Everything I've published,
in one feed.
9 posts across writeups, research, and technical deep-dives. Filter by tag.
Why I wanted my own code audit tool
Less technical than usual. The story of sek, the code audit tool I'm building: where the idea came from, my failed first attempt (spotted), the restart on Joern, the Rust backend I picked against my will, and the weird feeling of thinking you're done when you're not.
My First Bug Bounty: A DOM XSS
I found my first DOM-based XSS in a bug bounty program. No SQLi, no RCE - just a missing origin check in a postMessage listener and a javascript: URI. CVSS 9.0. Sink-to-source analysis, exploit chain, and some bonus impact.
Semgrep Architecture: Comprehensive Reference
A deep technical reference on how Semgrep works internally - from CLI entry-point and target discovery, through parsing, AST normalisation, pattern matching and taint dataflow analysis, to output formatting.
Une nuit pour hacker 2026: Thread of Doom
CTF reverse-engineering writeup: static analysis of a Windows crackme in Ghidra recovers an XOR flag from the decompilation, skipping every anti-debug check.
Enketo 6.2.1 - Auth-Bypass, SSRF, and XXE Browser Abuse to File Read
This article is the result of an OffenSkill Training. It discusses an unauthenticated arbitrary file read vulnerability found in the Enketo software, a web survey manager. The vulnerability, found during a white-box code review session, allows an unauthenticated attacker to read any arbitrary file on the server's by chaining an auth bypass, SSRF, XXE in svg and browser abuses.
Amazon AppSec CTF: HalCrypto
CTF writeup: a JWT jku URL check uses lastIndexOf instead of real parsing, so an @ symbol tricks it into trusting an attacker-hosted JWKS and bypasses auth.
Amazon AppSec CTF: PageOneHTML
CTF writeup: an image-fetching helper on node-libcurl accepts any protocol, turning a markdown converter into an SSRF reaching an internal API via gopher://.
Understanding Code Property Graphs
Why AST, CFG, and PDG each fall short for security review, and how Code Property Graphs unify them into one queryable structure, with an intro to Joern.
Code auditing 101
A tour of code auditing fundamentals: manual review vs SAST, taint analysis, sink-to-source vs source-to-sink, and picking a SAST tool people will use.