Viewing profile — nullcathedral

I wouldn't be surprised if we saw a headline in a few years when we find out other actors (e.g. China, Russia) have been buying this data en-masse too.

Yikes. Why are private organizations so happy to participate in mass surveillance.

I got bored so I decided to take another look at Roundcube :)

This was one of my most frustrating disclosures, feedback on the process is very welcome :)

Did you request a SSL certificate? Those are public, actors use those to scan any newly requested website for known vulnerabilities and other misconfigurations. I suspect you're ju…

Sonnet 4.6 and Opus 4.6 are still available here. Pro+ subscription.

Do you run a dedicated "AI SRE" instance for each customer or how do you ensure there is no potential for cross-contamination or data leakage across customers? Basically how do you…

I think the underlying point is valid. Agents are a potential tool to add to your arsenal in addition to "throw shit at the wall and see what sticks" tools like WebInspect, Appscan…

The website gave it away for me, felt very AI generated

One approach (Claude Code) is to evolve it over time. Start small and run /insights often and use that to refine the CLAUDE.md as needed. https://github.com/trailofbits/claude-code…

Feel free to correct me, but the ML classifier appears to be rather bare. Less than 20 hardcoded payloads with randomized URL encoding as the only augmentation. How does this gener…

Good suggestion! Thanks. I'll go write up a welcome post soon :)

Author here! Are you referring to the "What’s inside this vendor’s VMware images?" on the about page? That is merely an illustration of what goes on inside my head. This is the fir…

Author here! I have looked at Thunderbird. I'll go and look at some others as well, should have probably done that earlier.

https://nullcathedral.com Just waiting on some vendors to patch bugs before I can drop the first set of posts :)

I'd say I agree with you there for the low-hanging fruit. The deep research (there's an image filter here but we can bypass it by knowing some obscure corner of the SVG spec) is wh…

Maybe in the future when labs train more specifically on offensive work, lots of hand holding needed right now. Even simple stuff like training the models to recognize when they're…

I work in this space. The productivity gains from LLMs are real, but not in the "replace humans" direction. Where they shine is the interpretive grunt work: "help me figure out whe…