UNC1739
Offensive security research. Web exploitation. Red team tradecraft.
// featured research
Centurion: Bring Your Own Execution Environment
A virtualized loader built in a week using LLM-assisted development. Custom ISA, PE loader, TLS stack, and software crypto coprocessor all running as interpreted bytecode — with only an ~18 KB native stub.
read the post →Qlik Sense Vulnerability Chain (ZeroQlik / DoubleQlik)
HTTP request tunneling and path traversal vulnerabilities enabling unauthenticated remote code execution. Exploited by Cactus ransomware and Magnet Goblin. Added to CISA KEV catalog.
view all cves →// recent posts
Centurion: Bring Your Own Execution Environment
How we built a custom virtualized loader with its own ISA, PE loader, TLS stack, and software crypto coprocessor in about a week using LLM-assisted development — and what the BYOEE model means for offensive tooling.
Et Tu, Default Creds? Introducing Brutus for Modern Credential Testing
Introducing Brutus, a multi-protocol credential testing tool for penetration testers and red teams. Covers default credential validation, SSH bad key testing, and pipeline integration with modern reconnaissance workflows.
Beyond the Last Mile: How Internet Routing Shapes Red Team Ops
How Internet routing, peering relationships, and transit providers affect red team operations. Observations from tunneling traffic through web conferencing infrastructure.
Analyzing a Modern Linux Kernel Vulnerability (CVE-2023-0266)
Deep dive into a use-after-free vulnerability in the Linux kernel sound subsystem exploited in the wild against Android devices.