Latest writing
February 9, 2026
Building a Headless Browser Exploit with Claude Opus 4.6
December 27, 2025
Hunting for Deserialization Gadgets in the Rails Ecosystem
December 4, 2025
OSWE: 4 Years Later
October 21, 2025
DNS Rebinding Attacks Against SSRF Protections
June 11, 2022
Sandboxing Code Execution
June 7, 2022
Threat Modeling Modern Applications - An Interview Guide
March 5, 2022
Building Custom Detection Signatures (SAST)
February 18, 2022
Java Deserialization Vulnerabilities
December 2, 2021
SSTI In Python Frameworks
November 5, 2021
Discovering a Blind SQL Injection: Whitebox Approach