The Curious Engineer

All blogs / Security

Include Security Research Blog

blog.includesecurity.com

Team Research blog

SecurityReverse engineeringGame development

’15’20’25
Posts
50 from 19 Feb 2014 to 29 Oct 2026
Posting
monthly (7 in the last year)
Kind
company blog
Feed
https://blog.includesecurity.com/feed/

2026 6

  1. Abliterated Models in Appsec Pentesting
  2. EncryptedSharedPreferences is Dead: Here’s What You Should Use Instead
  3. Web App Pentesting in the AI Era
  4. The Smart TV in Your LivingRoom Is a Node in the AIScraping Economy
  5. CTFs in the AI Era
  6. The AWS Console and Terraform Security Gap

2025 7

  1. Immutable Strings in Java – Are Your Secrets Still Safe?
  2. Production Security, Not That Kind
  3. LLMs in Applications – Understanding and Scoping Attack Surface
  4. Misinterpreted: What Penetration Test Reports Actually Mean
  5. Cross-Site WebSocket Hijacking Exploitation in 2025
  6. Memory Corruption in Delphi
  7. Replacing a Space Heater Firmware Over WiFi

2024 6

  1. Spelunking in Comments and Documentation for Security Footguns
  2. Vulnerabilities in Open Source C2 Frameworks
  3. Coverage Guided Fuzzing – Extending Instrumentation to Hunt Down Bugs Faster!
  4. Discovering Deserialization Gadget Chains in Rubyland
  5. Improving LLM Security Against Prompt Injection: AppSec Guidance For Pentesters and Developers – Part 2
  6. Improving LLM Security Against Prompt Injection: AppSec Guidance For Pentesters and Developers

2023 3

  1. Think that having your lawyer engage your penetration testing consultancy will help you? Think again.
  2. Impersonating Other Players with UDP Spoofing in Mirror
  3. Mitigating SSRF in 2023

2022 5

  1. Hacking Unity Games with Malicious GameObjects, Part 2
  2. Reverse Engineering Windows Printer Drivers (Part 2)
  3. Reverse Engineering Windows Printer Drivers (Part 1)
  4. Hunting For Mass Assignment Vulnerabilities Using GitHub CodeSearch and grep.app
  5. Working with vendors to “fix” unfixable vulnerabilities: Netgear BR200/BR500

2021 9

  1. Drive-By Compromise: A Tale Of Four Wifi Routers
  2. Issues with Indefinite Trust in Bluetooth
  3. Customizing Semgrep Rules for Flask/Django and Other Popular Web Frameworks
  4. Hacking Unity Games with Malicious GameObjects
  5. Hack Series: Is your Ansible Package Configuration Secure?
  6. Dependency Confusion Vulnerabilities in Unity Game Development
  7. New School Hacks: Test Setup for Hacking Roku Channels Written in Brightscript
  8. Dependency Confusion: When Are Your npm Packages Vulnerable?
  9. Custom Static Analysis Rules Showdown: Brakeman vs. Semgrep

2020 1

  1. Announcing RTSPhuzz — An RTSP Server Fuzzer

2019 1

  1. IncludeSec’s free training in Buenos Aries for our Argentine hacker friends.

2016 1

  1. Introducing: SafeURL – A set of SSRF Protection Libraries

2015 3

  1. Strengths and Weaknesses of LLVM’s SafeStack Buffer Overflow Protection
  2. Firmware dumping technique for an ARM Cortex-M0 SoC
  3. A light-weight forensic analysis of the AshleyMadison Hack

2014 8

  1. Reversing the Dropcam Part 3: Digging into complied Lua functionality
  2. Hacking your hacking tools: When you absolutely must decode ProtoBuf
  3. Exploiting CVE-2014-0196 a walk-through of the Linux pty race condition PoC
  4. Mobile App Data Privacy – the Outlook.com Example
  5. Reversing the Dropcam Part 2: Rooting your Dropcam
  6. Reversing the Dropcam Part 1: Wireless and network communications
  7. How to exploit the x32 recvmmsg() kernel vulnerability CVE 2014-0038
  8. How I was able to track the location of any Tinder user.