// Technical Writing
Research Articles
Deep-dive writeups on vulnerability classes, methodology, binary analysis, and security research — written for researchers and engineers.
🏆 Best Paper Award · DCS-CI'26
Indirect Prompt Injection Against LLM Copilots in Industrial Control Systems
Peer-reviewed research on hijacking LangChain-based SOC copilots through poisoned advisories and telemetry, with attack success rates up to 86.4% and a layered defense that cuts it to 8.1%. Includes the full attack taxonomy (C1/C2/C3), workflow diagrams, and results.
Read the paper writeup →
Published
Methodology
GUIDE
How to Pentest Firmware: Extraction, Binary Analysis, and Disclosure
A phase-by-phase firmware research methodology and learning roadmap, covering extraction, attack-surface recon, static binary analysis, emulation, and fuzzing, with worked command-line examples end to end and how to turn a candidate into a valid, disclosed bug.
Read full writeup →
CVE Writeup
MODERATE
CVE-2026-111055: One Code, One Client, Many Freebies
A TOCTOU race in FOSSBilling checkout lets a single client redeem a once-per-client promo code as many times as they can check out at once — the per-client sibling of the global-limit race, fixed in 0.8.9.
Read full writeup →
CVE Writeup
HIGH
CVE-2026-43921: From Config Update to Root Shell in FOSSBilling
A single missing escape in PHP config serialization turns an admin API call into persistent RCE. Full root cause walkthrough, exploit chain, and patch analysis.
Read full writeup →
CVE Writeup
MODERATE
CVE-2026-43925: Mass Assignment Hidden in Plain Sight
How an undocumented field in a public API endpoint lets any visitor self-assign to admin-controlled client groups and claim discounts they were never meant to have.
Read full writeup →
CVE Writeup
MODERATE
CVE-2026-43927: Race Conditions in Billing Systems and Why They're Underreported
A TOCTOU race in FOSSBilling's cart checkout lets a client bypass promo code limits by firing concurrent requests. Includes timing diagrams and threaded PoC.
Read full writeup →
Firmware Research
REPORTED
Auditing a Hikvision DS-K1T671M: One Finding, Four Leads That Died
A full static-analysis walkthrough of an access control terminal. The RTSP session token uses a weak time-based seed (reported to HSRC, under review), plus every lead I chased, ruled out, and what each one taught.
Read full writeup →
More articles coming soon
Full writeups for the bug bounty and in-progress research findings listed below are in progress. Check back or follow on GitHub for updates.
Planned
Research Blog
Coming soon
Authenticated RCE via Settings Namespace Injection in Akaunting
How a Laravel settings controller accepts a _prefix parameter that rewrites the namespace, redirecting SMTP config into a shell injection via proc_open(). CVSS 9.9.
Research Blog
Coming soon
SSRF via SMTP Check — InvoiceNinja and the Internal Port Oracle
The SMTP test endpoint accepts an attacker-controlled host with no RFC1918 filtering. How response timing and error messages leak internal service state.
Binary Analysis
Coming soon
Hikvision DS-K1T671M: Reversing the No-Auth URL Whitelist in hicore
ARM ELF analysis of a physical access control terminal revealed a 34-entry hardcoded no-auth table — bypassing authentication for config export, iris enrollment, and ONVIF factory reset.
Research Blog
Coming soon
SSRF via Redirect Bypass in Graylog's URL Allowlist
Graylog validates a URL against its allowlist once, then OkHttp follows 3xx redirects without re-checking each hop, letting an allowlisted or open-redirect host pivot server-side requests into internal services like an unauthenticated OpenSearch cluster or the cloud metadata endpoint. CVSS 9.9 Critical.
Research Blog
Coming soon
Unauthenticated Decompression Bomb DoS in Graylog's Beats Input
The Beats frame decoder bounds every frame type it handles except one, the compressed frame inflates with no size limit. A modest concurrent burst of small zlib payloads drives a sustained OutOfMemoryError storm and JVM-wide GC stalls, with no authentication required.