Latest writing
February 9, 2026
Building a Headless Browser Exploit with Claude Opus 4.6
January 4, 2026
Hunting for Deserialization Gadgets in the Rails Ecosystem
December 17, 2025
DNS Rebinding Attacks Against SSRF Protections
December 4, 2025
OSWE: 4 Years Later
June 11, 2022
Sandboxing Code Execution
March 5, 2022
Building Custom Detection Signatures (SAST)
February 18, 2022
Java Deserialization Vulnerabilities
January 19, 2022
Automating DAST Scanning with OWASP ZAP
December 2, 2021
SSTI In Python Frameworks
November 5, 2021
Discovering a Blind SQL Injection: Whitebox Approach