offensive security researcher. i hunt hostile-input bugs - the kind that pop when a security tool eats attacker-controlled data - and i run responsible disclosure campaigns against whoever ships them.
- 🔎 tool audits - i point scanners, frameworks and agents at themselves. recent reports: Tenable, Rapid7, Greenbone
- 💥 CVE PoCs - weaponized proof-of-concepts in my spare time (see below)
- ☁️ cloud red team - AWS / GCP attack paths, role juggling and privilege-escalation mazes
- 📻 hardware bench - Flipper Zero + ESP32 counter-surveillance: hunting Flock/ALPR cameras and rogue BLE trackers
- 🐍 languages - Python first, Ruby for module dev
score so far: 2 fixed (1 with a bounty 🏆) - 2 partially fixed - 4 ghosted 👻 - 3 refused - 1 pending public writeup
these are feeding a security conference talk.
| # | target | contacted | outcome | notes |
|---|---|---|---|---|
| 1 | REDACTED1 | Jun 12, Jul 2 |  |
declined to fix |
| 2 | REDACTED2 | Jul 8, 10, 20 |  |
no response |
| 3 | REDACTED3 | Jul 15, Jul 26, Jul 2, Jul 10, Jul 20 | |
no response |
| 4 | REDACTED4 | - |  |
part of the potential Black Hat Europe talk |
| 5 | REDACTED5 | Jun 21, 26, Jul 10, 20 | |
no response |
| 6 | REDACTED6 | Jun 20, 25, 27, Jul 3, 13, 20 | |
PoCs delivered, then silence |
| 7 | REDACTED7 | May 6, 15, Jun 15, 21, 26, 30 |  |
some vulns fixed |
| 8 | REDACTED8 | Jun 21, Jul 2, 10, 13, 20, 20, 21 |  |
vulnerabilities fixed |
| 9 | REDACTED9 | Jul 8 | |
tickets marked resolved, not interested |
| 10 | REDACTED10 | Jun 27, 29, Jul 2, 10 | |
tickets closed as resolved/spam |
| 11 | REDACTED11 | Jul 24 |  |
fixed, bounty paid |
| 12 | REDACTED12 | Sep 27 | |
hostile-input audit of a C2 framework; DoS crash-loop finding fixed same-day by the author (verified against the fix commit), more findings in the pipeline |
the pipeline: submitted -> acknowledged -> verified -> fixed -> public -> bounty. chips fill left to right as stages land - outline means not there yet.
| Submitted | Type | Vendor | CVE | Channel | Status |
|---|---|---|---|---|---|
| Aug 26 | file read | Tenable | HackerOne 3971365 |  |
|
| Aug 29 | bypass | Greenbone Security | 06e9e46e | direct email |  |
| Aug 29 | SQLi | Greenbone Security | 4ddc78e0 | direct email |  |
| Aug 29 | Confi Change | Greenbone Security | 2929e8fc | direct email |  |
| Sep 5 | DoS | Plex | direct email |  |
|
| Sep 5 | SSRF | Plex | direct email |  |
|
| Sep 5 | Auth Bypass | Plex | direct email |  |
|
| Sep 14 | HTMLi | Tenable | HackerOne 4029330 |  |
|
| Sep 16 | Malicious Upload | Tenable | (likely) CVE-2026-103947 | HackerOne 4034759 |  |
| Sep 27 | DoS (crash loop) | Mythic (its-a-feature) | 6477dad8 | author DM |  |
| Oct 18 | Auth RCE | AdaptixC2 | GHSA-w4xp-8xrp-7686 | Github Security Advisory |  |
| Oct 18 | Auth File Write (Limited RCE by host OS family) | AdaptixC2 | GHSA-hg7v-748c-2xmc | Github Security Advisory |  |
Exploits for CVEs I hadn't found elsewhere and developed.
| CVE | PoC |
|---|---|
| CVE-2026-19626 | POC-CVE-2026-19626 |
| CVE-2026-19679 | POC-CVE-2026-19679 |
| CVE-2026-19681 | POC-CVE-2026-19681 |
| CVE | Info |
|---|---|
| NOCVE-2009 | Addonics NAS Adapter NASU2FW41 bts.cgi DoS |
| NOCVE-2009 | Addonics NAS Adapter NASU2FW41 nas.cgi DoS |
| CVE-2009-4753 | Addonics NAS Adapter NASU2FW41 FTP based DoS |
| NOCVE-2009 | HP Deskjet 6840 firmware XF1M131A reflected XSS |
| NOCVE-2010 | CiviCRM 3.1 < Beta 5 - Multiple Cross-Site Scripting Vulnerabilities |
| NOCVE-2010 | dotProject 2.1.3 XSS / Improper Permissions |
| NOCVE-2017 June, 01 | Torch router authentication bypass, clear text credentials, and more. CERT VU#118167. |
| CVE-2017-6526 | dnaLIMS unauthenticated RCE |
| CVE-2017-6527 | dnaLIMS directory traversal |
| CVE-2017-6528 | dnaLIMS plaintext password storage |
| CVE-2017-6529 | dnaLIMS session hijacking |
| CVE-2022-34876 | VICIdial authenticated SQLi |
| CVE-2022-34877 | VICIdial authenticated SQLi |
| CVE-2022-34878 | VICIdial authenticated SQLi |
| CVE-2022-34879 | VICIdial reflected XSS |
| CVE-2024-48530 | eSoft Planner DoS |
| CVE-2024-48531 | eSoft Planner reflected XSS |
| CVE-2024-48533 | eSoft Planner account enumeration |
| CVE-2024-48534 | eSoft Planner reflected XSS |
| CVE-2024-48535 | eSoft Planner stored XSS |
| CVE-2024-48536 | eSoft Planner incorrect access control |
| CVE-2026-87690 | Metasploit Dir Traversal to RCE |
| CVE-2026-102507 | Sliver DoS |
https://www.exploit-db.com/?author=1611
full list of external repos (not mine) that i've sent PRs to:
593 upstream PRs to 25 external repos (repos i don't own), plus 25 collab PRs in friends' forks
metasploit module work usually starts in friends' forks before it lands upstream: