Research, written down.
Findings, experiments and notes from my work in web security.
AI agents finding bugs in an AI agent
With the help of an agent, I found four vulnerabilities in the Hermes Agent dashboard, all reachable without an account. The most serious one leads to a session takeover because Python and the browser do not parse the same URL the same way.
Read article
Bugbounty agent benchmark
I built a black box benchmark for bug bounty agents in a week and ran sixteen hundred cells across six models, seven harnesses and one browser. The largest effect I measured was not the harness or the browser: it was waiting a few weeks for the next model.
Building my own AI Agents
From frustration with existing frameworks to building my own agent in under 72 hours — what I learned about memory, SDKs, and the real complexity of AI agents.
2026
1 article- AI agents finding bugs in an AI agentWith the help of an agent, I found four vulnerabilities in the Hermes Agent dashboard, all reachable without an account. The most serious one leads to a session takeover because Python and the browser do not parse the same URL the same way.6 min
- Bugbounty agent benchmarkI built a black box benchmark for bug bounty agents in a week and ran sixteen hundred cells across six models, seven harnesses and one browser. The largest effect I measured was not the harness or the browser: it was waiting a few weeks for the next model.28 min
- Building my own AI AgentsFrom frustration with existing frameworks to building my own agent in under 72 hours — what I learned about memory, SDKs, and the real complexity of AI agents.9 min
- Investigating a Compromised WordPress SiteDiagnosing a WordPress site compromise that was redirecting visitors to adult content and pharmaceutical spam through injected malicious scripts.3 min
2025
12 articles- Hookd: A Lightweight Out-of-Band Interaction ServerHookd - A simple webhook server for testing and debugging.5 min
- Simple Monitoring SolutionSetting up simple monitoring for your services.4 min
- Smart Contract Testing in RemixTesting smart contracts using Remix IDE.6 min
- Ethernaut - Dex TwoSolving the Ethernaut DEX Two challenge.8 min
- Damn Vulnerable Defi : The RewarderSolving The Rewarder challenge from Damn Vulnerable DeFi.9 min
- Damn Vulnerable Defi : Side EntranceSolving the Side Entrance challenge from Damn Vulnerable DeFi.5 min
- Damn Vulnerable Defi : TrusterSolving the Truster challenge from Damn Vulnerable DeFi.6 min
- Damn Vulnerable Defi : Naive ReceiverSolving the Naive Receiver challenge from Damn Vulnerable DeFi.9 min
- Collaborative Code AuditingSetting up a collaborative code auditing environment using code-server.5 min
- Damn Vulnerable Defi : UnstoppableSolving the Unstoppable challenge from Damn Vulnerable DeFi.7 min
- Extract and monitor bugbounty scopesExtracting and monitoring bug bounty scopes automatically.5 min
- Blogging in 2025: My ThoughtsMy journey through various blogging platforms over seven years and why I finally settled on Hugo with GitHub Pages.3 min
2023
1 article2022
3 articles- Basic recon to RCE IIIExploiting command injection through Ruby string interpolation in a Rails application to achieve RCE via DNS exfiltration.6 min
- DNS Tools ComparisonComparing Amass, DNSX, and PureDNS for DNS resolution accuracy and performance in bug bounty reconnaissance.6 min
- Basic recon to RCE IIHow trusting my instincts led to discovering a critical RCE that everyone else missed on a popular bug bounty program.4 min
2021
5 articles- My bounty infrastructureA complete Docker-based infrastructure for bug bounty hunting featuring Traefik, XSS-Catcher, Rengine, and more.6 min
- Basic recon to RCEHow I discovered my first RCE through basic reconnaissance and exploiting a known Java deserialization vulnerability in Adobe ColdFusion.2 min
- SSRF Through PDF GenerationExploiting a Server-Side Request Forgery vulnerability through WKHTMLTOPDF to access AWS metadata and local files.4 min
- My first OOB XXE exploitationExploiting a blind Out-of-Band XXE vulnerability to exfiltrate sensitive data despite misleading error messages.5 min
- Binary search in Golang on large filesImplementing binary search in Go to efficiently search through a 550 million line file in seconds instead of hours.5 min
0 RESULTS
No articles match this search and topic.