Descending into information security madness one bit at a time.
Augment your workflow with AI and let agentic AI agentically augment the AI workflow until the workflow itself becomes AI which makes working at AI-native agentic scale feasible. Coding is solved! Vulnerability research is cooked! 10x! 100x! Workflow! AI! I hate hype and I hate hyperbole. It puts me immediately into a wary state and makes it highly unlikely that I’ll engage with a topic.…
Welcome to “It’s not mine!”, a series of articles where I go over vulnerabilities found by other people. Recently the media server Emby was on my mind again because an old vulnerability I’ve reported more than two years ago finally got assigned a CVE (CVE-2025-64325). In the meantime, a much more interesting API vulnerability was disclosed (CVE-2025-64113): This…
My first couple of articles all deal with low-level binary shenanigans. To this day, I think the allure of binary exploitation is very strong . Still, I’ve shifted more towards application and web security in the following years. In this article, both things come together. Sort of. We’re looking at the JavaScript runtime Deno , specifically at its ability to produce stand-alone…
“Reading brings us unknown friends." – Honoré de Balzac I love generalizing an idea that helped me to achieve a specific goal. The research presented in this article started with Kavita , a self-hosted digital library. I wasn’t able to find any meaningful attack vector, so I’ve decided to make it an inside job: By adding a malicious script to an ebook. To my surprise, this…
After the last two articles, I’ve said to myself: Why always go after Jellyfin ? Why not go back to where it all began, the fork from Emby . I wanted to know just how much DNA both projects share these days and was curious if my knowledge of the former proved to be useful. Ultimately, it was useful, because I’ve found three vulnerabilities in version 4.7.14.0 : An unauthenticated…
Roses are chrominance blue, Water is chrominance red, I suggest you, Dive into FFmpeg. – Fred Murpheg, https://youtu.be/9kaIXkImCAM Last time we managed to gain remote code execution on a default Jellyfin instance. Unfortunately we needed a low-privileged user account to make it happen. After seeing how many instances of Jellyfin are directly reachable, I went back to the drawing board.…
“But what is best is what we saved for last. The one sure-fire thing to make your best day ever the best day ever!" — SpongeBob, ‘Jellyfishing’ I always thought of getting a CVE as information security’s rite of passage. Which is probably shallow reasoning, but the symbolic value can’t be denied. Because I really love this stuff, I decided to treat myself to my…
“The fear […] was of being overwhelmed, of disintegrating under a pressure of reality greater than a mind, accustomed to living […] in a cosy world of symbols, could possibly bear." — Aldous Huxley, ‘The Doors of Perception’ If you’ve read anything related to information security in the past, chances are you’ve come across the following term:…
“Mirror, Mirror, on the Wall - Who is the Most Reflected One of All?" — Evil Queen, ‘Snow White and the Seven Dwarfs’ Attackers often times have a distinct advantage: They only need to find and exploit one vulnerability, whereas the defending side tries to defend against an unknown number of unknown threats. Cybersecurity war rhetoric aside, this makes defending a mostly…
“Leave your stupid comments in your pocket!" — Mark, ‘The Room’ We’ve gone from patching binaries by hand, hooking functions with FRIDA and writing our own little virus to finding and exploiting a real-world remote code execution ( RCE ) vulnerability. In keeping with the theme of jumping around , we’re going to have a thorough look at a web app in order to get…
“Mess with the best, die like the REST!" — Dade ‘Zero Cool’ Murphy, ‘Hackers’ Information security is sick ! Having said that, it’s also a rather intimidating affair for me personally. There are so many things to learn, so many subcategories to discover and so many people specializing in only a subset of even those . I never quite knew when to take the…
Roses are red, Violets are blue, Sugar is sweet, And viruses are cool. — Nursery Rhyme Current events yada yada . We’re going to write a virus today! In hindsight it’s obvious that our previous adventures led to the magical realm of malware. What other group of software needs to hide in the trenches of an operating system (or even lower ), always trying to evade detection. In…
“I want to be inside your darkest everything." — Frida Kahlo, ‘The Diary of Frida Kahlo’ Focusing on a tool sometimes gets a bad rap. There’s always this faint aura of incompetence present. In the previous article I’ve already talked about believing in strong fundamentals, which means learning what’s actually going on instead of learning how to use a tool…
“There, that hole. Take a closer look." — Patches, ‘Dark Souls’ Working with a raw binary has something magical. It’s this little black box, created through an arcane process, where all high-level concepts collapse into a single block of bytes. The thought of poking around in binaries seemed intimidating to me at first, but many great tools and resources exist to aid…
“Hello, World!" — Frederic, ’the Internet’ There, I said it. This humble site will end years of just lurking in the shadows of the Internet and finally allow me to produce and present things myself. What a cosy little place it’ll be :).