I just finished up a phone call with a "stealth startup" that was pitching an idea that agents could generate code securely via an MCP server. Needless to say, the phone call did not go well. What follows is a recap of the conversation where I just shot down…

Drivers are a common part of every Windows environment, and many of them provide low-level functionality. This blog details how to connect…

Background: Modern adversaries increasingly hide command-and-control (C2) traffic inside cloud services. We built this proof of concept…

Exploiting the mechanism that automatically searches for additional executable files when Windows detects that the requested file does not exist

Information Security Services. Offensive Security, Penetration Testing, Mobile and Application, Purple Team, Red Team

Exploiting vulnerability in the update mechanism of Windows Defender by using a symbolic link folder. Destroying or injecting code into Defender

We’re back - it’s a day, in a month, in a year - and once again, something has happened.

In this week’s episode of “the Internet is made of string and there is literally no evidence to suggest otherwise”, we present even further evidence that as a

When you're handed an SDK with no documentation and told "the backend is secure because it's proprietary," grpc-scan helps prove otherwise

Welcome to 2026!

While we are all waiting for the scheduled SSLVPN ITW exploitation programming that occurs every January, we’re back from Christmas and idle hands, idle minds, yada yada.

In December, we were alerted to a vulnerability in SmarterTools’…

Technical analysis of Starlink terminal telemetry showing GPS spoofing detection during Iran's January 2026 internet shutdown - narimangharib/starlink-iran-gps-spoofing

The OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics. - OWASP/CheatSheetSeries