Address C:\Marba$\Projects

Projects & research

A running list of things I'm building, breaking, and organizing. This page grows as I do. Check the blog for the deep dives.

Building

• pwnagotchi.com is the oldest pwnagotchi seller around. We've outfitted folks with over 8,500 pwnagotchis, and it's still my corner for gear, builds, and the tinkering that doesn't fit anywhere else.
• Phreak Boutique is the shop and project bench for the hardware and oddities I put together.

These are personal projects, but they're not just for me: the proceeds help fund DC207 and the community security programs run by DirigoSec, the Maine nonprofit I preside over.

The book

• The Vulnerability Researcher's Handbook (Packt, 2023), my comprehensive guide to discovering, reporting, and publishing security vulnerabilities.

Research

A few of the write-ups I've bothered to publish here. There are dozens more CVEs and disclosures that never made it to the blog, or that went out through other channels.

• CVE-2021-22521, a privilege escalation write-up. Read it →
• CVE-2021-32077, fun with Social Security numbers. Read it →
• MARBAS-22-001, a Beckman Coulter Remisol Advance security advisory. Read it →
• Bypassing .NET request validation with MSSQL, a technique I keep coming back to. Read it →

Community & education

• BSides Maine, founder & lead organizer.
• DC207, lead for the DEF CON Group in Maine.
• OffSec Ambassador, helping people break into offensive security.

Want to collaborate, have me speak, or talk shop? Get in touch.