Cenarion Refuge // kept
The Moonwell
- SSRF · CHAIN How I Chained 4 Vulnerabilities on GitHub Enterprise The masterclass in chaining: four low-severity bugs folded into one RCE. It rewired how I weight a finding.
- REQUEST SMUGGLING HTTP Desync Attacks: Request Smuggling Reborn Made me stop assuming the front-end and back-end agree on where a request ends. They rarely do.
- JNDI · RCE Log4Shell: RCE 0-day in Log4j A logging library as a remote shell. The blast-radius lesson I point every junior at.
- MEMORY Smashing the Stack for Fun and Profit Nearly thirty years on, still the cleanest explanation of why a buffer is a weapon. I re-read it every year.
- SPECULATIVE EXEC Meltdown & Spectre The week hardware stopped being a trust boundary. It still reshapes how I threat-model.
- API · IDOR Web Hackers vs. the Auto Industry Proof the boring bug (IDOR at scale) still owns the modern web. Humbling, and a little funny.
- AI · RECON Hacking Google with AI A glimpse of where bug hunting is going: an LLM as a tireless recon partner against a giant. Equal parts exciting and unsettling.