Categories

N°01 · 1986-01-08

Hacker's Manifesto

The Mentor's 1986 text, written days after his arrest. Kept here because it still says why curiosity gets mistaken for crime.

N°08 · 2019-09-02

HackTheBox OneTwoSeven Writeup [eng]

The most educational box I have solved — an SSH-tunneled admin panel, a hijacked APT repository, and a chain that only works if each step is understood, not copied.

N°07 · 2019-08-03

HackTheBox Fortune Writeup [eng]

OpenBSD, so nothing behaves as expected: command injection into an authpf-gated network, an NFS export that leaks a private key, and pgAdmin credentials for the final step.

N°05 · 2019-05-06

TSG CTF - Obliterated File 1-2 Writeup [eng]

Two TSG CTF forensics challenges, both about git internals — recovering a flag from objects a committer thought they had obliterated.

N°04 · 2019-05-02

UTSA Cyber CTF - Linux2 Writeup [eng]

A UTSA Cyber CTF Linux challenge solved with plain enumeration: read the sudo rules, notice the Docker group, and the box hands you root.

N°03 · 2018-09-25

HackTheBox Olympus Writeup [eng]

Port knocking and a DNS zone transfer open the door; from there Xdebug RCE and a misconfigured Docker socket carry the box to root.

N°02 · 2018-09-22

HackTheBox Poison Writeup [eng]

LFI on a retired HackTheBox machine, turned into a shell through log poisoning — then a base64-encoded secret and a tunneled VNC session for root.

N°06 · 2019-05-13

Python - Module and Library Hijacking [eng]

Module vs library hijacking in Python, and why sys.path order is a privilege escalation primitive when a root process imports the wrong file first.

N°09 · 2021-02-06

Discovering an Undisclosed Stack Overflow Vulnerability in Microsoft SQL Server (CVE-2019-1068)

Root cause analysis of a silently patched stack overflow in svl.dll, reversed out of Microsoft SQL Server and rebuilt into a working proof of concept.

N°11 · 2026-08-07

AI Orchestration, Episode 1: Four CVEs in the Tree I Was Standing On

I pointed my own multi-agent review system at my own dependency tree — re2 and stream-json, about 12.1M npm downloads a week between them. Four accepted advisories came out, and this is the honest account of how, including the parts where the process nearly threw a finding away.

N°10 · 2026-06-21

Gossipcat: Teaching AI Agents to Catch Each Other Lying

Single-agent AI review states hallucinations with the same confidence as real findings, and never learns. Gossipcat makes agents verify each other against the source, and turns the verdicts into reward signal.