Research, CVEs, CTFs, and some yapping.

By Zenneth. Mostly web exploitation, with some pwn on the side.

Recent posts

Pinned 19 Feb 2026 10 min read

Weaponizing unicode case folding and URL inflation to create a new XS-Search oracle

a novel URL inflation gadget — branch-dependent unicode case folding pushes a redirect past chromium's 2 MiB URL limit, turning a query-normalization mistake into a clean cross-origin search oracle.

web xs-search browsers javascript unicode
14 May 2026 1 min read

Welcome

Welcome to my blog!

meta