I work on security engineering. Everything I learn ends up here.
I have spent close to a decade on the offensive side: offensive AI development, web, internal network, mobile and API penetration testing, red team work and DevSecOps. Everything here is based on public vulnerability reports and experiments in my own lab — these are personal notes. Enjoy the read.
Writing
161 posts · page 13 / 14Back to Factory Settings: A Day Among Rusty Pipes and Exposed PLCs
Think air-gapped networks are real? Think again. Let's dive into the world of OT hacking, where Modbus is king and "reboot" is a terrifying word.
Walking the Minefield: From Reverse Engineering to Runtime Manipulation
Mobile security is more than just decompiling APKs. Here is my journey from being a rookie to mastering the art of runtime manipulation with Frida.
SSH into the Human Terminal: Why the 'Trust' Protocol is Still Unpatched
Red teaming isn't just about zero-days. It's about debugging the 'Human OS' and bypassing danger perception through context and HTML Smuggling.
Hunting for Treasure in the IOC Trash: The ‘Real’ Face of Threat Intel
Stop chasing static IPs and hashes. If you want to actually hurt an attacker, you need to climb the Pyramid of Pain and start targeting our TTPs.
Görünmez Duvarları Yıkmak: IDOR’un Sessiz Çığlığı ve Mantık Hatalarının Anatomisi
Selam dostum, bugün seninle biraz dertleşelim, biraz da ellerimizi kirletelim. Kahveni (veya o meşhur enerji içeceğini) aldıysan konuya direkt dalıyorum. Bak,...
Why Isn’t That Cursor Blinking? Terminal Ghosts and Red Team Realities
It’s 3 AM, your reverse shell finally lands, but the terminal is dead silent. Let's talk about WAF bypasses, DNS exfiltration, and "blind" hacking.
Beyond `mov eax, 1`: Diving Into the Binary Mind and Chasing Lost Logic
0x55 0x48 0x89 E5 — more than just bytes. It's the heartbeat of a function. Let's talk Reverse Engineering, the "meat grinder" effect, and finding logic.
Stealthy Infiltration or Breaking the Door Down? The Dance of Payloads and That Critical Second
It's 3 AM, the WAF is mocking me, and standard payloads are failing. Time to ditch the noise and get surgical with some OOB exfiltration.
Leaving the Key in the Lock: Why We’re Still Failing at Identity Management
Million-dollar security is useless if you leave your AWS keys in a script. Let's talk about why IAM is still our weakest link and how to fix it.
The "Root" Illusion in Container Land: How Not to Score an Own Goal
Just because it's in a container doesn't mean it's secure. Let's talk about the common mistakes that turn your isolated box into an open door.
Lord of the Leaks: Data Hunting in the Epstein Archives and the Gritty Side of OSINT
Digging through thousands of leaked documents is a nightmare. Here’s how I use OCR and Python to find the signal in the noise.
Your Screen Isn’t Just Black, Your Heart Just Stopped: The Reality of Ransomware
A raw look at how ransomware actually works, why speed is everything, and what attackers are really doing inside your network before the big "lockdown."