Skip to content

Blog

From the blog

Writeups, protocol deep dives, and the ideas behind attacks written down as data. The full corpus and reference live in the documentation.

Topics: designformatheartbleedidentityllmprotocolsreplicatls
plasma plasma 
###%%%%%%%###**+++==---:::::::---===++******
%%@@@@@@@@@%%%##**++==----::::::---===+++**#
%%%@@@@@@@@@@@%%##**++===----------====+++**
**####%%%%%%%###**+===-------------=====++++
=====++++++++===-::.     ...:::-----=======+
:::::::::::::::...        ...:::----========
::...........           ....::---===+++++***
==------::::::..........:::--===++**###%%%%%
#######*****++++==========+++**##%%@@@@@@@@@
designformatllm

Attacks as data: why a plain text format beats a script

Exploitmatic formalizes the hand-rolled replay script with a grammar. A solution is data, never code: no supply chain, a deterministic run, and a result that comes from the tests.

Read post
heartbeat heartbeat 
                                            
                                            
                                            
                                            
:::-=@@@@@-::::::=@@@@@@@@@@@@@@@@@@@@@@@@@@
:=-.      .@    @                           
            -*+-
replicaheartbleedtls

Build a vulnerable Heartbleed lab in minutes

A local Docker replica of OpenSSL 1.0.1c with nginx, and a replay of the Heartbleed solution that prints 2/2 verified.

Read post
tunnel tunnel 
...:::::.........:::::...       .::-------::
==--:..     ..:--==+++==--:::::::..::::---=-
-:::::-====--:.  ..:--:.   .:-=++++=-:..  ..
   .:--==-----====-=#%*==*#*+-:. ..::::.    
   .:--::.  .:-===-:. ==+*###*=--:-==+==-::.
::::-=+++=-::..::-+#%+=+#%*=:.   .:--=--:...
-:.....:::::::::---::    .:--====--:..     .
:::..     ..:-==++==--::::-------::.....::::
  ..:::-----:::::...        ..::---====--::.
protocolsidentitydesign

Eighteen protocols, one grammar

A step's identity is the protocol it speaks, from the IANA/STIX vocabulary. A closed grammar keeps every protocol expressible as the same plain text shape.

Read post

Write attacks down. Verify them.

Download the binary, point it at a target you own, and get a verified result. The corpus is open and the format is plain text.

Get started Read the docs