~/research
Vulnerability research, public exploits and the tooling built along the way. Everything here was researched and disclosed responsibly.
From unauthenticated RCE to memory-corruption primitives.
Unauthenticated remote code execution
A Go proof-of-concept for the WLS-WSAT XML deserialization flaw in Oracle WebLogic Server, enabling unauthenticated RCE. Widely referenced — 120+ stars on GitHub.
Root via rogue DHCP server
A Scapy-based rogue DHCP server exploiting the NetworkManager integration script command-injection bug to run commands as root on RHEL, CentOS and Fedora. Published to Exploit-DB as EDB-44652.
Reverse shell through a 66-byte buffer
Original research delivering a full reverse shell despite a tiny buffer by reusing the WS2_32.recv call to re-read the active socket. Full writeup hosted here.
Code execution via SEH overwrite
A structured-exception-handler overwrite exploit for QuickZip 4.60.019, documented from crash to reliable control of execution.
Remote code execution
A from-scratch stack buffer overflow exploit for the MiniShare HTTP server, a canonical walkthrough from offset discovery to shell.
Libraries and utilities, mostly in Go, Python and TypeScript.
Generate Ansible directory structures quickly and consistently.
An APISpec plugin that lets you document APIs with Pydantic models instead of Marshmallow.
The complete set of SecurityTube Linux Assembly Expert (SLAE-1134) assignments — shellcode, encoders, egghunters and a crypter.
An RFC 2622 / RFC 4012 compliant Routing Policy Specification Language utility.
A faithful TypeScript port of Python's ipaddress module.
List, view and download .gitignore templates from GitHub's gitignore repo.
An asyncio-powered coroutine worker pool.