of the TURNt utility.
read more → -
Ghost Calls: Abusing Web Conferencing for Covert Command & Control (Part 1 of 2)
Part one of the Ghost Calls series takes apart how web conferencing platforms work under the hood, using Zoom as the primary example — the Multi-Media Router and Zone Controller architecture, RTP media handling, the fallback chain Zoom uses to stay connected through restrictive networks, and the TURN infrastructure that makes it all work.
read more →