Systems & Networking · Security
Build a Private Server Status & Control Page with Tailscale
A tiny status page plus a safe control API for your server — published only inside your tailnet with Tailscale Serve, never exposed to the public internet.
Home / Research
Security research
Featured
Disclosures & PoCs
- Android APK Backdoor — Install-Time Permission AbusePoC2020
Trojanizing a legitimate APK with a Meterpreter payload and downgrading targetSdkVersion to 22 to force all permissions at install time (Android Oreo/Pie). details ↗
- WPA2 Handshake Capture via DeauthenticationPoC2019
Forcing a WPA2 4-way handshake with an aireplay-ng deauth and capturing it with airodump-ng for offline cracking. details ↗
- WPA2 Offline Password Cracking (crunch + aircrack-ng)PoC2019
Cracking a captured WPA2 handshake offline by piping crunch-generated password candidates straight into aircrack-ng. details ↗
From the journal
Research & writeups
Security
Encrypt Your Own Passwords — In Your Head
Carry a unique, strong password for every site in your head — using one memorized phrase and a simple algorithm you run yourself. No password manager needed.
AI · Security · Systems & Networking
Letting Claude Manage Your DigitalOcean Droplet — and What to Watch For
An AI agent like Claude can SSH into your server and run it for you — add users, harden SSH, debug. Here's how to do it without handing over the farm.
Security
The Importance of Choosing Strong Passwords
Your password is often the only thing between an attacker and your accounts. Here's what actually makes one strong — and why length beats complexity.
Security
Creating an APK Backdoor That Asks for All Permissions at Install
An old Android pentesting writeup: embedding a Meterpreter payload in a legit APK and editing the manifest so it requests all permissions at install time.
AI · Security
The Role of AI in Modern Pentesting
AI won't replace the pentester — but it's already changing the job: recon, triage, payloads, reporting. What's real, what's hype, and how to use it well.
Systems & Networking · Security
Passwordless SSH: Key-Based Login to Your Linux Server
Stop typing your server password. Set up SSH key-based authentication to log into your Linux server — or DigitalOcean droplet — without one.
AI · Security
Prompt Injection: The New Injection Attack
SQL injection broke databases. Command injection broke shells. Prompt injection breaks AI — and as we wire LLMs into agents, it's the #1 risk to understand.
Security
Crunch Rules for Complex Password Patterns
A blind wordlist wastes time and disk. Learn crunch's pattern placeholders (@ , % ^) to generate targeted password lists — digits, words, and mixed patterns.
Security
How to Use Aircrack-ng to Brute-force WPA2 Passwords
Some of you may already know that brute forcing a WPA2 password takes a very long time but I'm going to show you one of the ways to do this and how this…
Security
How to Capture a WPA2 Handshake with Aircrack-ng
Before you can crack a WPA2 password offline, you need the 4-way handshake. Capture one with airmon-ng, airodump-ng, and a deauth from aireplay-ng.
![A Quick Way to Fire Up a Web Server for Testing Purposes [Linux/MacOS]](/assets/posts/cover-quick-way-fire-up-web-server-testing-purposes.svg?v=74okqt)
Systems & Networking · Security
A Quick Way to Fire Up a Web Server for Testing Purposes [Linux/MacOS]
Developers always need to test code once in a while and there is a way to quickly launch a web server from your current working directory without the need…