Hackerman's Hacking Tutorials

(A)I reverse engineered Burp Suite's project format and built a tool that exports Proxy history, Repeater messages, and Target Site Map traffic.

It looks like higher reasoning effort (and even later models) are not always better for triaging security results.

LLMs regularly ignore my Markdown instructions.

I used GPT-5.4 and Claude Opus 4.6 to reverse engineer the Aula F108 Pro keyboard's software using Ghidra MCP.

I wake up and read the news.

The "radical" idea to add prompts and code context directly to SARIF files for AI triage.

Ladies and gentlemen, my name is Parsia and I'm here to ask and answer one simple question: WTF is AI-Native SAST?

We want to use custom OpenAI compatible API LLMs with GitHub Copilot Chat in VS Code without API keys.

Kusto is important at my current employer and one of my work besties does SecOps.

This is a quick peek inside Burp AI.

A few weeks ago I wrestled with a complex Kusto query.

This is not a bug, but some notes about the new Steam "Open in Desktop" button.

We will continue the tree-sitter adventure and tackle the problems we couldn't solve with just tree-sitter queries.

tree-sitter is a parser generator.

I want to use Semgrep as a light code intelligence tool with a few experiments.

As is tradition, I started the SANS Holiday Hack and this time I almost did everything.

Semgrep has an experimental and (IMO) more readable rule syntax.

As is tradition, I started the SANS Holiday Hack and stopped midway.

I will talk about how I parsed Semgrep rules in YAML with Rust, how I created Rust structs from JSON schemas for Semgrep rules, and finally, what didn't work.

I will discuss the (not novel) concept of code review hot spots.

Let's talk about the security nightmare of handling hundreds of different game installations.

Here are some of my answers to the SANS Holiday Hack 2021.

The Visual Studio Code server in Windows Subsystem for Linux uses a local WebSocket WebSocket connection to communicate with the Remote WSL extension.

Semgrep's experimental autofix feature can automagically modify vulnerable code.

You would think modifying a GitLab repository from its CI job should be straightforward.

In part 3 of my attack surface analysis series, I will discuss an undisclosed RCE.

A few days ago I saw a tweet about thick client vulnerability.

Why are We Here?

We have an XSS in a desktop application, what happens next?

In Part 2 of the Attack Surface Analysis series I talked about how passing a remote file with a UNC path can lead to unexpected results.

Recently, I looked at the NordPass Password Manager browser extension.

Custom protocol handlers are an obscure attack surface.

Recently, I have started moving my non-critical websites to GitHub pages.

This year like last year and unlike 2018, I only did a few of the SANS Holiday Hack challenges.

A few months ago I found a way to subvert the update process of an Electron application to get local privilege escalation.

Earlier in December 2020, my PlayStation Now report was disclosed.

The other day I customized the Python built-in SimpleHTTPServer with some routes.

I will talk about some edge cases of the Same-Origin Policy (SOP).

I had the hono(u)r of presenting in the DEF CON 28 Appsec village.

An intentionally insecure system is insecure.

In this post we will use our knowledge from Thick Client Proxying - Part 10 - The hosts File to proxy GOG Galaxy 2.

A friend pointed me to this Go quiz about slices by Serge Gotsuliak.

Welcome to the 10th installment of Thick Client Proxying.

This is how I reduce the noise in Burp's HTTP history when testing thick clients.

I was looking at an application (not related to my day job) and I decided to reverse engineer how it creates logs.

This blog is about a GitHub Security Lab Spot The Bug challenge that had an overlooked bug.

A while ago I read Time Management for System Administrators by Tom Limoncelli.

A few years ago I did the Context Information Security challenges.

These are my notes for the booklet Documentation Writing for System Administrtors.

I did some of the solutions for the SANS Holiday Hack Challenge of 2019.