Where was Mythos when WordPress fell?
On marketing claims nobody checks, the 1,000 projects Anthropic never listed, and why an industry full of experts followed along.
Research
Vulnerability research, technical walkthroughs, and writing, wherever I published it.
2026
CargoWise WebTracker — The Keys Were in the Cargo ↗
Credentials recoverable from a logistics platform's own tracking interface.
Keys to the Kingdom: Anonymous SQL Injection in Drupal Core ↗
Unauthenticated SQL injection reachable in Drupal core.
To Kara, Alex, and Michiel — Your Researchers Are Leaving
Bug bounty platforms never humanized researchers or triage. Now they're drowning in AI slop and wondering why their best people are leaving.
New Age of Collisions: Pre-Auth Arbitrary File Read as root in cPanel ↗
Reading arbitrary files pre-authentication, as root, on cPanel.
Hyoketsu — Solving the Vendor Dependency Problem in RE ↗
Tooling for reverse engineering without waiting on vendor firmware.
Running h1-brain Against a Real Target
A start-to-finish walkthrough of using h1-brain on an actual program. From hack() briefing to attack plan.
Teaching Claude Everything You've Hacked
h1-brain is an MCP server that gives Claude your HackerOne bounty history and a database of public disclosures. Setup and first sync.
What h1-brain Actually Does
Every tool in h1-brain, explained. Your reports, public disclosures, and the hack() briefing that ties them together.
Replaced by a Goldfish
Opus 4.6, the pentesting hype, and why most of the AI discourse around security is just noise.
Daily Workflows with the Email Agent
Real usage patterns for an AI email agent — morning triage, thread summaries, draft replies, and where the human stays in the loop.
Gmail API Credentials the Paranoid Way
Setting up Google Cloud OAuth credentials with minimal scopes for an AI email agent — because 'full access' is never the right default.
Guardrails That Actually Work
A four-layer defense model for AI email agents — because no single safety measure is enough when your inbox is on the line.
Wiring Gmail into OpenClaw
Installing the Gmail MCP server, configuring agent tools, and filtering down to only the operations you actually want.
Writing a SOUL.md for Email
Defining hard rules, tone guidelines, and PII handling for an AI email agent — because 'be helpful' isn't a security policy.
Syncing Obsidian to a Headless Server
Running Obsidian in a headless Docker container with Obsidian Sync, giving AI agents direct access to your vault.
Connecting Claude Max and Telegram
Using OAuth credentials from a Claude Max subscription to power OpenClaw agents, and wiring up a Telegram bot for mobile access.
Securing the Dashboard with Nginx Proxy Manager
Putting the OpenClaw Control UI behind HTTPS with basic auth, WebSocket passthrough, and a proper Content Security Policy — all through Nginx Proxy Manager.
Setting Up OpenClaw on a Hetzner ARM64 Server
Getting Node.js 22 and OpenClaw running on a fresh Hetzner CAX ARM64 Ubuntu Noble server — including the ARM64 gotchas nobody warns you about.
2020
Jolokia endpoints: JNDI RCE and heap dumps
A full lab build and exploitation walkthrough for exposed Jolokia JMX endpoints: reflected XSS (CVE-2018-1000129), JNDI remote code execution via a rogue LDAP server (CVE-2018-1000130), and dumping the Java heap to recover credentials.
2018
Visual recon with Aquatone and WebScreenshot
A VPS-based workflow chaining Aquatone subdomain discovery, WebScreenshot capture and express-photo-gallery into a browsable wall of screenshots for triaging a large attack surface.
2017
Android certificate pinning bypass with Frida
A walkthrough of installing the Burp CA on an Android device, running frida-server and using an SSL re-pinning Frida script to intercept traffic from apps that pin certificates.
2016
.htpasswd exposed, DES hash cracked
Directory brute-forcing a private bug bounty target turned up a world-readable .htpasswd whose descrypt hash, once cracked, opened four staging and development subdomains.
Google Cloud Console: dormant stored XSS
An XSS payload stored as a Google Cloud project name executed months later in the unfiltered project-deletion error message, earning a $5,000 VRP reward, plus the impact argument that got it past a self-XSS classification.
2015
Shopify POS firmware: extracting a root hash
An in-scope Shopify POS endpoint exposed the card reader's firmware bundles, which unpack via binwalk, a dd carve at 0x202024 and jffs2dump into a JFFS2 root filesystem containing a salted MD5 root hash.
Stop OS X Spotlight Leaking Your Location
Proxying OS X Spotlight through Burp showed it shipping the user's latitude and longitude to api.smoot.apple.com on every search, with two ways to block the request.
XSS via XML File Upload on PayPal
PayPal's invoicing feature accepted .xml attachments, and an XHTML-namespaced script element inside the XML executed when the file was served back. Includes the exploitability argument needed to qualify it for a bounty.
2014
PayPal merchant directory reflected XSS
A duplicated q parameter in PayPal's merchant directory let an injected payload break out of script context, producing a reflected XSS that PayPal patched within days.
Hijacking a Prezi Subdomain Redirect ($500)
mailroom.prezi.com concatenated the request path onto its own hostname when redirecting, so a request to /.attacker-domain sent victims to a lookalike attacker-controlled host.
BillMeLater: XSS Through a Style Attribute
A Firefox-only reflected XSS on wwwb.search.billmelater.com, achieved by closing out of a style attribute and injecting a fresh script element, which the vendor classified as out of scope.
Two Weeks of a Kippo SSH Honeypot
Results from two weeks of a Kippo SSH honeypot in November 2014: roughly 4,000 brute-force attempts, 2,500 distinct credential pairs, and a source distribution dominated by hosts in China.
PayPal Stored XSS via a Signup Flow Bypass
A stored XSS in PayPal's account name field, delivered to arbitrary users through invoices after bypassing the signup flow's security check by truncating the workflow URL to /webapps/.
DOM XSS on PayPal's Main Domain
A payload placed in the URL fragment reached a DOM sink on PayPal's main domain and executed; PayPal closed the report as a duplicate.
XSS in Google Tag Manager via JSON Import
Google Tag Manager validated macro names in the web UI but not in the JSON container import path, so a payload smuggled through a file upload executed and earned a $5,000 bounty.
Stored XSS in Three WordPress Chat Plugins
WP Live Chat Support, MyLiveChat and Provide Support all accepted stored cross-site scripting during a 2014 customer install.
Chrome backslash URLs and XSS filter bypass
Chrome resolves and executes a script URL written as http: followed by any number of backslashes. Firefox does not, and that difference can slip past pattern-matching XSS filters, closed by Chromium as wontfix.
Path Traversal on map.prezi.com ($1,000)
A path traversal issue on Prezi's map.prezi.com subdomain, fixed within two days of reporting and rewarded with a $1,000 bounty.
Seven PayPal Bugs, Zero Bounties
A 2014 run through PayPal's bug bounty scope: seven confirmed issues across paypal.com, financing.paypal.com, apps.paypal.com and the paypal-*.com family, all closed as duplicate or invalid.
2013
160 German tax office sites vulnerable to XSS
Reflected cross-site scripting across 160 German tax office websites, disclosed via heise.de and forwarded to CERT-Bund for coordinated remediation.
PHP 5.3.3–5.3.6 socket_connect Bind Shell
A public PHP 5.3.3-5.3.6 socket_connect exploit carrying a bind-TCP shell payload, dropped as an uploaded PHP file and located with an nmap sweep of ports 4000-4500.
SQL injection to root on a 2013 lab box
Chaining a login-form SQL injection through sqlmap's --os-shell into a Linux 2.6.32 local root exploit to go from the 'nobody' user to full control of the server.
iTunes anti-debugging bypass with GDB and LLDB
Defeating iTunes' ptrace-based anti-debugging on OS X by breaking on ptrace and rewriting the rdi register, and porting the bypass from Apple's GDB to LLDB to get a Python-capable debugger.
Yahoo's /14 and an exposed phpinfo.php
Pivoting from Yahoo's main A record to its ARIN netblock and sweeping all 260,000 addresses in the /14 for an exposed phpinfo.php.