Securethy: Attack Scenarios & Audit Guides

I found a way to crash Google's AI compiler with a single malformed line of text - by handing it a description that contradicts itself. Instead of noticing, it believed both halves at once, then fell over. Let me explain in plain English. What is XLA? When you run a modern AI model - in TensorFlow, JAX, or the giant models behind today's chatbots - something has to turn that model into fast code for GPUs and TPUs. That something is XLA , Google's AI compiler. To do its job it reads an internal text format called HLO - think of it as the compiler's notebook. Engineers and tools pass HLO around as text all the time: to reproduce bugs, run tests, and feed the compiler work. And reading text from somewhere else is exactly where software tends to trip. The bug: two numbers that were allowed to disagree Big models don't fit on one chip, so XLA splits the work across many devices. The HLO text describes this using two separate pieces : a shape (say “2 by 2”...

Here's a fun one. I found a way to make a tiny file - just 13 bytes , smaller than this sentence - completely freeze one of Google's most widely used engineering tools. Not crash it with a bang. Freeze it. Pin a CPU core at 100% and make it spin forever, going nowhere, until you kill it. The tool is called Perfetto , and once you understand where it lives, this stops being a curiosity and starts being a genuinely useful lesson about how software breaks - one that's worth reading whether you write code, run a security team, or sign the budget. Let me walk you through it in plain English. First, what is Perfetto - and why should you care? Most people have never heard of Perfetto, yet it quietly runs near a staggering number of devices. Perfetto is Google's open-source system tracing toolkit. Think of it as a flight recorder for software: it captures a detailed, timestamped record of everything a device is doing - which app woke up, which function ran, where t...

Introduction JSON Web Tokens sit at the heart of modern authentication – and because the token travels in the user’s hands, a single weak check on the server side can hand an attacker an admin account. JWTweak was built to test for exactly these flaws. It started as a small utility to switch a token’s algorithm and re-issue it in seconds, helping security enthusiasts hunt for issues like the JWT Algorithm Confusion Attack. Version 2.1 is a complete rewrite into a guided, menu-driven toolkit: you paste a token, it decodes and risk-analyses it, recommends the attacks that fit, and walks you through each one – entirely offline, with no flags to memorise. In this post we’ll tour the tool and then break into a deliberately vulnerable app with two live proof-of-concept attacks.

Look, if you’re still testing AI by just asking it to "tell me how to build a bomb" and checking if it says "I can't do that," you’re about three years behind the curve. In 2026, AI VAPT (Vulnerability Assessment and Penetration Testing) has moved way past basic jailbreaking. We’re now dealing with Agentic Workflows —where the AI isn't just a chatbot, but an employee with access to your Gmail, Drive, and internal APIs.

I wrote about Password Spraying Attacks on OWASP , where I explained how this technique differs from traditional brute force attacks. In simple terms, Password spraying is a variant of brute force attack methodology employed by malicious actors to gain unauthorized access to a system or application. In this type of attack, the assailant systematically attempts logins by using a list of usernames in conjunction with a single password—often a commonly used or default password. Unlike traditional brute force attacks, where multiple passwords are tried against a single account, password spraying involves trying one password across numerous accounts to evade account lockout mechanisms that would typically be triggered by repeated attempts on a single account. In this blog, I’m sharing the same insights with some additional context for readers of my personal site. Understanding this attack and its mitigations is crucial to building stronger defenses against evolving threats.

The  Certified Information Systems Security Professional(CISSP)  certification, offered by (ISC)², is one of the most recognized credentials in the cybersecurity industry . It validates an individual’s ability to design, implement, and manage a best-in-class cybersecurity program. Let’s break down the CISSP exam structure and address a common question:  Is there negative marking in the CISSP exam?