All write-ups
Deep dives on offensive security, defensive engineering, and the systems in between. 13 posts and counting.
Becoming a Cybersecurity Expert: Red Team / Blue Team Mastery Roadmap
A complete six-phase roadmap from software developer to professional-grade defender who can exploit, detect, hunt, harden, and run purple-team exercises.
Exploiting JWT Misconfigurations in Modern APIs
JSON Web Tokens promise stateless, tamper-proof authentication until a single misconfiguration hands an attacker the keys to every account.
Bypassing Content-Security-Policy in the Real World
A field guide to CSP gadgets, nonce reuse, and JSONP endpoints that quietly defeat your strongest header.
Hardening CI/CD Against Supply-Chain Attacks
A pragmatic checklist for pinning dependencies, isolating runners, and reducing the blast radius of a compromised pipeline.
Reverse-Engineering a Smart Router's Firmware
Dumping flash, unpacking SquashFS, and finding the hardcoded credential that started it all.
Implementing mTLS Across a Microservices Mesh
Identity-based service auth without the YAML sprawl: certificates, rotation, and graceful failure modes.
Prompt Injection: Defending LLM-Powered Apps
Why input filtering is not enough, and the architectural patterns that actually contain untrusted model output.
IMDSv2 and the End of SSRF-to-Credentials
Why instance metadata hardening matters and how to enforce it across an AWS organization.
Building a Custom Linux ISO for Field Hardening
Reproducible images, signed packages, and a locked-down base for edge deployments.