Archive
A journey through everything I've published, organized over time.
I reproduced the aiohttp parser bug end to end: a rejected WebSocket upgrade leaves the request body in the parser tail, and through the standard Nginx WebSocket map it becomes CWE-444 smuggling that bypasses a deny-all edge ACL. PoC in Python and Rust, plus lab-validated detection.
I tested five MS-DRSR flag and EXOP manipulations meant to perform a DCSync without triggering the DS-Replication-Get-Changes-All GUID in Event 4662. Every variant that returned usable credential material also logged the GUID, identically on Server 2016 and Server 2025. One variant contradicts the MS-DRSR specification and I could not resolve it.
Why hiding instructions in a page to bias an AI's answer is a bad idea, and how I built a labeled, disclosed canary experiment to measure it instead.
BloodHound OpenGraph extension for enumerating AD tombstones.
Runtime Application Self-Protection for High-Scale .NET Services.
An Active Directory time discovery toolkit for red teams.