My Blog

Through the Wall: a kernel UAF turned into a Dirty Pipe-style write

File Stream Oriented Programming (FSOP) exploitation: House of Apple 2 through a heap FILE overflow

Browser Exploit Design Course Review (Zero Day Engineering)

Apple CVE-2026-43666: Out-of-Bounds Write in mDNSResponder

Forcing glibc to Hand You the Flag: Tcache Saturation, Three-Way Consolidation, and a UAF

Became OSCE3 - OffSec Certified Expert 3

Obtained OSED - Windows User Mode Exploit Development

Linux Kernel Exploitation: KASLR bruteforce and Overwriting modprobe_path to gain root privileges

Linux Kernel Exploitation: Heap Overflow & SMEP/SMAP Bypass using commit_creds(&init_cred)

Passed the Certified Android Exploit Developer course & exam - Mobile Hacking Lab

Hacking the Heap: The Data-Only Heap Overflow

1st and 3rd place at SnakeCTF - Italy

Format String GOT Overwrite Attack: From Printf to System Shell

ret2plt: ASLR Bypass via PLT/GOT Leak

ASLR Bypass with Libc given leak: Breaking Address Randomization

ret2libc ROP Attack (No ASLR): Reusing Library Functions

PIE Exploitation with Address Leak: Defeating Position Independence

Stack Canary Bypass with Format String Leak

ROP Chain Without Memory Leak: Return-Oriented Programming

Format String Vulnerability: Reading Memory Without Buffers

Shellcode Injection Buffer Overflow: Beyond ret2win

Basic ret2win Buffer Overflow: Your First Stack Smashing

Hacking the Nexxt Solutions NCM-X1800 router: Four CVEs and exploits

Exploiting Arbitrary Write via .fini_array in a ropchain

Fuzzing TCPdump with AFL++ to recreate CVE-2017-13028

Trust your gut when it comes to git: Hiding backdoors in .git files

Event Spoofing in EVM Chains: How Smart Contract Events Can Create Deceptive Transaction Records

1st place at EHGN (Ethical Hackers Groep Nederland) CTF - The Netherlands

Homoglyph Attacks: Confusing Characters to Obfuscate Logic

Creating an Invisible Unicode Hangul Filler Backdoor in web applications

Exploiting delegatecall vulnerabilities in smart contracts

Zero-Knowledge Proofs: Prove Your Bank Balance Without Revealing It

Writing Custom Shellcode in Assembly for Windows x86 (Finding Kernel32.dll)

Guest Podcast Thuis In IT (Dutch)

Bypassing ASLR and DEP using WriteProcessMemory

ASLR and DEP bypass using VirtualAlloc

Android SSL Pinning Bypass

Manipulating the Blockchain for Fun and (NOT) for Profit

Stack Pivoting to leaking libc in limited stack space

Creating a backdoor through APT sources

Leaking libc through puts@got with ROPchains

Stealing Browser History: Exploiting CSS Timing Side-Channels with requestAnimationFrame

Your Browser Leaks More Than You Think

Leverage XSS Impact with Capturing Photos and Videos

Prepared Statement Bypass in NodeJS MySQL

Race against the machine: exploiting race conditions in coupons

Stealing Secrets from internal Web Pages from XSS through command injection

MongoDB Injection (NoSQL) with Mongoose

ImageMath PIL PoC - CVE-2022-22817 | Amidst Us (HTB)

SQLi to Python Pickle Deserialization RCE | C.O.P (HTB)

Markdown XSS to Cache Poisoning through Directory Traversal

Bypassing CSP through jsDelivr

Manipulating iframes dynamically PoC

Prototype Pollution in PugJS

Hiding Malware in SVG's: A new Threat to NFTs (DUTCH)

File Inclusion Cheat Sheet

Circumventing DEP on x86 Windows

Deploying ERC-20 Tokens on Starknet with Caïro

Chainhunters - Criminal Blockchain Investigation

Crypto Crime Training

Development of custom blockchain tokens and smart contracts at cryptomaker.nl

Ethical hacking specialist at tozetta.com

Hacking Smart Contracts and Exploiting Vulnerabilities on the Blockchain

1st place at Hack The Hague - The Netherlands