Notes on AI pentesting and security research: pentesting code and live applications, testing hypotheses, and documenting findings with evidence.
ResearchFeatured
An AI agent read the HTTP/2 spec and wrote an exploit that exhausts 32 GB of server RAM in ten seconds — from one connection, with zero authentication. Apache, nginx, IIS, Envoy, and Pingora are all affected, and public PoC code is live.
CVE-2024-47575 let attackers register rogue devices on FortiManager and pull managed configs full of credentials. Unit 42's PEERSTITCH implant shows what came next: memory-resident malware on the firewalls themselves. Here is how to test for it and what evidence proves impact.
Remediation isn't complete when a ticket closes — it's complete when an automated retest proves the exposure is gone. This guide covers retest loop design, proof-of-fix evidence, and regression detection.
False positives don't just waste time — they erode analyst trust and hide the findings that matter. This guide explains how validation gates sit between detection and alarm, using exploitability evidence, EPSS/KEV context, and reachability checks to turn noisy scanner output into a prioritized, auditable queue.
GuardDuty Extended Threat Detection now attaches five indicator types — VULNERABILITY, MALICIOUS_PACKAGE, REACHABILITY, MISCONFIGURATION, SENSITIVE_DATA — to attack sequence findings. Each is context, not a detection, and the same correlation discipline decides which exposure findings deserve an analyst queue.
Unsophisticated attacks can still cause major breaches when third-party risk is overlooked. This CTEM guide explains how to discover, prioritize, validate, and remediate exposure introduced by vendors, partners, and suppliers.
Vulnerability, CVE, assessment, scan, management, report — the terms get used interchangeably, but they mean distinct things. This guide breaks down each one with clear definitions: what makes something a "security vulnerability," how CVE IDs work, and why scanning is not the same as ongoing vulnerability management.
Threat actors are using Web3 infrastructure and poisoned open-source packages to reach enterprise cloud environments. This guide explains how these supply chain attacks work, what telemetry exposes them, and how to inventory exposure and validate exploitability before a dependency becomes a breach.
A web security testing platform unifies discovery, inventory, scanning, validation, and exploitability-aware prioritization into one continuous exposure workflow. This guide maps the discovery-to-validation path and shows where point tools stop and a program begins.
Web content and directory enumeration maps the reachable paths, files, and API routes attackers probe first. This guide shows how to turn content discovery into continuous exposure management: inventory hidden assets, validate exploitability, and prioritize the paths that create real breach risk.
