the lab notebook. writeups land here when the work holds up, not a day before.
an llmjacking honeypot, a quarter-million captured requests, and the anti-phishing org that showed up in its own prompt. 250k inference requests from one ip, ten languages per domain, and a tls cert that named the sender.
i detonated a full ad attack chain against my own wazuh + sysmon lab and scored every phase: detect vs void. two custom rules passed the vendor's own logtest and had never fired in production. three stacked bugs, one green check.
a too-permissive sudo shim, a sealed detonation lab, and four rounds of fake C2 to pull a diicot cryptomining crew's live zephyr wallet out of a $6 honeypot.
more on the bench, writeups land when the work holds up, not a day before:
what a control channel gives away through timing, power, and iq, before anyone touches an encrypted frame.
how far a modern client can be pushed back down the sae handshake, and where it holds.
where a tool-calling agent can be steered: injected prompts, poisoned context, and the paths that leak out.