Posts
-
Disclosure economics in 2026: are bug bounty programs actually faster than an email?
I have reported the same class of bug through a bounty platform and through a plain security@ address in the same year. The bounty was not reliably faster to a fix. Here is what actually moved the timeline, and why the platform sometimes made it worse. -
Anatomy of a Vulnerability Report That Gets Fixed Fast
The companion to the bad-list post. If getting deprioritized taught me how coordination goes wrong, the reports that got fixed in one patch cycle taught me what a triager actually needs on the first read. This is the structure I use now, and the parts that are about writing rather than research. -
What I learned about CVE coordination from getting on a vendor's bad list
Process commentary rather than a writeup. A disclosure I handled badly in 2021 got me quietly deprioritized by a vendor's security team, and it taught me more about how coordination actually works than any of the ones that went smoothly. -
DirtyWords v2: smarter targeting for parameter brute-forcing
The original dirtywords generated password candidates from OSINT. v2 adds a mode that generates targeted HTTP parameter-name wordlists by learning a target's own naming conventions, so the brute-force tries the parameters the application is actually likely to accept first. -
Adding a Slack integration to FAVE: notes from the rebuild
After four years on the shelf, I rebuilt FAVE's output layer to push reconnaissance results into a Slack channel instead of a stdout dump. Here is the architecture, the implementation notes, and the things that did not work on the first pass. -
Five years on, what changed in vendor patching cadence between 2020 and 2026
A narrower follow-up to the April retrospective: looking specifically at how long vendors actually take to ship a fix in 2026, what they publish about the process, and how that compares to the 2020 baseline. -
Five years on: revisiting the Quest UC vulnerabilities and what changed in vendor patching since 2020
A retrospective on the December 2020 Quest Policy Authority for UC advisory, with a sober look at what has actually changed in the vendor-patching ecosystem since. -
mBot v2.0.0: an update to my mission bot for Synack Red Team members
Notes on the v2.0.0 release of mBot - login automation, Discord notifications, mission templates, and target blacklisting. -
Zero Trust Network Access Providers: What to Look For
An overview of zero trust network access providers, evaluation criteria, and how ZTNA differs from traditional VPN-based remote access. -
Hybrid Cloud Security Architecture: Design Patterns and Pitfalls
Security architecture patterns for hybrid cloud environments covering network segmentation, identity federation, encryption, and common misconfigurations. -
API Security Framework: A Practical Guide to Building Secure APIs
A practical framework for API security covering authentication, authorization, input validation, rate limiting, and monitoring based on OWASP API Security Top 10. -
MBot v2 - Mission Bot for Synack Red Team Members
An updated mission monitoring bot for Synack Red Team members that tracks new targets and mission availability. -
FAV/E - Find a Vulnerability/Exposure
A tool for identifying known vulnerabilities and exposures in target environments based on detected software versions. -
CVE-2021-3156: Baron Samedit - Sudo Heap Overflow
Technical analysis of CVE-2021-3156 (Baron Samedit), a heap-based buffer overflow in sudo's sudoedit -s mode that enables local privilege escalation on most Linux distributions. -
Introducing dirtywords - A Targeted Word List Generator
A tool that generates targeted word lists from OSINT data for use in password cracking and authentication testing. -
Advisory: Multiple Vulnerabilities in Quest Policy Authority for Unified Communications
Thirteen vulnerabilities discovered in Quest Policy Authority for Unified Communications version 8.1.2.200, including SSRF, stored XSS, CSRF, and multiple reflected XSS.
subscribe via RSS