Crispler Blog

Programming has always been about translating human intent into something a machine can execute. A digital computer works with electrical states that are modeled as 1 and 0. That is precise for the machine, but painful for humans. Assembly made the interface slightly better by giving humans mnemonics and labels, but the programmer still had to describe small machine operations by hand. Moving a value, setting a register, jumping to an address, comparing a condition, and managing memory all had to be expressed close to the processor’s view of the world....

Security research often starts with behavior that does not match the expected design. The signal may be a crash, a timing difference, a malformed response, an unexpected privilege boundary, or a log entry that appears only under a specific condition. The first mistake is to treat that signal as the conclusion. A crash is an observation. A vulnerability claim requires a working explanation of the path that caused it, the condition that triggers it, and the impact that follows from it....

Introduction Manual Source code review is one of the most essential skills for any penetration tester to have. This is one of the areas where even the experienced penetration testers are not comfortable. This is because there are multiple challenges associated with the manual code review. One of the challenges is the familiarity with the language. As a penetration tester, we come across several languages and technology stacks. It is not feasible for a person to be proficient in all the programming languages....