Write-ups
Research notes, labs, and walkthroughs.
21 write-upsPage 1 of 2
Wiring BurpMCP-Ultra to a Local Model: Driving Burp Suite with LM Studio / Bionic
Setting up a local, offline LLM with BurpMCP-Ultra and LM Studio or Bionic to keep authorized LLM red team testing on your own machine, and where MCP tool calling gives way to generating prompts by hand.
HTB - MakeSense
Hack The Box write-up with exploitation notes and lessons learned.
Admin Endpoints Hiding in a JS Bundle: How a Missing Auth Check Turned Into Cross-Tenant OAuth Secret Disclosure
Missing server-side access control on an admin API surface let a non-admin token enumerate every OAuth M2M integration and pull live client secrets across unrelated tenants.
HTB - Paperwork
Hack The Box write-up with exploitation notes and lessons learned.
HTB - Bedside
Hack The Box write-up with exploitation notes and lessons learned.
HTB - SmartHire
Hack The Box write-up with exploitation notes and lessons learned.
HTB - Helix
Hack The Box notes focused on practical attack path thinking.
Exploiting React Server Components RCE (React2Shell – CVE-2025-55182)
Request-level exploitation notes for React Server Components RCE testing.
Fixing “Illegal Server Name” Error in Burp Suite Caused by Underscores in Domain Names
Troubleshooting notes for Burp Suite DNS handling and match-replace behavior.
LLM Assisted Source Code Review Using FalconEye
Using LLM-assisted workflows to accelerate source code review and vulnerability discovery.
Using Burp Suite Professional Without Installing It on a Client VDI (via SSH & EC2)
A practical SSH and EC2 workflow for proxying client VDI traffic into Burp Suite Pro.
Child-to-Parent Domain Escalation: Lessons Learned from Kerberos ETYPE Pitfalls
Active Directory escalation notes from Kerberos ticketing and hash-dump edge cases.