About
Security researcher. Offensive security, vulnerability research, and exploit development.
I have been working in cybersecurity for 18 years, mostly on the offensive side: red teaming, bug hunting, exploit development, and adversary simulation. I have also spent enough time on the engineering side to know what it takes to fix the things I find.
Over the years I have worked with government entities, financial institutions, telecom operators, and large enterprises. Different environments, often the same problems.
What I work on
Web applications, infrastructure, cloud, enterprise networks, and exploit development. I have led teams and security programs, but I still prefer to stay close to the technical work.
The name
Depending on where we crossed paths, you may know me by a different handle. I am not anonymous, just historically inconsistent at picking usernames. I have used a few across research projects, security communities, and bug bounty platforms, back when choosing a name felt like a low stakes decision. If you recognize the work but not the name, that is why.
Certifications
I go after them for the same reason I go after bugs: the challenge, and a good excuse to learn something properly.
About this blog
This is where I write about my research, tooling, techniques, and methodology. Some posts are detailed technical writeups. Others are short notes, a script I built to solve one specific problem, or whatever else happens to be on my mind at the time.
There is no plan behind it. After 18 years I still enjoy breaking things, understanding how they work, and writing down what I learn.