Field Notes
Quick observations, adversary emulation, and whatever else catches my eye.
-
Internet Dumpster diving OpenDirs
Ten capture analyses from exposed directory listings, each preserved in its own expandable section.
-
Plugin Trust Reaches the OS: OBS and Obsidian
Two minimal Windows tests: an OBS Lua hotkey and an Obsidian plugin that execute local OS commands.
-
Hiding ClickFix Payloads in Browser Cache
I staged harmless PowerShell in Edge's cache and tested reading it back through Windows Run.
-
One Time Code Phishing Inside Minecraft
A Paper dialog relays an email and one-time code through a local backend to a Microsoft sign-in browser session.
-
Mozi like DHT Identities: Persistence, Churn and IOC Overlap
Actively querying the BitTorrent DHT for Mozi-like IDs, tracking returning endpoints, and correlating the addresses with abuse.ch records.
-
I Mapped Nearly a Million Proxy IPs
I mapped nearly a million proxy IPs across 711, IP Royal and Proxy Seller, then looked at overlap, geography and ASNs.
-
Putting a Popup Inside Steam
I saw a fake Steam alert in a tweet and tried the basic popup trick on my own client.
-
CryBound JAR Basic: A Fabric Mod With a Memory-Only Loader
CryBound fingerprints a Minecraft host, authenticates to its C2, verifies chunked pack delivery, unwraps five crypto layers, and loads Java classes in memory.