Archives

2026

  • Testing Jev as a gate for agent-submitted knowledge

    • misc

    I got access to Jev and have been brainstorming cybersecurity projects to try it on. But I wanted to try it on something simple first, so I integrated it into a personal project: my existing knowledge vault for agents. In this integration, Jev evaluates proposed notes against review questions and returns probabilities that the application uses to decide what goes in.

    The vault uses Obsidian as a backend and Khoj for retrieval. It stores information that agents can use in future tasks, including project facts, shared capabilities, decisions and their reasons, and verified lessons.

    The tricky part is deciding what deserves to go in. Something that failed on one machine might be useful to remember, but that doesn't mean it should become a rule saying it always fails. An agent finding that note later needs to know the difference.

    I've used calls to Claude or Codex to help determine what …

  • AI, jailbreaks, and 150GB of unanswered questions

    • Cybersecurity x AI

    A hacker allegedly jailbroke Claude to hack Mexican government agencies, but key details remain unverified. Plus Claude Code and Copilot vulns, and Chinese AI firms stealing Anthropic's model.

  • The threat model that made me sandbox my AI agents

    • Security

    AI coding agents have shell access to your machine. I mapped out the threats before letting one touch my code, then built Claudecker to contain them.

  • Your AI Assistant Might Be Working for Someone Else

    • Cybersecurity x AI

    Copilot and Grok repurposed as C2 channels, Cline supply chain attack installed AI agents on 4,000 dev machines, and AI found 12 zero-days in OpenSSL.

  • AI Agents Under Attack

    • Cybersecurity x AI

    AI security roundup: Claude finds 500+ vulns in open-source libs, LLMs conduct autonomous network breaches, and AI agent attack surfaces keep expanding.

  • Building a session retrospective skill for Claude Code

    • Misc

    A Claude Code skill that reads the session JSONL history and generates a human-readable markdown retrospective covering problems, decisions, and key takeaways.

  • Developer Tools Are the New Attack Surface

    • Cybersecurity x AI

    VS Code AI extensions with 1.5M installs stealing source code, 175K Ollama servers exposed globally, and AI running autonomous multi-stage network attacks.

  • Running AI agents in a box because I don't trust them

    • Tools

    Claudecker is my Docker wrapper for Claude Code that isolates AI agents from my host with network lockdown, per-project custom images, and SSH agent forwarding.

2023

2022

2021

  • Cyber Corp Case 2 Writeup - Part 3

    • Threat Hunting

    CyberCorp Case 2 part 3 — certutil download, LSASS dumping, WMI lateral movement to a domain controller, and tracking the second reverse shell C2 address.

  • Cyber Corp Case 2 Writeup - Part 2

    • Threat Hunting

    CyberCorp Case 2 part 2 — decoding a base64 gzipped registry payload, tracing PID spoofing in PowerShell, and identifying the reverse shell C2 IP.

  • Cyber Corp Case 2 Writeup - Part 1

    • Threat Hunting

    CyberCorp Case 2 threat hunting walkthrough — tracking WMI persistence, a malicious Word document, and a hidden iexproxy.dll download technique in Kibana.

  • New Tool Preview: vATT&CK

    • Tools

    vATT&CK is a visual relationship mapper for MITRE ATT&CK that shows linked malware, threat groups, mitigations, and subtechniques in a single interactive graph.

  • IOLI Crackme 0x04

    • Reverse Engineering

    IOLI Crackme 0x04 walkthrough — the password is any digits that sum to 15, revealed by tracing sscanf-based accumulation through static analysis in IDA.

  • Building my Virtual Cybersecurity Home Lab

    • Malware Analysis

    How I built a virtual cybersecurity home lab with pfSense, Metasploitable, Kali, Splunk, Snort, and a dedicated malware analysis network using Remnux.

  • Making a RAT

    • Malware Analysis

    Building RATwurst, a RAT in C and Python, with runtime DLL loading, socket comms, anti-sandbox checks, and basic AV evasion — for educational purposes only.

  • Finding phished passwords on a scam site

    • Security

    How I found a publicly accessible victims.txt file storing phished Facebook credentials on a 000webhost server and what happened when I reported it.

  • Emprisa Maldoc Writeup

    • CTF

    Writeup for the Emprisa Maldoc CTF — analyzing a CVE-2017-18822 exploit using rtfdump, speakeasy shellcode emulation, and EQNEDT32 process debugging.

  • Investigating an FB phishing site

    • Security

    OSINT into a Facebook phishing campaign spreading via friend-tagging — separate hosting domains, Vietnamese code traces, and possible Phishing-as-a-Service.

  • The Emprisa Maldoc Challenge

    • CTF

    How I turned a real-world malicious document exploit into the Emprisa Maldoc CTF on CyberDefenders — 14 questions targeting intermediate maldoc analysts.

  • IOLI Crackme 0x03

    • Reverse Engineering

    IOLI Crackme 0x03 walkthrough — reverse engineering a Caesar-style cipher that shifts each character by 3 to decode garbled success and failure strings.

  • Maldoc101 Writeup (Part 2)

    • Malware Analysis

    Continuing the Maldoc101 malware analysis — decoding obfuscated VBA string concatenation to reveal WMI class references used for process execution.

  • Maldoc101 Writeup (Part 1)

    • Malware Analysis

    Step-by-step maldoc analysis of the Maldoc101 challenge using oledump and olevba — deobfuscating VBA macros and tracing the WMI process execution chain.

  • IOLI Crackme 0x02

    • Reverse Engineering

    IOLI Crackme 0x02 walkthrough — computing the password via static analysis of x86 arithmetic, then confirming with dynamic analysis by stepping through IDA.

  • Introducing shcode2exe

    • Tools

    shcode2exe converts raw shellcode blobs or strings into debuggable executables targeting 32 or 64-bit Windows, with no Wine dependency when running on Linux.

  • IOLI Crackme 0x01

    • Reverse Engineering

    IOLI Crackme 0x01 walkthrough — converting hex to decimal to find the password, plus a closer look at how arguments are passed to functions in x86 assembly.

  • IOLI Crackme 0x00

    • Reverse Engineering

    IOLI Crackme 0x00 walkthrough — finding the hardcoded password in IDA Pro and patching the binary to accept any input by changing a jz opcode to jmp.

2020

2018

2017