Recent content on ༧
tl;dr i found that when macOS’s Archive Utility extracts a ZIP archive containing symlinks, the symlinks themselves do not inherit the com.apple.quarantine extended attribute. when a user executes the symlink, Gatekeeper checks the symlink’s quarantine status (absent) rather than resolving the symlink and checking the target’s status (present). this allows unsigned/un-notarized…
art by fdkubba tl;dr in the first post , i described the initial design and plan behind iota. since then, i’ve evolved the design and added some more features. i still haven’t deployed to production, so this post is also still about design choices and implementation details (rather than production battle-tested results). bloom filter the original design used SQLite for alert…
tl;dr i’m building a lightweight detection engine called iota: https://github.com/bilals12/iota . it reads CloudTrail logs from S3, runs Python rules against them, and sends alerts to Slack. these are design notes on the core implementation, before we head for deployment. why build? CloudTrail logs sit in S3, and we need to run detections against them. as a security team, you have 3 options:…
tl;dr earlier this year, i discovered that macOS’s genatsdb binary (Generate Apple Type Services Databas, i.e. font processing tool) runs without inheriting sandbox restrictions from its parent processes, creating a universal sandbox escape. this was assigned a CVE by Apple. this meant that any sandbox application could execute genatsdb via polyglot files (which, in my PoC, were…
part of the attack sim from the last post was an eBPF module that provided extended kernel-level monitoring and interference with processes. i thought it would be fun to reverse engineer it in a restricted environment, like a docker container. container the Dockerfile for the container is loaded with analysis tools. FROM ubuntu:20.04 # avoid interactive prompts during installation ENV…
tl;dr clusterfuck is a multi-stage attack simulation against k8s environments. it performs executing privilege escalation, container escape, credential theft, lateral movement, and crypto mining techniques. it’s designed to validate detection capabilities in your cloud security posture management (CSPM) and endpoint detection and response (EDR) tools. when successful, it triggers 20+…
tl;dr how can we leverage PEB walking + dynamic API resolution to locate/use Windows APIs without relying on static imports? modern Windows apps typically rely on static linking and the Windows loader to resolve APIs and load DLLs. convenient, but it creates detectable patterns in binaries: import tables, string references, and predictable loading sequences. how can we learn to operate without…
tl;dr rootkit-style code that uses the Microsoft Detours library to perform system call hooking. this tool allows us to: hide malicious processes (like backdoors) from Task Manager and security tools. conceal files and directories from file explorers and system utilities. hide registry keys from registry editors and system queries. the power comes from where it operates - at the Native API level…
tl;dr in part 1 , i talked about bypassing ASLR via information leaks. this time, we’ll try to bypass DEP (Data Execution Prevention) using a very specific method: leveraging WriteProcessMemory to copy shellcode into an already-executable region. this post breaks down the internals of a Windows exploitation technique that leverages WriteProcessMemory and PE section manipulation to bypass…
tl;dr ROP (Return Oriented Programming) techniques made many stack buffer overflows exploitable, despite DEP (Data Execution Prevention), leading to the introduction of ASLR (Address Space Layout Randomization) as a countermeasure (that randomizes memory addresses). to bypass ASLR + DEP, you need three elements: exploiting a logic flaw to bypass ASLR’s randomization. using ROP chains to work…
tl;dr drivers are software components that facilitate communicatioon between the OS and hardware devices. since they operate at the kernel level, they’re granted extensive privileges and direct access to system resources. as a result, exploiting vulnerabilities in drivers is highly valuable. by manipulating MSRs (like IA32_LSTAR), abusing IOCTL, writing operations in kernel memory,…
previously, we discussed/mapped all the fundamental Windows PE structures and parsing capabilities needed by every other component for our custom minidumper tool. in this part, we’ll define the minidump format structures that build upon the PE definitions. following that, we’ll learn how to implement the actual dumping logic using the types defined. data types in the context of…
credential management in macOS is not dissimilar to that in Windows, but with some additional quirks. let’s take a look at some of the ways they can be accessed, both legitimately and illegitimately. securityd credentials are managed by the securityd process, and stored in the “keychain”. securityd is a daemon (i.e. a background process) that maintains different security contexts…
imagine if your computer kept a journal. a journal not merely consisting of poetic silicon muses, but moment-by-moment accounts of all its inner workings. these journals exist, and they’re called minidumps. minidumps are compact snapshots of a computer’s memory, and they capture the essence of what’s happening inside your machine at any given moment. to the unitiated (or…
currently reading [*] there is no antimemetics division by qntm [*] structure and interpretation of computer programs by sussman + abelson [*] poc or gtfo by manul laphroaig [*] an inventory of losses by judith schalansky [*] applied cryptography: protocols, algorithms, and source code in C by bruce schneier queue [+] blue fox: ARM assembly internals and reverse engineering by maria azeria…
during a recent penetration test, i encountered two linked web apps that i thought would be good case studies for a blog post. let’s call them Ren + Stimpy. Ren is a custom-built web app, designed to manage user interactions + content. users can upload/download content, manager user roles, and interact with the database in the backend. Stimpy handles uploaded invoices and user accounts,…
in part 1, i covered the first act of the post-exploitation phase, pivoting from the user workstation to the UAT server and then the dev server. in this part, i’ll use the privileges gleaned from the dev server to pivot to the production server, the child domain controller, and, finally, the forest root domain controller. target 4 the production server prodsrv.nebula.cosmos.local, contains…
introduction corporate networks face a constant and ever-evolving array of threats. at the heart of many enterprise IT infrastructures lies Active Directory [AD]. this is a directory service developed by Microsoft that provides authentication (AuthC) and authorization (AuthZ) services. AD is ubiquitous because of its robust capabilities in managing users, groups, computers, and access to resources…
LATRODECTUS is an emerging malware loader that i first encountered during my research at the start of 2024. initially discovered by walmart’s security team, it quickly gained attention due to the similarities it held with ICEDID, particularly in the use of a command handler for downloading and executing encrypted payloads. proofpoint and team cymru both established a link between the network…
if you ever find yourself in between jobs for an extended period of time, remember to take time off from bouncing from constantly worrying to being completely nihilistic. if you can spare the time and energy, it can be quite rewarding to find something that you can totally nerd out on. for me, it was the world of windows malware. this could probably benefit from being part of a series, so…
as part of a post-layoff glow-up, i began to delve deeper into programming and building my own tools. a lot of these tools are based on specific actions, like attacks, analysis, etc. one thing i’ve always been fascinated with though is object-oriented programming used to build applications from the ground up, specifically backdoors. backdoors are often used for securing remote access to a…
first time running with the cinestill 400d. it’s quite a finicky film, and i’m not sure i have the skill or patience (yet) to deal with its many quirks.
a fun aspect of pentesting is finding interesting ways to get authenticated sessions running. usually, a session authentication relies on the user entering some kind of key (password) that corresponds to their user ID (username). however, in some cases an attacker can “revive” sessions using just the session cookies. i wrote cookieJar for exactly this purpose: extracting cookies from…
since splurging on a new macbook m3 pro, that came with a 12-core CPU, 18-core GPU, 16-core neural engine, and 36GB of RAM, i thought to myself: i should probably use this to train some version of a local AI (LLM) i can use to boost my security and hacking toolchains, namely SAST/DAST and vulnerability scanning. thus began my journey into acquiring the perfect flavours of AI that were ideal for…
i really love this film.
a number of years ago, i received advice that would deeply change my outlook on engineering and understanding of technology. if you want to understand how something works, build it. at the time, i was a little too impatient to actually grasp the nuances of such advice, because i had the immediate gratification of well-built programs and tools to carry out whatever tasks i needed to. but as i…
over the past few days, i’ve been writing tools that automate cumbersome manual tasks and make my workflow/toolchain cleaner and pushing them to my personal github. the latest one in this series is a tool i call gdbExtract . as a security researcher, i spend a lot of time diving deep into the worlds of software security and system analysis. in these domains, binary analysis and reverse…
this was my first roll of black + white film. i have to say, i had a lot of fun shooting with it because i wasn’t preoccupied with colour and got to focus instead on the moods and shadows of the shots. people here’s my friend sib, writing a message to his friend. my girlfriend joey. events these next few shots are from a protest in toronto. thousands of people had gathered to speak out…
portra 800 is probably my favourite film to shoot with. once i’d gotten comfortable enough with the gold 200, i wanted to elevate my colour game with a more light sensitive film and this one is definitely up there. people some shots of friends: sib + kubba, hyder, nisan, and natasha. bonus one of joey. it came out a bit dark, but i kind of like it. also found this one i took of sib having a…
more work with the gold 200, my first and favourite film (until i discovered portra 800 at least). wrapping up the month of october. warm, sunny days and the leaves just starting to change.
the last roll of the manitoba trip. even though it’s a technically “inferior” film, i still love the gold 200 and these shots are some of my favourites.
second roll for the manitoba trip. first time shooting with the portra 800, and it turned out great (even if some shots are blurry).
first time shooting with ultramax 400. the colours seem a little cooler than the gold 200, and definitely not as rich as the portra 800, but i do like the “real” feel of some of these photos. it was also the first of 3 rolls i took along with me on my trip to manitoba, so the photos are a mix of toronto and manitoba scenes.
still practicing. stuck with the gold 200 because it’s a low-cost film, and nice for summer days.
my first ever roll of film + my first ever analog camera. during the summer, i became increasingly disillusioned with our (my) over-dependence on technology, especially given both my career and hobbies are steeped in digitalia. i decided to shoot film, and was able to find a great deal for an intermediate analog camera: the Asahi Pentax Spotmatic SPII. with it came 3 lenses: a 35mm Zeiss Zebra, a…
lately, i’ve been getting more and more into reverse engineering executable programs and using them to gain control of a target machine. it brings to mind what i learned in “microcontrollers and microprocessors”, a really interesting but tough course i took in my 3rd year of electrical engineering. the course dealt with low-level computing, mainly assembly language (aka ASM), and…
if you’ve worked in any sort of SaaS/tech company, odds are you’ve used a CI/CD (continuous integration/continuous delivery and deployment) and DevOps tool. CI/CD is a method used to deliver apps to customers and clients by introducing automation into the stages of app development. it allows orgs to ship software “quickly” and “efficiently” (i used scare quotes…
hello! it’s been a while since my last post, but there’s a reason (i promise). as you may know, this past year i’ve been seriously pursuing security as both a passion and possible career. it’s been a fun time learning and a not-so-fun time applying for jobs (i believe i might have applied to 300+ jobs – seriously). the great news is that i’ve finally got a job…
as i’ve been studying and preparing for my next big certification, the eCPPT (certified professional penetration tester), i had to remind myself to try and keep my skills sharp. since the course material for the eCPPT goes deeply into the fundamentals of topics like assembly, social engineering, etc., i’ve had to take time away from it to keep practicing all that i’ve learned so…
i’m going to talk about one of my favourite rooms on thm, and that is overpass 2. overpass 2 is the 7th room in the “advanced exploitation” chapter, of the “offensive pentesting” path. it’s also the 2nd room in the overpass series, which is about a bunch of computer science students trying to run a company called “overpass”. this room is interesting…
this is a walkthrough for the room “game zone” on tryhackme. this was the 4th room in the “advanced exploitation” chapter, part of the “offensive pentesting” path. i liked this room because i like sql (yes, i know). database security is a very important component of cybersecurity, as databases are used in almost every type of modern organization. at the end of…
over the past year, i felt something i haven’t felt in a long time. passion, for a new hobby and possibly a new field of work: cybersecurity. more specifically, pen(etration)testing. the story is pretty boring. as a kid, i was fascinated by computers. then, like so many young wannabe hackers, i watched “the matrix” and i became even more fascinated. not so much by computers, but…
cracks in the asphalt, cracks in the curb cracks in the sidewalk, cracks in the doors cracks in the walls and cracks in the floor cracks in the glass, cracks in the steel cracks in the marble and cracks in the pillars crack my eyes open to see a little more cracks in my hands, cracks in my feet cracks in my smile, cracks in my face cracks in my youth and cracks in my world
tl;dr github left clicks 0 right clicks 0 keypresses 0 mouse movement 0m jobs platform engineer <redacted> • april 2026 - engineering manager, platform security Turo • oct 2025 - feb 2026 staff software engineer, platform security Turo • nov 2024 - oct 2025 platform security: core platform, backend, frontend, devX. plus: runtime security research, container/cluster hardening, red-teaming…