Collection of my thoughts on various topics
❯ 20 of 20 posts
A commercial Android obfuscator can hide strings behind a difference table, withhold the decryptor from the DEX files entirely, and wrap every call-site argument in framework arithmetic. All three come apart, and the reason is the order the layers are stacked in.
A config file that should have been 100 bytes arrived at 32,404. Behind 509 spaces on line 11 sat an obfuscated loader that pulled its command and control address off the Ethereum blockchain and ran on every build.
A crypto writeup from HTB Cyber Apocalypse CTF 2026: recovering a hidden Adler-32 target via checksum composition, then forging a single number whose Adler-32 and CRC-32 both collide with it.
A pwn writeup from HTB Cyber Apocalypse CTF 2026: chaining single 5-byte relative branches through a two-state RWX-page machine to land a posix_spawn one_gadget with no libc leak.
A reverse engineering writeup from HTB Cyber Apocalypse CTF 2026: recovering a deterministic anti-analysis XOR key to decode shellcode hidden inside a replication log's timestamp fields.
A first-timer's walkthrough of fuzzing the RESP3 reply parser in go-redis, from a five-second crash to disclosure with Redis's security team and a four-line fix merged into a library with millions of downloads.
BloodHound already holds the answer in the graph; the operator has always been the one reasoning over it. pathhound-mcp is a read-only MCP server that hands that reasoning to the model, grounded in a graph you already collected.
A medium pwn writeup from BlackHat MEA Quals 2025: abusing scanf into libc's FILE structures to leak libc and pull off a File Stream Oriented Programming (FSOP) attack for a shell.
A medium pwn writeup from CM CTF 2025: using a negative out-of-bounds index write to overwrite a pointer and redirect execution to the win function.
My review of CyberWarFare Labs' Certified Red Team Analyst (CRTA) exam: my prep, what the assessment demanded, and honest tips for passing it.
My review of INE's eJPT (Junior Penetration Tester) exam: my prep timeline, what the exam covers, and the resources I leaned on to pass.
A crypto writeup from PCC Quals 2024: breaking an AES-CTR challenge with keystream reuse and a crib-dragging attack to recover the flag.
A pwn writeup from CSAW CTF 2024: leaking an address through a format-string bug to defeat PIE and ASLR, then redirecting execution to the win function.
A step-by-step guide to deploying the KYPO Cyber Range Platform on OpenStack: the prerequisites, configuration files, and gotchas in one place.
My review of INE's Certified Cloud Associate (ICCA) exam: how I prepared, what the exam was like, and the notes and resources that got me certified.
A Deep Dive into the Royal Elementor Addons Plugin Vulnerability and How to Protect Your WordPress Site.
A network forensics writeup from AirTech CTF 2024: spotting the flag smuggled one byte at a time inside the SYN packets of the TCP handshake.
A network forensics writeup from AirTech CTF 2024: following a TCP stream in Wireshark, carving a file out of FTP traffic, and brute-forcing its cipher down to the flag.
Tips, tricks, and tooling I use to move fast in Attack & Defence CTFs, from patching vulnerable services to spotting other players on the box.
A crypto writeup from Cyber Quest CTF 2023: a simple but time-consuming chain of base conversions and a rotation cipher to decode the flag.
hwat.saucehwat.sauce