Hacker at heart, threat hunter by trade. I think like an attacker to find what defenses miss, and I dig for attack techniques nobody has discovered yet. I emulate them in realistic labs, turn them into detections, and keep evolving the methods and tools behind them.
I’ve worked in cybersecurity since 2018, on a path that took me from networks to building SOCs, and on to malware analysis, incident response and digital forensics. I’ve been writing code and breaking things since 2007, and I’m a free and open-source software enthusiast.
Here you’ll find my articles, my projects are on GitHub, and feel free to reach out on LinkedIn.
In this video I obtain an interactive reverse shell on a test machine through a DNS tunnel. A custom C2 DNS server handles the agent’s queries and returns commands without being authoritative for the requested domain. This approach allows the use of arbitrary domain names, including legitimate-looking or even non-existent ones, helping the activity blend in with normal DNS traffic or mislead analysis. From a security perspective, this shifts the IOC from the queried domain to the DNS server.
In this video I obtain an interactive reverse shell on a victim machine with no Internet access using an Android smartphone as a Wi-Fi Rogue Access Point connected to the Internet, an ESP8266 (Wi-Fi) USB device that appears as a virtual COM Port and forwards serial traffic through the Access Point and an ATtiny85 virtual keyboard that injects the bootstrap payload to enumerate COM ports, detect the ESP8266, and execute the reverse shell over that port
A deep dive into the invisible Unicode obfuscation technique popularized by GlassWorm, extended to undocumented variants and unseen attack surfaces such as command lines and security logs.
