i looked at unusual macOS mechanisms and found a persistence path through the manual reader. it could launch a program selected by a system configuration file, leaving a backdoor behind one of the most ordinary commands on the system. the payload waits for someone to open a man page; reading the documentation does the rest.
Read more →two local Qwen models, one unseen Flask target and 32 GB of unified memory. both found the command-injection sink and wrote a valid localhost exploit; the real difference was speed, tooling and whether the agent finished the job.
Read more →i investigated why three crypto funds could not collect valid rewards, only to find that two systems disagreed about which token had been paid. one delivered the real reward; the other tried to transfer a wrapper that was already gone. every claim reverted.
Read more →at the end of may, doyensec published a direct comparison of aikido and xbow, with each run costing $4,000. shortly after, hacktron recreated the benchmark for $350. i ran the same target through my own pipeline for $11.89.
Read more →i reverse engineered a $200 commercial protection system, only to discover that the developers had protected the installer instead of the software. the payload ran completely unprotected. the crack was copying the installed files.
Read more →entra's application model hides interesting persistence methods where most reviews never check. i added credentials directly to service principals, turned external oidc identities into application access, then used a privileged graph explorer session to delete users, applications and conditional access policies in seconds.
Read more →dumping avr/atmega328/arduino firmware, pure static analysis, speed ctf solve, xor crib dragging over ciphertext with known plaintext attack, cyberchef
Read more →