BLOG

Two Wazuh cluster bugs, each moderate on its own, share one root cause: a security guard applied to every sibling code path except one. Chained, a read-only API user reads the cluster key, authenticates as a cluster peer, and reaches remote code execution as root on every node. Fixed in 4.14.7.

A fork pull request that ran my code on Mozilla's own Mac mini, why a fake secrets file was never a security boundary, and the CI/CD hardening checklist the whole industry is still learning the hard way.

A download servlet in Payara's admin console attaches the administrator's REST session token to an outbound request whose destination the caller controls, and it answers a plain GET with no CSRF token. Chained, an unauthenticated attacker lures a logged-in admin into leaking that token, replays it, and deploys a WAR for code execution as the server user. Fixed in Payara 7.2026.6.

How I chained DOM Clobbering, a forgotten same-origin JSONP endpoint, and a dynamic script loader to bypass DOMPurify and a strict CSP and walk away with the admin cookie.

A walkthrough of how I found and exploited a stored XSS in InkDrop by chaining a broken markdown renderer, a dangerous script re-execution pattern, and a JSONP callback injection to bypass CSP.

A step-by-step walkthrough of bypassing the Windows 11 lock screen via WinRE binary substitution to obtain an NT AUTHORITY\SYSTEM shell.

A digital-forensics-focused follow-up to the Cobalt Strike attack series, covering static analysis, deofuscation, and network/process/memory investigation with screenshots.

An attack & defense walkthrough of Cobalt Strike, with screenshots and references, focusing on teamserver setup and stageless payload creation.