What would it look like giving LLM's command line access to Nmap. Explore the possibilities in the security tools space.

Disclaimer: This article is intended for security professionals conducting authorized testing within the scope of a contract. The author is not responsible for any damage caused by the application of the provided information. The distribution of malicious…

Back in April, I shared a walkthrough on how to make a Ghidra noscript for spotting suspicious malloc calls. I then put that noscript to the…

How Leonard Leo's 2021 sale of an electronics firm enabled tech giants to subvert the 2024 election.

GoClipC2: A covert Windows clipboard-based C2 channel for VDI/RDP environments. Bypasses network monitoring with encrypted Base64 messaging.

Asher Falcon's personal website - Software engineer and student

Thanks to Termux and the clever termux-adb project, you can run ADB and Fastboot directly from your phone — no computer needed. This guide breaks down how to install it, how it works, and practical use cases.

A cybersecurity expert warned Telegram could become "a tool for global surveillance of messenger users."

Unless you lived under a rock for the past several months or started a digital detox, you have probably encountered the MCP initials (Model Context Protocol). But what is MCP? Is this just a...

Welcome to June! We’re back—this time, we're exploring Sitecore’s Experience Platform (XP), demonstrating a pre-auth RCE chain that we reported to Sitecore in February 2025.

We’ve spent a bit of time recently looking at CMS’s given the basic fact that they…

Learn how Horizon3.ai uncovered CVE-2025-34508 in ZendTo, allowing attackers to access sensitive files through a path traversal flaw.

Wallets solved the card problem. But they created new ones.

Intro A few months ago, I read the work of Jeroen Delvaux, Cristofaro Mune, Mario Romero, and Niek Timmers on […]

Discover how Varonis researchers detect stealthy beacon traffic by analyzing jitter patterns, turning evasion tactics into powerful behavioral detection signals.

A Template Injection vulnerability in the latest version of Kong's Insomnia API Client leads to Remote Code Execution.

Observe and reprogram running programs on Windows, macOS, GNU/Linux, iOS, watchOS, tvOS, Android, FreeBSD, and QNX

File parsers in Go contain unexpected behaviors that can lead to serious security vulnerabilities. This post examines how JSON, XML, and YAML parsers in Go handle edge cases in ways that have repeatedly resulted in high-impact security issues in production…

What’s up, everyone? I’m back with Part 2 on implementing the Web Penetration Assistant (WPA) logic in RAWPA. Last time, we talked about the initial steps, and now, I’ve got some major updates to share.