Research & writeups

Vulnerability research, exploit development and the occasional side quest.

Or browse by topic →

• 

  How to Troll Pokémon Players — Gen1recomp Edition

  Gen1recomp

  Mapping the Gen1recomp network protocol, finding the trust boundary nobody checked, and turning Lua type confusion into a one-packet client crash.

  11 Aug 2026 · 20 min read type-confusionreverse-engineeringvulnerability-research
• 

  Pwning Samsung TV Browser - Chrome V8 WASM Type Confusion bug

  7-part series

  From a single web page to a reverse shell on a Samsung QLED (Tizen 9, Chromium 120, ARM32) — exploiting a V8 WebAssembly-GC type confusion.

  18 Jun 2026 · 14 min read browser-exploitationtype-confusionmemory-corruption
• 

  Nimhawk v2.0: Development Update

  C4-style relay multi-agent architecture, cross-platform agents, and upcoming self-contained TCP mesh networking.

  13 Jan 2025 · 1 min read red-team
• 

  Introducing Nimhawk C2

  A powerful, modular, lightweight and efficient command & control framework written in Nim for red team operations.

  15 Nov 2024 · 2 min read red-team
• 

  WebKit CVE-2016-4622: Array.slice Memory Disclosure

  CVE-2016-4622 Apple WebKit

  Comprehensive analysis and exploitation of the WebKit JavaScript Core vulnerability that enables memory disclosure through Array.slice manipulation

  11 Apr 2020 · 7 min read browser-exploitationmemory-corruptionexploit-development
• 

  D-Link DIR600 Remote Code Execution Exploit Chain

  D-Link DIR-600

  Complete exploit chain for D-Link DIR600 routers using CSRF, authentication bypass, and RCE to achieve persistent backdoor access via single HTTP link.

  15 Aug 2019 · 5 min read rcecsrffirmware
• 

  CVE-2019-9194: elFinder Command Injection 1-Day Exploit

  CVE-2019-9194 elFinder

  Analysis and exploitation of CVE-2019-9194, a command injection vulnerability in elFinder, from discovery to functional exploit development.

  20 May 2019 · 6 min read rceweb-securityexploit-development
• 

  CVE-2019-9960: LimeSurvey Arbitrary File Download

  CVE-2019-9960 LimeSurvey

  Analysis of CVE-2019-9960, arbitrary file download vulnerability in LimeSurvey through Directory Traversal exploitation.

  26 Mar 2019 · 7 min read path-traversalweb-security
• 

  CVE-2019-14670 - LimeSurvey TCPDF RCE via PHAR File

  CVE-2019-14670 LimeSurvey

  Remote code execution in LimeSurvey < 3.17 through TCPDF PHAR deserialization attack, exploiting queXML PDF export functionality.

  25 Mar 2019 · 4 min read rceweb-securityexploit-development
• 

  CVE-2019-3809: Moodle Blind SSRF Vulnerability Analysis

  CVE-2019-3809 Moodle

  Analysis of a Blind Server-Side Request Forgery vulnerability in Moodle's badge backpack functionality allowing internal network reconnaissance.

  15 Feb 2019 · 4 min read ssrfweb-securityvulnerability-research
• 

  Escalating TP-Link Firmware Vulnerabilities

  CVE-2018-16119 TP-Link

  Automated vulnerability pattern detection across multiple TP-Link firmware versions using Ghidra scripting and Binwalk to discover CVE-2018-16119.

  1 Dec 2018 · 5 min read firmwareiotreverse-engineering
• 

  CVE-2018-16119: TP-Link Router Remote Code Execution

  CVE-2018-16119 TP-Link WR1043ND

  Detailed analysis of CVE-2018-16119, a buffer overflow vulnerability in TP-Link WR1043ND routers leading to remote code execution via ROP chains.

  15 Oct 2018 · 14 min read rcememory-corruptionrop