Mav Levin Security Research

TL;DR Technical plot: I found RCE in retesteth, the Ethereum Foundation’s official blockchain testing infrastructure created to prepare for “The Merge” (Ethereum’s transition from Proof of Work to Proof of Stake1).

Every 12 seconds, risk-free profit is auctioned for millions on the Ethereum network.

I found this 0-day while competing in CPTC (Collegiate Penetration Testing Competition).

Here’s a fun html-injection vulnerability in one of Stanford University’s websites and how I found it.

Announcing my latest developer tool: Source Snapshot – A source code directory visualizer for your browser.

Solidity Integers Solidity supports 64 different integer types!

I recently bought a new DIR-842 home router, and immediately (as any hacker would) started toying with it - I can’t call it mine until I pop a shell on it.

If you too have been personally victimized by Python3’s 'str' object has no attribute 'decode' exception and other string/bytes-related exceptions, I feel your agony.

The world’s most popular torrent client, uTorrent, contained a security vulnerability — later to be called CVE-2020-8437— that could be exploited by a remote attacker to crash and corrupt any uTorrent instance connected to the internet.

Imagine if your first reverse engineering exercise was to reconstruct an encrypted IAT – if you don’t fully know what that means, that’s the point: beginner reverse engineering exercises should be clear (and fun)!