research & field notes

Penetration Testing

How attackers exploit subtle authorization flaws in REST and GraphQL endpoints to drain customer balances and hijack merchant records, and why Web Application Firewalls (WAFs) fail to detect them.

Cloud Security

How misconfigured sts:AssumeRole trust policies and excessive wildcards in secondary AWS accounts allow attackers to escalate from a single container breach to organisation-wide administrative control.

Red Teaming

An in-depth technical analysis of user-mode EDR hooking in ntdll.dll, and how modern red teams utilize Hell's Gate, HalosGate, and indirect syscall trampolines to bypass sensor inspection.

Digital Forensics & OSINT

A forensic methodology for investigating cryptocurrency heists: extracting ephemeral private keys from host RAM and de-anonymizing funds through mixers, peel chains, and cross-chain liquidity bridges.

Cloud Security

How compromised container workloads escalate into multi-cloud cluster takeovers through misconfigured capabilities, Kubernetes API service tokens, and Cloud Metadata Service abuse.

Vulnerability Research

How sub-millisecond concurrency windows in payment processors and coupon redemption systems enable duplicate fund disbursement, and how engineering teams must fix them.

Digital Forensics & OSINT

A forensic walkthrough of how financial fraud syndicates manipulate mailbox routing rules, modify PDF invoices, and route proceeds through cryptocurrency OTC brokers.

Red Teaming

Why traditional push notifications and SMS codes fail against adversary-in-the-middle (AiTM) frameworks, and how FIDO2 WebAuthn hardware keys neutralize modern session token theft.