I work on security engineering. Everything I learn ends up here.
I have spent close to a decade on the offensive side: offensive AI development, web, internal network, mobile and API penetration testing, red team work and DevSecOps. Everything here is based on public vulnerability reports and experiments in my own lab — these are personal notes. Enjoy the read.
Writing
161 posts · page 10 / 14When the PLC Heartbeat Stops: Red Teaming Industrial Systems and the Harsh Reality
In the world of ICS/OT, a single hex code can be the difference between a smooth operation and physical disaster. Here's why security in the field is a completely different ballgame.
Could Your Smart Bulb Be Watching You? The 'Shodan' Illusion and Bitter Truths in IoT Security
IoT security is more than just scanning Shodan. Let's dive into the world of 'Embedded Insecurity,' firmware analysis, and why your office coffee machine might be your biggest vulnerability.
You’ve Got a Shell, Now What? Navigating the Labyrinths of Internal Networks Silently
Initial access is just the beginning. The real game starts with staying under the radar, moving laterally, and understanding the defensive gaps that let attackers roam free.
Vulnerabilities in the Human OS: More Than Just Taking the Bait
In the cyber world, we pour millions into firewalls and EDRs, but the 'Human OS' remains the most critical patch. From a Red Teamer's perspective, social engineering is less about simple trickery and more about meticulous technical infrastructure.
The Shadow of the Ghost: Is Anyone Truly Safe in a Zero-Day World?
Dive into the world of Zero-Day vulnerabilities from a Red Team perspective. We explore how these invisible threats are born and why understanding the 'logic of the break-in' is the best defense.
Unlocking Invisible Doors: IDOR and the Silent Guests at API Backdoors
Ever seen someone else's invoice just by changing a number in the URL? That's IDOR. Let’s look at why this 'old but gold' vulnerability still haunts modern APIs and how we can secure our systems.
Smart Bulbs, Dumb Passwords: The IoT Backdoor Reality
A deep dive into why IoT devices remain the ultimate 'pivot points' for attackers and how a $20 smart plug can compromise an entire corporate network.
Security Beyond Borders: Anatomy of SASE Architecture and Modern Defense
The traditional 'castle and moat' approach is dead. Discover why SASE is the new frontier of security and how Zero Trust is reshaping our defense strategies from a Red Team perspective.
Getting Lost in the Kubernetes Labyrinth: Can You Truly 'Hacker-Proof' Your Cluster?
Ever felt the cold sweat of a cloud bill exceeding your company valuation? Let's look at Kubernetes security through a Red Teamer's lens and fix those common YAML blunders.
Patching the Human Factor: Vulnerability Scanning in Social Engineering
When a user clicks a malicious link, millions of dollars in security investment can turn into expensive paperweights. Let’s talk about how social engineering exploits 'wetware' and how we can defend against it.
Görünmeyeni Avlamak: Zero-Day Efsanesi ve Otomatize Taramaların Sefaleti
Otomatik tarama araçlarının sahte güvenine kapılanlara kötü bir haberim var: Zero-day'ler o raporlarda gözükmez. Bu yazıda, bilinmeyenin peşine düşüyoruz.
When Your Safety Net Becomes a Trap: How Library Dependencies Betray You
Ever wonder who actually wrote the 100,000 lines of code running in your 'small' microservice? Let's talk about the fragility of the software supply chain and how Red Teamers exploit it.