Senior Principal Security Engineer · Verizon
I break software to understand it, then build the tools to do it again.
I started out in graphic design and web development, then moved into offensive security and stayed there. Today I work as a security architect: writing exploits and the tooling around them, researching CVEs, and designing systems meant to hold up against real attackers.
Public exploits and original research, from unauthenticated RCE to squeezing a shell through a 66-byte buffer.
All research & open sourceUnauthenticated remote code execution
A Go proof-of-concept for the WLS-WSAT XML deserialization flaw in Oracle WebLogic Server, enabling unauthenticated RCE. Widely referenced — 120+ stars on GitHub.
Root via rogue DHCP server
A Scapy-based rogue DHCP server exploiting the NetworkManager integration script command-injection bug to run commands as root on RHEL, CentOS and Fedora. Published to Exploit-DB as EDB-44652.
Reverse shell through a 66-byte buffer
Original research delivering a full reverse shell despite a tiny buffer by reusing the WS2_32.recv call to re-read the active socket. Full writeup hosted here.
Deep-dive writeups on exploit development, shellcode and binary exploitation.
Browse all 31 postsDefeating a 66-byte buffer constraint in Vulnserver's KSTET command by reusing WS2_32.recv to stage and execute a full reverse shell over the live socket.
A structured-exception-handler overwrite exploit for QuickZip 4.60.019, walked through end to end from crash to reliable code execution.
A custom crypter that encrypts shellcode at rest and decrypts it at runtime with authenticated AES-256-GCM. SLAE-1134 assignment #7.
Announcing the release of my CVE-2018-1111 (DynoRoot) exploit, archived on Exploit-DB — a rogue DHCP server that lands root on RHEL/CentOS/Fedora, with a Metasploit module to follow.
I've spent over a decade on both sides of the security line: writing software and taking it apart. Today I'm a Senior Principal Security Engineer at Verizon, working on security architecture, offensive tooling and the systems that need to hold up against real attackers.
Background, expertise & timeline