Blog

  •

    Source code disclosure via exposed .git

    4.82 of 112 votes

    This is my write-up on a misconfigured .git repo I found during my day off and how the potential exploitation of this vulnerability can amount to source-code disclosure. During my day off I took a brief look at a particular vendor my employer was in the process of procuring a new service from. I quickly identified what appeared to be

  •

    My limited edition print art collection

    4.78 of 125 votes

    Over the years I've collected a number of prints from a particular artist. This artist is David Ambarzumjan, an incredibly talented painter from Germany that aims to combine abstract and surrealistic elements to express his fascination for nature in all its diversity and unpredictability. His works can be found in private collections and exhibitions all around the world, some of

  • How to install a Wazuh SIEM server on a Raspberry Pi 4B

    4.70 of 130 votes

    With many security professionals now working remotely from home, some are looking at ways in which they can improve their home environment network and endpoint security. Commercial SIEM solutions are often considered too costly and complicated to deploy, but free lightweight open-source solutions offering minimal overhead such as Wazuh provide a good compromise for those of modest means aiming to mature the security of their home or small

  • FEATURED

    I got a letter of appreciation from Cambridge University

    • General
    • by Jacob Riggs
    • 02-10-2021
    4.86 of 115 votes

    Recently, I received a letter of appreciation from Cambridge University after responsibly disclosing a critical vulnerability. The letter reads:We appreciate you taking the time, and effort, to inform us responsibly and ethically regarding these security issues. My report was well received and their triage and remediation efforts were swift.Thanks, Cambridge.

  •

    I hacked the Ministry of Defence so they sent me this coin

    • General
    • by Jacob Riggs
    • 28-09-2021
    4.84 of 159 votes

    The UK Ministry of Defence (MoD) sent me a VDP challenge coin for my finding and responsible disclosure of a critical (9.6 CVSS) severity vulnerability. Together with the coin was a small thank you note.Thank you! The Ministry of Defence takes the security of our systems seriously. To show our appreciation for all your time and effort, we would like

  • How I stumbled over a vulnerability in the Vatican

    4.85 of 145 votes

    This is my write-up and walkthrough for a simple low-complexity but potentially high-impact vulnerability I identified within files hosted on the Vatican web app. This started as me looking for a domain to set up a dedicated BIND9 service on a new DNS server I was building. I was looking for a domain, and for reasons I won't go into