I work in digital forensics and incident response at Huntress, and my curiosity keeps me busy with security research outside work.
All posts
-
Plugin Trust Reaches the OS: OBS and Obsidian
Two minimal Windows tests: an OBS Lua hotkey and an Obsidian plugin that execute local OS commands.
Field Notes -
Hiding ClickFix Payloads in Browser Cache
I staged harmless PowerShell in Edge's cache and tested reading it back through Windows Run.
Field Notes -
Detecting Active Directory Attacks
CTF writeups for Detecting Active Directory Attacks, organized by challenge.
Challenge -
One Time Code Phishing Inside Minecraft
A Paper dialog relays an email and one-time code through a local backend to a Microsoft sign-in browser session.
Field Notes -
Mozi like DHT Identities: Persistence, Churn and IOC Overlap
Actively querying the BitTorrent DHT for Mozi-like IDs, tracking returning endpoints, and correlating the addresses with abuse.ch records.
Field Notes -
I Mapped Nearly a Million Proxy IPs
I mapped nearly a million proxy IPs across 711, IP Royal and Proxy Seller, then looked at overlap, geography and ASNs.
Field Notes -
Your Steam Games Suck: 4 RCEs and Counting
Four Steam game code-execution paths through courses, maps and mods.
Blog -
Crosshair X URI to Code Execution via SVG Injection
Crosshair X 15.5.3 code execution through a crafted URI or a shared Steam Workshop crosshair.
Blog -
Putting a Popup Inside Steam
I saw a fake Steam alert in a tweet and tried the basic popup trick on my own client.
Field Notes -
Dude, Where's My DLL?
DLL hijacking I've seen in incidents, what I've added to HijackLibs, and what I found inside FudCrypt.
Blog -
The Chrome Extension Economy, and How Trust Gets Hijacked
I bought 16 Chrome extensions to see what changes hands in an ownership transfer: the code, the users, and the ability to send them updates.
Blog -
Shipping ClipShield, a Browser Extension That Blocks ClickFix and Clipboard Attacks
How I built ClipShield to catch ClickFix-style clipboard attacks, and why it runs locally without telemetry.
Blog -
Operation Blackout — Hack The Box Sherlock Notes
Tracing virtualization checks through PowerShell event logs with Chainsaw.
Challenge -
EscapeTwo — Hack The Box Walkthrough
From an assumed-breach account and exposed spreadsheet credentials to WinRM, directory control, and an administrator hash.
Challenge -
Inside a Low-Budget Spyware Operation
I found an exposed mobile spyware panel, traced its infrastructure, and followed the mistakes that left victim data visible.
Blog -
How I found an infinite money bug in a rewards platform
I found a way to spend reward points, reclaim them through a comment edit, and bypass the vendor's first fix.
Blog -
Brutus — Hack The Box Sherlock
Reconstructing an SSH brute force, root login, and persistence account from auth.log and wtmp.
Challenge -
Code — Hack The Box Walkthrough
Bypassing a Python editor's string filter, recovering an SSH credential, and using a privileged backup task to reach root's files.
Challenge -
How we got code execution on a government satellite system
We followed a public lead to a NOAA web application, found command injection, and reported it to the agency.
Blog -
Forest — Hack The Box Walkthrough
A domain controller, AS-REP roasting, BloodHound, and a path to domain administrator.
Challenge -
Investigating Windows — TryHackMe Walkthrough
Following Windows account, logon, startup, and process clues in a forensic lab.
Challenge -
Remote Process Execution with Scheduled Tasks
A TryHackMe lab demonstration of creating, running, and removing a task on a remote Windows host.
Challenge -
Netmon — Hack The Box Walkthrough
Anonymous FTP, a PRTG configuration backup, and authenticated command execution.
Challenge -
Blue — Hack The Box Walkthrough
Identifying MS17-010 on an SMB service and confirming code execution on the Blue lab machine.
Challenge -
Bastion — Hack The Box Walkthrough
Recovering Windows credentials from an exposed backup, then following an mRemoteNG connection file to administrator access.
Challenge -
Heist — Hack The Box Walkthrough
Using a guest helpdesk page and Cisco configuration to reach a Windows account, then investigating a running browser.
Challenge -
Stonks — picoCTF Format String Walkthrough
Reading a flag from process memory through an unsafe printf call.
Challenge -
LFI to RCE via Log Poisoning
How a TryHackMe Advent of Cyber lab turned a local file inclusion bug into PHP code execution through an application access log.
Challenge -
Memory Forensics with Volatility — TryHackMe
Examining a Cridex memory image with Volatility's process, module, and extraction plugins.
Challenge -
Horizontall — Hack The Box Walkthrough
Finding a Strapi API through frontend JavaScript, then reaching a local Laravel service.
Challenge