Digital World (III): The Tamer's Digivice — V-Pet Biometrics, Rhythm Combat, and Automaton Manipulation
In the previous two articles, we traced the evolution of this project: starting as a 17,000-line Python monolith floating over the Linux desktop, and subsequently transformed into a living cellular automaton governed by Conway’s rules across File Island. We now had an ecosystem where cells reproduce, wild fauna competes for forage, and biomes evolve organ..
Read more
Digital World (II): Digi-Life — Adapting Conway's Game of Life to the Ecology of File Island
In the previous post, I explained why the original architecture of virtual pets floating over X11 windows hit a conceptual wall: the world needed to be a living organism. Not a static backdrop across which sprites wander, but an emergent system that breathes, grows, corrupts, and competes for computational resources. To solve this challenge, I turned to o..
Read more
Digital World (I): From X11 Desktop Pets to an Autonomous Living Ecosystem
For years, I’ve had an itch to scratch when it comes to Digimon video games. Aside from niche gems of the PlayStation era like the original Digimon World, almost all modern adaptations commit the exact same sin: they turn Digimon into generic turn-based RPG avatars wrapped in monster skins, completely disregarding the original concept born in the late 90s..
Read moreCTF Walkthrough: Prototype Pollution from Client-Side to RCE (BLEACH Enterprise)
A few weeks ago, this CTF from XDMIRROR popped up on my feed: a mock corporate IT management panel called BLEACH Enterprise built entirely around prototype pollution. Five distinct gadgets, spanning from client-side DOM XSS and open redirects all the way to server-side auth bypass, SSRF, and full RCE in Node.js—all exploiting the exact same root cause vuln..
Read moreJavaScript Libraries and Browser APIs Worth Knowing for Security (2025)
End-of-year post. This one is a roundup of JavaScript libraries and browser APIs that I’ve found interesting from a security angle in 2025 — either because they’re useful for offensive tooling, because they’re misunderstood in ways that create vulnerabilities, or because they expose attack surface that defenders miss. Not a “top 10” list with scores. Just ..
Read moreClient-Side Hacking Curiosities (2025 edition)
Been accumulating a list of client-side weirdness all year. Things that surprised me, techniques I found while reading specs, and browser behaviours that look benign on paper but get interesting when you think adversarially. No particular order, no particular coherence — just a dump of things worth knowing if you spend time attacking or defending browser e..
Read moreOffensive Callback (IV): OSINT Pipeline and IP Intelligence
Fourth and last post in the Offensive Callback series. This one covers what happens server-side once the callback server has an IP address — the full intelligence enrichment pipeline that runs automatically for every new source IP that hits the system. The goal is to go from “an IP connected” to “here’s everything we know about that IP” with minimal manual..
Read moreOffensive Callback (III): Inside the Browser Stealer — merch.js
Third post in the Offensive Callback series. This is the deep dive into the client-side JavaScript payload — what I call merch.js internally, served as dl.full.min.js by the XSS dealer. It’s the piece that runs in a victim’s browser and does all the actual collection work. The file is about 10,000 lines minified and bundles several libraries: a hashing lib..
Read moreOffensive Callback (II): Dealers — Collection Points and Routing Engine
Second post in the Offensive Callback series. This one is about dealers: the server-side collection endpoints that define what happens when a request arrives and how telemetry gets delivered back. If you haven’t read the first post about the server architecture, start there. Here I’m going to focus entirely on the dealer system. What is a dealerA dealer i..
Read moreOffensive Callback: Multi-Protocol Passive Intelligence Collection
So I’ve been sitting on this for a while. I’ve been working on a tool that I call Offensive Callback — a passive intelligence collection server that captures inbound traffic across HTTP(S), WebSocket, DNS, and ICMP simultaneously, enriching every hit with browser telemetry, geolocation, and automated OSINT. This post is about the server itself: what it ru..
Read more