/ WRITING · INDEX
— · — · — v 4.2 · MMXXVI
Long-form 6 entries 2 categories

// 02 — Recent writing

Field notes & writeups.

CVE disclosures, research notes, and engagement-grade writeups — published when they're cleared for release.

// mobile-pentest Mobile Pentest

iOS & Android pentesting tradecraft — Frida hooking, jailbreak/root-detection bypass, SSL pinning, runtime tampering.

№ 09 2026 · 05 · 06
iOS jailbreak detection bypass — a Frida + Objection field guide
21 min read iosfridaobjectionjailbreak-detectionmobilehooking
Read →
№ 08 2026 · 05 · 04
Defeating Android SSL pinning in 2026 — a Frida-first methodology
24 min read androidfridassl-pinningmobilehooking
Read →

// web-exploitation Web Exploitation

CVE disclosures and writeups against modern web targets — XSS, SQLi, SSRF, SSTI, broken auth.

№ 10 2026 · 04 · 28
Server-Side Template Injection — from leak to RCE across five engines
26 min read sstircewebjinja2twigfreemarkervelocity
Read →
№ 11 2026 · 04 · 22
SSRF against cloud metadata in 2026 — IMDSv2, parser confusion, and DNS rebinding
23 min read ssrfcloudawsgcpazuremetadataweb
Read →
№ 01 2024 · 09 · 15
CVE-2024-46638 — Stored XSS in HelpDeskZ v2.0.2
2 min read xsscvehelpdeskz
Read →
№ 02 2024 · 09 · 01
CVE-2024-44851 — Stored XSS in Perfex CRM File Sharing module
2 min read xsscveperfex-crm
Read →