Protocol Dissection
Behind the Peplink management plane.
Mapping CGI authentication, WTP, remote administration tunnels, and traffic flows on the Pepwave Balance 1350, with the full reverse-engineering record.
Independent security research
Reading between
the lines of
complex systems.
Field notes on vulnerabilities, reverse engineering, and the systems we trust.
Explore the archive
Selected research
All articles ↗
Firmware Reversing
Inside the CenturyLink firmware.
Investigating OpenWrt authentication, configuration decryption, RIP, MTD/NVRAM, and device-key derivation, including experiments and unresolved boundaries.
Vulnerability Research
Tracing command injection across router interfaces.
Analysis of three command injection vulnerabilities, from Telnetd argument handling to router HTTP interfaces, with code and experimental evidence.
Recent writing
All articles ↗Inside the CenturyLink firmware.
Investigating OpenWrt authentication, configuration decryption, RIP, MTD/NVRAM, and device-key derivation, including experiments and unresolved boundaries.
Behind the Peplink management plane.
Mapping CGI authentication, WTP, remote administration tunnels, and traffic flows on the Pepwave Balance 1350, with the full reverse-engineering record.
Following the DSR-250N request path.
Following historical CVEs, the firmware filesystem, and HTTP request handling to investigate DSR-250N overflow candidates and document the debugging process.