Security notes
All writing.
Vulnerability analysis, technical fixes, code and short news notes. Public sources and my own lab.
42 posts
- IoT & OT
Dumb Mistakes of Smart Devices: Getting Lost in the IoT Labyrinth
Think your office coffee machine is just for caffeine? Think again. From root passwords like '12345' to open SSH ports, I’m diving into why the IoT world is currently the Wild West of cybersecurity and how these 'toys' can become a bridge to your production database. - Penetration Testing
WAF Won't Save You: The Illusion Behind Firewalls and the Harsh Truths
Think your 'premium' WAF makes your web application invincible? Think again. Let's talk about why defense starts in the code, not at the perimeter. - Malware Analysis
The Regret After Double-Clicking That File: Getting Lost in the Labyrinths of Malware Analysis
A deep dive into the 'wild' path of analyzing malware from a Red Teamer's perspective, starting with a personal 'bridge mode' disaster and moving into static and dynamic analysis techniques. - Offensive AI
Claude Code is Here: Hunting Vulnerabilities Directly from Your Terminal
Testing Claude Code from a security perspective—why this new CLI tool is more than just another chatbot for your workflow. - Offensive AI
Claude Code Terminale İndi: Kodun İçindeki Açıkları Bulmak Artık Çocuk Oyuncağı mı?
Claude Code duyuruldu ve işler iyice kızıştı. Peki bu yeni AI aracı gerçekten güvenlik açıklarını yakalayabiliyor mu yoksa sadece gürültü mü yapıyor? - Offensive AI
New Eye in the Terminal: Can Claude Code Actually Spot Security Vulns?
I put Anthropic’s new Claude Code CLI to the test. Here’s how its agentic workflow stacks up against traditional tools in finding real-world bugs. - IoT & OT
When Valves Turn by Themselves: Inside the Dark Corridors of Industrial Systems
A midnight emergency call, the illusion of a 'perfectly fine' SCADA dashboard while physical machines struggle, and the harsh reality that air-gapped systems are never as secure as we think. - Penetration Testing
What Happens When You Change Just One Digit? The Silent Scream of IDOR
A deep dive into why authorization flaws like IDOR and business logic errors remain the 'invisible' threats that automated scanners often miss, told through real-world Red Team experience. - Penetration Testing
The Art of Pen Testing: A Red Team Journey Beyond Automated Tools
It’s 3:15 AM. That hypnotic terminal glow is burning my eyes, but the real hunt has just begun. Here is why penetration testing is more than just clicking 'Scan' and why manual analysis is the true game changer. - Malware Analysis
Think That File Is Gone? The Silent Scream of Digital Traces
A deep dive into the world of digital forensics, why you shouldn't just pull the plug on a compromised system, and how to catch an attacker's 'whispers' using Volatility. - Red Team
You Can’t Stop What You Can’t See: Let’s Cut Through the XDR Hype
Stop watching single raindrops and start looking at the whole storm. Here’s why XDR is changing the game for us on the Red Team side. - Penetration Testing
Saving Pennies or Stashing Bugs? Tales from the Bug Bounty Trenches
Bug bounty isn't just about finding flaws; it’s about outsmarting the system and staying patient. Here’s a look at the real grind behind the hunt.