all posts

Everything I've published,
in one feed.

9 posts across writeups, research, and technical deep-dives. Filter by tag.

9 posts
2026.06.12
Code AuditingSASTJoern

Why I wanted my own code audit tool

Less technical than usual. The story of sek, the code audit tool I'm building: where the idea came from, my failed first attempt (spotted), the restart on Joern, the Rust backend I picked against my will, and the weird feeling of thinking you're done when you're not.

10 min
2026.05.10
Bug BountyXSSDOM XSS

My First Bug Bounty: A DOM XSS

I found my first DOM-based XSS in a bug bounty program. No SQLi, no RCE - just a missing origin check in a postMessage listener and a javascript: URI. CVSS 9.0. Sink-to-source analysis, exploit chain, and some bonus impact.

9 min
2026.04.08
ResearchSASTSemgrep

Semgrep Architecture: Comprehensive Reference

A deep technical reference on how Semgrep works internally - from CLI entry-point and target discovery, through parsing, AST normalisation, pattern matching and taint dataflow analysis, to output formatting.

17 min
2026.03.29
CTFReverse EngineeringWindows

Une nuit pour hacker 2026: Thread of Doom

CTF reverse-engineering writeup: static analysis of a Windows crackme in Ghidra recovers an XOR flag from the decompilation, skipping every anti-debug check.

18 min
2026.02.07
0daySSRFXXE

Enketo 6.2.1 - Auth-Bypass, SSRF, and XXE Browser Abuse to File Read

This article is the result of an OffenSkill Training. It discusses an unauthenticated arbitrary file read vulnerability found in the Enketo software, a web survey manager. The vulnerability, found during a white-box code review session, allows an unauthenticated attacker to read any arbitrary file on the server's by chaining an auth bypass, SSRF, XXE in svg and browser abuses.

10 min
2025.09.21
CTFWeb SecurityJWT

Amazon AppSec CTF: HalCrypto

CTF writeup: a JWT jku URL check uses lastIndexOf instead of real parsing, so an @ symbol tricks it into trusting an attacker-hosted JWKS and bypasses auth.

6 min
2025.09.21
CTFWeb SecuritySSRF

Amazon AppSec CTF: PageOneHTML

CTF writeup: an image-fetching helper on node-libcurl accepts any protocol, turning a markdown converter into an SSRF reaching an internal API via gopher://.

5 min
2025.08.05
ResearchCPGStatic Analysis

Understanding Code Property Graphs

Why AST, CFG, and PDG each fall short for security review, and how Code Property Graphs unify them into one queryable structure, with an intro to Joern.

22 min
2025.08.02
ResearchSASTStatic Analysis

Code auditing 101

A tour of code auditing fundamentals: manual review vs SAST, taint analysis, sink-to-source vs source-to-sink, and picking a SAST tool people will use.

21 min
>_ esc