Posts
All the articles I have published.
CVE-2026-69243 PoC: aiohttp request smuggling through a rejected WebSocket upgrade
Published date:8 min readI reproduced the aiohttp parser bug end to end: a rejected WebSocket upgrade leaves the request body in the parser tail, and through the standard Nginx WebSocket map it becomes CWE-444 smuggling that bypasses a deny-all edge ACL. PoC in Python and Rust, plus lab-validated detection.
Stealth DCSync, an autopsy: no flag combination got me usable secrets without Get-Changes-All
Published date:13 min readI tested five MS-DRSR flag and EXOP manipulations meant to perform a DCSync without triggering the DS-Replication-Get-Changes-All GUID in Event 4662. Every variant that returned usable credential material also logged the GUID, identically on Server 2016 and Server 2025. One variant contradicts the MS-DRSR specification and I could not resolve it.
GEO Poisoning and the LLM Canary Lab
Published date:3 min readWhy hiding instructions in a page to bias an AI's answer is a bad idea, and how I built a labeled, disclosed canary experiment to measure it instead.