Binaries confess.
Packets tell the truth.
An ethical hacker's field notes: CTF writeups, reverse engineering notes, and hard-won lessons from picking apart code and networks — all by the book.
Latest writeups
Step-by-step challenge breakdowns, from recon to flag. Reproducible, commented, no black magic.
A classic buffer overflow, NX enabled, and no system within reach. How to chain a ret2plt, a puts@GOT leak and a second pass to drop the shell.
The binary decrypts itself in memory at runtime. We spot the decryption routine, set a breakpoint at the right OEP, and dump the reconstructed image for static analysis.
An image preview that accepts a URL. We pivot to the internal metadata endpoint, grab a token, and show why IMDSv2 changes the game.
What we take apart here
Reverse engineering
Disassembly, dynamic debugging, packer unpacking, firmware and malware analysis in an isolated environment.
Binary exploitation
Stack & heap overflows, ROP, format strings, and defeating mitigations (NX, ASLR, canary, PIE).
Application security
Injections, SSRF, deserialization, attack chains and broken business logic — offensive and defensive alike.
From the field to compliance
Turning a technical finding into risk, evidence and control. NIS2, CyFun, audit: offense in the service of defense.
A challenge, a collab, a question?
Always up for talking exploitation, disassembly, or building a security program that actually holds up.