research

original research. tooling, novel attacks, things i had to figure out the hard way.

2026.10.25 shedskin: PowerShell leaves its skin, Defender scans somebody else's amsi

2026.10.25 one pointer, fifteen bytes, CLR's AMSI call lands on a stub we wrote amsi

2026.10.25 32768 and nothing else: the integer PowerShell's AMSI block has been waiting for since 2017 amsi

2026.10.13 Odoo sale_margin: the line was protected, the order total was not info-disclosure

2026.10.13 Odoo payments: one real payment, unlimited paid orders auth-bypass

2026.10.13 Odoo: installing server modules without being an administrator privilege-escalation

2026.10.06 Four pads to a root shell router

2026.10.01 OP-TEE PKCS#11: the CVE-2026-53764 fix that only validates one instant pkcs11

2026.10.01 Odoo CRM: the portal guard that only guards portal users broken-access-control

2026.10.01 Odoo base_import.import: the wizard with an ACL and no record rule broken-access-control

2026.08.14 Half a vulnerability each http-request-smuggling

2026.07.15 declaw ssl-unpinning

2026.06.16 Atomic Arch: the AUR package that swapped my Monero wallet for a drainer supply-chain

2026.06.14 Mantis llm

2026.03.23 Odoo snippet filters: a pre-auth ORM domain you control, evaluated as superuser orm-injection

2026.03.11 Odoo POS self-order: the leak they fixed and the one they didn't info-disclosure

2026.03.09 Odoo Xendit: the payment endpoint that skipped the token check auth-bypass

2026.02.19 Odoo website forms: the signature check that one empty field turns off auth-bypass

2023.02.20 Ring 3 Field Notes windows

2022.08.31 Shadow Stack exploit-dev

2022.08.31 Dead SDR Society hardware

2022.08.31 The License Plate Password social-engineering