LABS / PUBLICATIONS
Exploit Development
Research, published with evidence and technical context.
CVE-2021-31181: Building a functional exploit from a ZDI report and a non-working Metasploit module
During an offensive engagement, our team encountered a vulnerable SharePoint 2013 server where public exploits failed. By revisiting ZDI’s research and adapting a Metasploit module to the target’s version and configuration, we…
Copycats at Machine Speed: Reproducing Frontier Windows Kernel Exploitation Research
At BruCON 2026, researcher Juan Sacco presented methods for redirecting Windows kernel execution under modern protections. Our team utilized LLM assistance to replicate Sacco’s techniques, Native SSDT and Shadow SSDT, achieving successful…
Old Dives #02: SQLi Bypassing Captcha with Google Cloud Vision
In 2021, a penetration test uncovered a blind SQL injection vulnerability in an HR portal’s password recovery method, complicated by a CAPTCHA. Using Google Cloud Vision API and Selenium, the exploit aimed…
Old Dives #01: The RPS Status Page That Gave Passwords Back (CVE-2023-3349 / CVE-2023-3350)
During an offensive engagement, a publicly accessible ERP status page allowed unauthenticated users to manipulate logs and access sensitive SQL queries. The compromised logs included reversible AES-CBC ciphertext for passwords. This case…
Cashdro Vulnerabilities: From Pentest to Stealing Money
In a 2025 ethical hacking assessment at a Spanish leisure center, vulnerabilities in a CashDro smart drawer machine were uncovered, allowing unauthorized access and money extraction. Key issues included weak PIN security,…
Bypassing the FortiGate Symlink Patch: The Double Slash Technique (CVE-2025-68686)
Peter Gabaldon analyzes a security vulnerability in Fortinet’s SSL-VPN, revealing a flaw in a patch that fails to block unauthorized access through a double slash in file paths. Despite a subsequent patch,…
Beyond CVE-2025-31702: From arbitrary file reading to admin account takeover (Part III)
This article, by Javier Medina, provides a technical analysis of CVE-2025-31702, focusing on exploiting a vulnerability in Dahua cameras. It details how low-privileged users can read sensitive files, decrypt data, and generate…