Not was. Not used to be. All three, at the same time, on purpose. I build tools, find vulnerabilities, and write about both.
Almost two decades of reading systems under pressure. First in clinical care, now in security. The pattern recognition doesn't change, just the systems being interrogated.
The combination of everything I know is how I work on the problems that actually matter.
More about meA few things about me.
18+ yrs nursing experience
OSCP & CPTS
Published CVEs
US
ZoneMinder's event export concatenates monitor names directly into shell commands. One unsanitized source, two exec() sinks, and a payload that someone else can trigger for you.
A path traversal in Camaleon CMS that only triggers under a weird combination of Rails 8, the Solid trio, and an S3 backend. Found by accident. Reproduced through stubbornness.
Eighteen years of high-stakes clinical work on top of offensive security credentials is a rare combination. If that matters to your team, I'd like to hear from you.
Eighteen years of high-stakes clinical work on top of offensive security credentials is a rare combination. If that matters to your team, I'd like to hear from you.