███████╗██╗ ██╗██╗ ██╗ ███████╗████████╗ █████╗ ██████╗██╗ ██╗ ██╔════╝██║ ██║██║ ██║ ██╔════╝╚══██╔══╝██╔══██╗██╔════╝██║ ██╔╝ █████╗ ██║ ██║██║ ██║ ███████╗ ██║ ███████║██║ █████╔╝ ██╔══╝ ██║ ██║██║ ██║ ╚════██║ ██║ ██╔══██║██║ ██╔═██╗ ██║ ╚██████╔╝███████╗███████╗███████║ ██║ ██║ ██║╚██████╗██║ ██╗ ╚═╝ ╚═════╝ ╚══════╝╚══════╝╚══════╝ ╚═╝ ╚═╝ ╚═╝ ╚═════╝╚═╝ ╚═╝ ██████╗ ██████╗ ████████╗ █████╗ ████████╗ ██████╗ ██╔══██╗██╔═══██╗╚══██╔══╝██╔══██╗╚══██╔══╝██╔═══██╗ ██████╔╝██║ ██║ ██║ ███████║ ██║ ██║ ██║ ██╔═══╝ ██║ ██║ ██║ ██╔══██║ ██║ ██║ ██║ ██║ ╚██████╔╝ ██║ ██║ ██║ ██║ ╚██████╔╝ ╚═╝ ╚═════╝ ╚═╝ ╚═╝ ╚═╝ ╚═╝ ╚═════╝
> a potato that does security
0x01 Introduction
I do offensive security at Intruder — dev and pentest background. Mostly I poke at web apps and automate the boring parts of finding bugs.
This page is static — no trackers, no frameworks, no cookie banner — and doubles as my GitHub profile and the landing spot for a handful of domains.
0x02 Writing
// posts @ intruder.io
// research
0x03 Current Research
*Mass exploitation of N-days — automation that turns any CVE or disclosed vuln into a working PoC + vulnerability check within an hour. post soon™
*Reverse engineering — some experiments in doing it at volume. Still cooking.
*Attack surface — poking at what's exposed on the internet.
0x04 PoC Index
Self-hosted PoC gadgets for authorised bug-bounty / pentest work, so client PoCs never depend on third-party infra. SVGs based on Brute Logic's work. Served straight off this host.
$/empty.svg — empty SVG,
alert(document.domain) on load.$/potato.svg — SVG image carrying an alert box.
$/redir.svg — open-redirect PoC.
?url=, &w=1 warns first.$/c.js — remote-JS execution proof (console).
$/p.js — visual XSS phishing PoC for screenshots.
$/clickjack.html — clickjacking framer.
?url=$/cors.html — CORS misconfig tester.
?url=$/csrf.html — CSRF PoC generator.
?action=&fields=$/pm.html — postMessage / CSWSH tester.
?url=$/hunter.js — DOM-XSS sink spotter.
$/polyglot.txt — XSS polyglot reference.
$/xxe — OOB XXE DTD generator.
?token=&f=0x05 Services
$
curl 0y.is — this page as plaintext .nfo for terminals.$
0y.is/<slug> — short links for length-restricted fields.$/meta/<cloud> — 302 to cloud metadata (aws/gcp/azure/…). SSRF testing.
$/echo — your request, exactly as the server saw it.
$/ip — your egress IP.
0x06 Contact
EOFfullstackpotato · Scotland