Research

Security analysis of networked vending machines running embedded Linux and Windows IoT — from unauthenticated cashless payment APIs to remote code execution via unpatched telemetry agents. Demonstrated full compromise of MDB (Multi-Drop Bus) payment interfaces, manipulation of product pricing logic, and persistent implants surviving reboot cycles. Findings cover 5+ major vending platforms and responsible disclosure outcomes with vendors.

Discovered 25+ LLM vulnerabilities with 80% guardrail bypass rate across major AI platforms. Includes adversarial prompting methodology, model behaviour taxonomy, and responsible disclosure timeline.

MQTT fuzzing campaign against 100+ IoT device types identifying 12 critical vulnerabilities in smart home infrastructure. Full disclosure with vendor coordination, exploitation PoCs, and remediation guidance.

Architecture and performance analysis of the NVD-LLM threat intelligence pipeline — latency benchmarks, LLM selection rationale, MCP server design, and empirical comparison against manual analysis workflows.

Design and implementation of covert C2 infrastructure with OverlayFS-on-tmpfs for zero forensic persistence. Traffic obfuscation analysis, EDR evasion rates, and detection signatures for the defensive community.

Case study from securing 15+ platforms — WAF configuration, TLS hardening, authentication hardening, and penetration testing methodology. Remediated 50+ critical issues including SQLi, XSS, and IDOR chains.

Weaponization analysis of PwnKit and MOVEit exploits in combined privilege escalation chains. Achieved 85% escalation success rate in simulated environments. CVSS analysis and detection guidance included.