Analyze custom virtual machines written in JavaScript by extracting instruction tables, examining constants, and capturing runtime state. Use the findings to reconstruct how obfuscated code executes, including custom runtimes used in risk-control engines.
Investigate AI-agent and cloud infrastructure challenges in a CTF sandbox. Trace untrusted content into tool actions, compare deployment configuration with runtime behavior, and follow software artifacts from source through build and release to their actual consumers.
Analyze how EDR, software that monitors endpoint threats, and antivirus products detect activity. Support authorized exercises by examining monitoring mechanisms, assessing evasion approaches, and checking detection results in an isolated test environment.
Transfer known function and variable names from an older binary to a newer version. Compare disassembly and pseudocode with an LLM, produce structured mappings, and apply names and comments in IDA.
Assess authorized single sign-on systems using SAML, OIDC, and OAuth2. Map the login flow, check signatures, redirects, and token validation, then document reproducible findings and their impact, including identity or tenant confusion.
Investigate suspicious domains, scams, impersonation, and malicious activity using public sources. Preserve source details, check leads against independent evidence, and prepare a threat intelligence handoff that records confidence, verification status, and remaining gaps.
Turn notes, prose, code, schemas, or tables into editable diagrams, including flowcharts, architecture diagrams, and schedules. Choose Mermaid, Graphviz DOT, PlantUML, or SVG to suit the content, with image or PDF rendering when needed.
Investigate signs of intrusion through hypothesis-led log searches, then turn findings into detection rules. Supports Sigma, YARA, and SIEM queries, with attention to false positives, data field mapping, and validation against historical logs.
Support authorized hardware security research by locating debug interfaces, recording pin assignments and voltage levels, and collecting boot logs. Assess interface locks and firmware extraction options, then hand extracted images to firmware analysis tools.
Assess the security of LLM applications and AI agents by tracing inputs, retrieved content, tool calls, and outputs. Covers prompt injection, where content carries unwanted instructions, along with permission misuse, memory poisoning, and supply-chain risks.
Analyze authorized macOS applications and Mach-O binaries, the executable format used on macOS. Examine signatures, dependencies, Objective-C and Swift symbols, and runtime behavior to produce findings tied to specific addresses or symbols.
Assess security in authorized cloud, container, and Kubernetes environments. Review excessive permissions, exposed resources, container isolation, and cluster access controls, then document findings with reproduction details and their impact.
Create task-oriented READMEs, API references, architecture documentation, and security reports. Organize information from quick starts to deeper explanations, and turn completed investigations into formal Markdown reports with supporting evidence, reproducible steps, and appropriately masked sensitive information.
Compare software binaries before and after a security patch to identify the underlying flaw. Guide creation of a proof of concept, a small vulnerability demonstration, and compare its behavior across patched and unpatched versions.
Test desktop application security across local storage, communication between processes, network traffic, and update channels. Map where trust and permissions change, then investigate weaknesses in credentials, access checks, and update verification.
Inspect browser storage and caches in a CTF sandbox to explain changes in authentication, page rendering, or requests. Compare clean and modified states, then document the smallest sequence that reproduces the relevant behavior.
Analyze authorized browser extensions for Chrome, Edge, and Firefox. Inspect permissions, background scripts, storage, and network activity to reconstruct key data flows and explain credential handling, signing, encryption, or proxy behavior.
Analyze firmware from routers, cameras, and other IoT devices, from extracting internal files to running services in an emulator. Follow a staged workflow to investigate vulnerabilities and reproduce findings with firmware analysis and testing tools.
Assess authorized APIs through a ten-stage workflow covering endpoint discovery, authentication, access permissions, input handling, and request limits. Collect reproducible evidence and turn findings into regression checks that can run in a development pipeline.
Route reverse engineering and security tasks to a specialist skill based on the target, purpose, and available tools. Establish the case scope and authorization status, then prepare supported tools before handing off the work.
Inspect Android APKs from the command line to understand app logic, permissions, and components. Supports Java decompilation, low-level code edits, rebuilding and signing, plus Frida observation of running methods and routing to native code analysis.
Plan and coordinate authorized penetration tests across multiple stages, from reconnaissance to access, privilege escalation, movement between systems, and impact assessment. Assign specialist skills, revise blocked paths, and maintain evidence and progress records for the final report.
Analyze executable files and libraries with IDA Pro. Inspect pseudocode, strings, function calls, and data flow, then add meaningful names and comments and produce a Markdown report documenting findings and analysis steps.
Review an existing security case package before report handoff. Check links between evidence, findings, investigation paths, tasks, and timeline entries, optionally verify file hashes to detect changes, and produce a Markdown or JSON review.
Is this your account? Link GitHub to bring it onto your creator page (Japanese)