publications
Books, papers & long-form.
Independent books, peer-reviewed papers, and selected articles. For press, interviews and conference talks see press & talks.
- 2024on requestBook · Independent
Field Manual: Modern Web Exploitation
A practitioner's guide to current-era web attack surface — request smuggling, prototype pollution, SSRF chains, and identity provider abuse.
- 2025on requestPaper · WOOT '25
PKCE Downgrade Attacks Against Public OAuth Clients
Formal analysis of method negotiation in widely deployed OAuth libraries and three CVE-class findings.
- 2024on requestArticle · Phrack #72
AD CS Revisited: Two Years After ESC1
What changed, what didn't, and why most environments are still vulnerable to certificate template abuse.