Blog
Notes from the field.
Write-ups, research and lessons from security work, newest first.
12 of 12 posts
- 18 Apr 2026 · 6 min readFrom PyCon JP 2024 speaker to PyCon JP 2026 organiserHow Python shaped my offensive security work, what I presented at PyCon JP 2024 in Tokyo, and how it led to joining the PyCon JP 2026 organising team.#PyCon#pyconjp#cybersecurityRead the post
- 11 Sep 2023 · 5 min readGetting started with hardware hacking: toolsThe basics and tools to start hardware hacking: electronics fundamentals, soldering irons, multimeters, SPI flash programmers, USB-UART and Flipper Zero.Read the post
- 9 Sep 2023 · 4 min readHardware hacking: bridging the cybersecurity gapHow a childhood spent repairing electronics led me to hardware hacking, and why hardware skills matter for closing gaps in cybersecurity.Read the post
- 2 Aug 2023 · 1 min readNavigating the regex maze with ease: ReGenReGen is a small open source tool that builds regex patterns from values you select in logs or text, for forensics, attack, defence and validation work.Read the post
- 4 Feb 2023 · 3 min readNepali Girl: trojan analysisAnalysis of Nepali Girl, an Android trojan that spread in Nepal through WhatsApp for over a month, stealing sensitive data from victims' phones.Read the post
- 17 Nov 2022 · 3 min readMEGA's unlimited cloud storage vulnerabilityHow a flaw in MEGA's cloud storage let a free account store about 1,300 GB of data despite the 20 GB limit, found in June 2022 without any tools.#megacloud#Security#vulnerabilityRead the post
- 12 Jul 2022 · 2 min readLeveraging SQL injection to execute XSS by evading CSPHow a SQL injection was used to get past a content security policy (CSP) and execute XSS, starting with a short introduction to how CSP works.#csp bypass#sqlinjectionRead the post
- 26 Nov 2019 · 1 min readReflected XSS leading to CSRF bypass and account takeoverHow a reflected XSS was chained to steal a CSRF token and change a victim's password, bypassing CSRF protection to take over the account.#rxss#cross site scriptingRead the post
- 19 Jun 2019 · 3 min readXSS on samy.plHow a javascript: URL got past the source-viewing blocks on samy.pl, the site of security researcher Samy Kamkar, and the XSS issue behind it.#Samy-kamkar#samy-worm#XSSRead the post
- 21 Aug 2017 · 3 min readCVE-2021-3258: stored XSS and account takeover in Q2AA proof of concept for CVE-2021-3258, a stored XSS in a Question2Answer (Q2A) theme that led to site defacement and account takeover.#Stored-XSS#CVERead the post
- 22 Nov 2016 · 1 min readFacebook SVG Locky ransomware analysisHow a malicious SVG file spreading on Facebook redirected victims to a fake YouTube page that pushed a browser extension tied to Locky ransomware.#Facebook#ransomwareRead the post
- 11 Sep 2016 · 2 min readBypassing eBay's XSS protectionA proof of concept for a POST-based reflected XSS I found in eBay's customer service search in 2016, and how its XSS protection was bypassed.Read the post
Let's scope it together.
Tell me what you need to protect and by when. I'll reply with whether I can help and how I'd approach it.