WEB
Downgrading Trust: Bypassing HTTPS-Only SSRF Filters with a 302 Found
Exploring HTTPS to HTTP downgrades in Server-Side Request Forgeries to access internal endpoints and Cloud Metadata Services.
Nov 3, 2026/6 min read
Published Research03
Evasion
Process Injection Tradecraft: Early Bird APC Queue Injection in Practice
Operational analysis of Early Bird APC Queue Injection, examining execution flow, detection surface, and practical considerations in Red Team engagements.
Mar 10, 2026/6 min read
Vuln Analysis
(Not)React2Shell - Alternative payloads for RSC injection
A deep dive into the exploitation of the React2Shell vulnerability in scenarios where RCE is off the table.
Feb 12, 2026/6 min read