This workbook walks you through the exact processes Iʼve found most useful for figuring out what to measure in a security program and why it matters. Itʼs built to cut through the noise and give you a clear, repeatable approach. I know your time is valuable. Thatʼs why this workbook is practical, not theoretical. The goal is to help you define metrics that drive real decisions and show a return on the effort you put in

This dissertation to explore the darker side of the protocol, how its privacy features can be exploited by attackers for data exfiltration, and what security challenges this poses for defenders

Open-source offensive security platform for conducting phishing campaigns that weaponizes iCalendar automatic event processing.
tangled.gitbook.io/tangled-docs/

A01:2025 - Broken Access Control
A02:2025 - Security Misconfiguration
A03:2025 - Software Supply Chain Failures
A04:2025 - Cryptographic Failures
A05:2025 - Injection
A06:2025 - Insecure Design
A07:2025 - Authentication Failures
A08:2025 - Software or Data Integrity Failures
A09:2025 - Security Logging & Alerting Failures
A10:2025 - Mishandling of Exceptional Conditions

This is a completely standalone sleep implementation for x86_64 Linux that depends only on the Linux kernel.

Smugglex is a security testing tool that detects HTTP Request Smuggling vulnerabilities in web applications. It tests for CL.TE, TE.CL, TE.TE, H2C, and H2 smuggling attacks.

A comprehensive guide to memory allocators, covering allocation strategies, heap management, and implementing a custom memory allocator from scratch with performance considerations.

CVE-2025-14847 - MongoDB Unauthenticated Memory Leak Exploit
A proof-of-concept exploit for the MongoDB zlib decompression vulnerability that allows unauthenticated attackers to leak sensitive server memory.

A unique technique that leverages the inner working of C++, specifically Pure Virtual Functions and Abstract Classes, to hijack AMSI without patching any RX in a .text section memory.

This paper presents a novel approach to revive these previously discarded vulnerabilities by exploiting Control Metadata Fields (CMFs) within Linux objects, rather than traditional pointer manipulation

A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.
imhex.werwolv.net web-version docs

Fully decrypt App-Bound Encrypted (ABE) cookies, passwords & payment methods from Chromium-based browsers (Chrome, Brave, Edge) - all in user mode, no admin rights required.

This is a proof of concept for CVE-2025-38352, a vulnerability in the Linux kernel's POSIX CPU timers implementation. The September 2025 Android Bulletin mentions that this vulnerability has been used in limited, targeted exploitation in the wild.

This is a proof of concept for CVE-2025-38352, a vulnerability in the Linux kernel's POSIX CPU timers implementation. The September 2025 Android Bulletin mentions that this vulnerability has been used in limited, targeted exploitation in the wild.