# Joshua Martinelle

> Joshua Martinelle - Security Engineer at Tenable and bug hunter, focused on web security, CVE disclosure and recon tooling.

## Pages
- [CVEs](https://www.jomar.fr/cves): Disclosed vulnerabilities and advisories
- [Blog](https://www.jomar.fr/blog): Security research, bug bounty and write-ups
- [Tools](https://www.jomar.fr/tools): Open-source recon and security tooling

## Blog posts
- [Building my own AI Agents](https://www.jomar.fr/blog/2026/building-my-own-ai-agents/): From frustration with existing frameworks to building my own agent in under 72 hours — what I learned about memory, SDKs, and the real complexity of AI agents.
- [Investigating a Compromised WordPress Site](https://www.jomar.fr/blog/2026/investigating-compromised-wordpress/): Diagnosing a WordPress site compromise that was redirecting visitors to adult content and pharmaceutical spam through injected malicious scripts.
- [Hookd: A Lightweight Out-of-Band Interaction Server](https://www.jomar.fr/blog/2025/hookd/): Hookd - A simple webhook server for testing and debugging.
- [Simple Monitoring Solution](https://www.jomar.fr/blog/2025/simple_monitoring/): Setting up simple monitoring for your services.
- [Smart Contract Testing in Remix](https://www.jomar.fr/blog/2025/remix_smart_contract_testing/): Testing smart contracts using Remix IDE.
- [Ethernaut - Dex Two](https://www.jomar.fr/blog/2025/ethernaut_dex_two/): Solving the Ethernaut DEX Two challenge.
- [Damn Vulnerable Defi : The Rewarder](https://www.jomar.fr/blog/2025/the_rewarder/): Solving The Rewarder challenge from Damn Vulnerable DeFi.
- [Damn Vulnerable Defi : Side Entrance](https://www.jomar.fr/blog/2025/damn-vulnerable-defi-side_entrance/): Solving the Side Entrance challenge from Damn Vulnerable DeFi.
- [Damn Vulnerable Defi : Truster](https://www.jomar.fr/blog/2025/damn-vulnerable-defi-truster/): Solving the Truster challenge from Damn Vulnerable DeFi.
- [Damn Vulnerable Defi : Naive Receiver](https://www.jomar.fr/blog/2025/damn-vulnerable-defi-naive_receiver/): Solving the Naive Receiver challenge from Damn Vulnerable DeFi.
- [Collaborative Code Auditing](https://www.jomar.fr/blog/2025/collaborative_code_auditing/): Setting up a collaborative code auditing environment using code-server.
- [Damn Vulnerable Defi : Unstoppable](https://www.jomar.fr/blog/2025/damn-vulnerable-defi-unstopable/): Solving the Unstoppable challenge from Damn Vulnerable DeFi.
- [Extract and monitor bugbounty scopes](https://www.jomar.fr/blog/2025/extract_and_monitor_bugbounty_scopes/): Extracting and monitoring bug bounty scopes automatically.
- [Blogging in 2025: My Thoughts](https://www.jomar.fr/blog/2025/my-perfect-platform/): My journey through various blogging platforms over seven years and why I finally settled on Hugo with GitHub Pages.
- [Bruteforce vs Permutations](https://www.jomar.fr/blog/2023/bruteforce-vs-permutations/): Comparing subdomain bruteforce and permutation techniques using Regulator, DNSGen, and AlterX to find the most effective reconnaissance strategy.
- [Basic recon to RCE III](https://www.jomar.fr/blog/2022/basic-recon-to-rce-iii/): Exploiting command injection through Ruby string interpolation in a Rails application to achieve RCE via DNS exfiltration.
- [DNS Tools Comparison](https://www.jomar.fr/blog/2022/dns-tools-comparison/): Comparing Amass, DNSX, and PureDNS for DNS resolution accuracy and performance in bug bounty reconnaissance.
- [Basic recon to RCE II](https://www.jomar.fr/blog/2022/basic-recon-to-rce-ii/): How trusting my instincts led to discovering a critical RCE that everyone else missed on a popular bug bounty program.
- [My bounty infrastructure](https://www.jomar.fr/blog/2021/my-bounty-infrastructure/): A complete Docker-based infrastructure for bug bounty hunting featuring Traefik, XSS-Catcher, Rengine, and more.
- [Basic recon to RCE](https://www.jomar.fr/blog/2021/basic-recon-to-rce/): How I discovered my first RCE through basic reconnaissance and exploiting a known Java deserialization vulnerability in Adobe ColdFusion.
- [SSRF Through PDF Generation](https://www.jomar.fr/blog/2021/ssrf-through-pdf-generation/): Exploiting a Server-Side Request Forgery vulnerability through WKHTMLTOPDF to access AWS metadata and local files.
- [My first OOB XXE exploitation](https://www.jomar.fr/blog/2021/my-first-oob-xxe-exploitation/): Exploiting a blind Out-of-Band XXE vulnerability to exfiltrate sensitive data despite misleading error messages.
- [Binary search in Golang on large files](https://www.jomar.fr/blog/2021/golang-binary-search/): Implementing binary search in Go to efficiently search through a 550 million line file in seconds instead of hours.