“You betrayed my trust. From the beginning, you intended to misuse this knowledge for evil purposes.”1
A few days ago, my OpenAI account got deactivated2. Reason: Cyber abuse. “Embrace AI or you’ll be left behind,” they said. Now I have been banished from the technofeudalist network state.
While it may be incredibly easy to be salty here, it does make sense to some extent why corporate bans are, at times, a necessity.
No! Not the silly manosphere stuff.
Redpills; techniques in which software (specifically malware) can detect whether they are running in some sort of virtualized environment, sandbox or debugger.
In version 0.15.1, Zig removed
the async and await keywords, anticipating to rework and bring them back
as part of a new Io interface. That was pretty exciting, but I didn’t get how
it would fully work until I got to try it out in version 0.16.0.
Zig provides spatial memory safety. It can perform bounds checking at compile time, for comptime known values, and crash with appropriate stack trace for runtime values. This means it prevents out-of-bounds access to arrays etc.
We’ll take a look at 2 simple examples to see how this works in practice.
Wazuh is a powerful open-source security monitoring platform that acts as a SIEM/XDR solution. Though it has some shortcomings, it has tons of strengths, my favorite ones being; its customizability and its open-source nature. This article will be more or less a tutorial on how to write a simple custom wazuh rule to detect potential port scans on a monitored host.
Zig is not a memory-safe language. It, however, provides some tools to help avoid some memory safety issues. One of the key tools that help achieve this is the debug allocator.
In-memory execution, a technique that allows programs to be run directly from memory without being written to disk.
A while back I wrote a small neofetch-like program in Zig as a way to learn the language. I always knew Zig could interoperate with C, as I had earlier written a yara rules parser using treesitter and Zig.
Now I wanted to test my neofetch-like program in various environments, and one
of those was st.
This is a follow up on my previous article.
It is generally about my journey in searching for a relatively unknown and easy to understand packer to obfuscate my custom zig C2 agent. If you are generally looking for a tutorial on how to pack binaries, this is not it. I will not go into the details of how packers work, but rather share what led me to the final solution.
Over the past couple of months, I’ve been writing a mythic C2 implant in zig. “Why?”, you ask. Well, it’s all part of my learning process. I also wanted to understand how C2 frameworks work and how zig can be used for offensive tooling.
It’s been a while since I wrote yara rules. In fact, the last time I did, I was still using vscode. I needed now to write one. So I chose to look at one of my local yara rules repo. Opened it in nvim and … no syntax highlighting.
This article was originally published on section.io, May 2022
This article was originally published on section.io, February 2022
I had previously written about my cutting up of clearfake which you can find here.
Quick recap:
data.zip file.On March 25th 2025, Troy Hunt, haveibeenpwned’s author, published in his blog about how a sneaky phishing lure got hold of his mailing list. This interesting read made me reminisce about how, not so long ago, I almost fell for a similar thing, albeit mine was not so sophisticated.
In my previous post I talked about how you can use snyk in your editor as you code and even added snyk-ls as a must have. I had a bit of a tough time finding the correct configuration to achieve this using Neovim. Perhaps you are, right now, on the same path as myself last year. Luckily for you, I gotchu.
Here is a quick list of my Neovim setup for dev work. This includes plugins, LSPs and some handy keymaps.
A while ago (around 7 months ago), I had obtained, through a friend, a sample of clearfake malware that was wrecking havoc in one of his friend’s servers.
This post is about analysis I had done. I have been procrastinating a lot on writing it, so here it goes…
Originally written Thu, Jun 15, 2023