m4t
ENPL
● available for collaboration · Q1 2026

Offensive security research & engineering.

I'm Mateusz Adamczyk — security researcher and engineer. I publish notes on vulnerability research, exploit development, and the systems I break for a living.

m4t@research:~$
read research →press & talksabout
as seen in
WiredNiebezpiecznik.plDarknet DiariesThe RecordGazeta WyborczaPhrack
featured

Latest research

view all →
10 min

Security+ Exam Day Strategy and Performance-Based Questions

How to manage the 90-minute SY0-701 clock, approach PBQs, eliminate distractors, and avoid common self-sabotage on CompTIA Security+.

#security-plus#sy0-701#exam-strategy#pbq
Security+ Acronyms That Matter (and How to Learn Them Fast)Governance, Risk, and Compliance: Domain 5 Without Bureaucracy FogIncident Response and Vulnerability Management for Security+
ctf

Recent writeups

view all →
HTBHard9 min

HTB · Cerberus — Three-Headed Privilege Escalation

Chaining an SSRF in a SAML responder with a misconfigured ADCS template for domain admin.

#htb#ad#saml#adcs
THMMedium7 min

THM · Glyph — Reversing a Custom VM

Recovering the bytecode dispatcher of a hand-rolled stack VM and decrypting the flag with a 40-line Python lifter.

#thm#re#vm
upcoming

In the pipeline

  • researchQ1 2026

    Bypassing Kubernetes Admission Controllers via Mutating Race

    A timing window between admission decision and object persistence that allows policy-violating workloads to land.

  • ctfFeb 2026

    HTB · Season VI Finale — full chain writeup

    Domain takeover via abused MSA delegation and a forgotten Exchange transport rule.

  • talkMar 2026

    Talk · BSides Warsaw 2026

    Engineering offensive tooling that survives EDR maturity curves — patterns and anti-patterns.

press

In the press & on stage

view all →
  • Wired· Feature · EN
    Why the next major breach will start in your build pipeline
    Oct 2025
  • Niebezpiecznik.pl· Interview · PL
    Jak działają ataki PKCE downgrade — rozmowa z m4t
    Sep 2025
  • Gazeta Wyborcza· Feature · PL
    Polacy łamią systemy — i robią to dla naszego bezpieczeństwa
    Jun 2025
  • Darknet Diaries· Podcast · EN
    Ep. 152 — The OAuth Job
    Apr 2025
linkedin

Recent posts

follow on linkedin →
publications

Books & papers

view all →
Book2024

Field Manual: Modern Web Exploitation

A practitioner's guide to current-era web attack surface — request smuggling, prototype pollution, SSRF chains, and identity provider abuse.

Paper2025

PKCE Downgrade Attacks Against Public OAuth Clients

Formal analysis of method negotiation in widely deployed OAuth libraries and three CVE-class findings.

Article2024

AD CS Revisited: Two Years After ESC1

What changed, what didn't, and why most environments are still vulnerable to certificate template abuse.

contact

Work with me

Selective consulting, responsible disclosure, speaking.

get in touch →