Research

Security research

Published security research on vulnerability discovery, network exploitation and offensive security techniques.

How I discovered a vulnerability in hundreds of Mac OS X applications

Identified a critical vulnerability in the Sparkle Updater framework that allowed remote code execution through man-in-the-middle attacks on applications using unencrypted HTTP connections. Hundreds of macOS apps were affected, including VLC, iTerm and Adium.

Vulnerability research

How to detect the Sparkle Updater vulnerability

Detection techniques and proof-of-concept exploitation of the Sparkle update framework vulnerability using mitmproxy. Demonstrates automated identification of vulnerable applications through network traffic analysis.

Network security

How attackers exploit routers remotely

Research into a remote code execution vulnerability in Netgear routers allowing unauthenticated command execution as root. Demonstrates browser-based exploitation through DNS rebinding techniques to compromise home networks.

Offensive security

Solving the XSS challenge from Intigriti

Demonstrates a race condition vulnerability in a domain whitelist bypass challenge. By dynamically changing an iframe's location hash before a redirect executes, arbitrary JavaScript execution is achieved within the target domain's context.

Offensive security

picoCTF 2019 - JavaScript Kiddie writeup

Technical writeup of two picoCTF web challenges involving PNG file format analysis and cryptographic key recovery. Published in Paged Out! magazine issue #2.

Reverse engineering

SANS Holiday Hack Challenge - Honorable Mention

Awarded honorable mention in the SANS Holiday Hack Challenge. Covers Android APK reverse engineering, ELF binary analysis, SQL injection, privilege escalation, cryptanalysis and Meteor framework exploitation across interconnected targets.

Research-Informed Consulting

Published research informs how engagements are approached - real-world vulnerability discovery and exploitation experience shapes every architecture review and security assessment.

Know where your security architecture stands before it becomes a blocker

A 30-minute call is enough to understand your system, identify the highest-risk areas, and decide whether a focused review would help.

Book a call