Arsenal
The tools I keep within reach. Nothing exotic—solid, well understood. A good craftsman knows their tools better than their collection.
// reverse engineering
The reference disassembler and decompiler. Scriptable, free, formidable on native code.
Dynamic debugging on Windows. Essential for watching a binary unpack itself in memory.
Command-line analysis, quick to script. For fast triage and automation.
Symbolic execution. When solving a constraint by hand would cost hours.
// binary exploitation
The pwn Swiss army knife: ROP, packing, network interaction, all in Python.
Augmented Linux debugging: heap, ROP, visual context at every step.
Gadget extraction for building ROP chains against NX.
Find the one-jump RCE in libc when space is tight.
// web & network
Intercepting proxy, the workshop of every app test: replay, fuzzing, analysis.
Content and parameter fuzzing, fast and scriptable.
Read traffic at the source. Often the truth is in the packet.
Template-based detection to cover ground without reinventing the wheel.
// forensics & crypto
Memory dump analysis: hidden processes, injection, network artifacts.
The "cyber Swiss army knife": encodings, ciphers, chained unwrapping.
The crypto-challenge companion: modular arithmetic, lattices, curves.
Spot and extract filesystems and embedded data inside firmware.
// governance, risk & compliance
NIS2, CyFun 2025, ISO 27001/27002: the shared grammar between tech and leadership.
Turn a finding into likelihood × impact, prioritized, traceable down to the control.
Dashboards that read well in the field—evidence, gap, action plan—not dead PDFs.
Without evidence, a control doesn't exist. Structured collection makes the difference in an audit.
A tool never replaces understanding. The best one on the list is the one you know to put down when you should not use it. The rest is method and patience.