iiinova — where your digital self keeps evolving

Dominic White @singe.bsky.social · 18/08/2026

I love @RoganDawes@infosec.exchange’s Apostille for cloning x509 certificate chains to make certs look identical to users when they're forced to eyeball them when a rogue AP presents a different cert. But I wanted something more portable with fewer deps. You can grab GOpostille 👇

A screenshot of the usage text with figlet ascii art of the name

132

Dominic White @singe.bsky.social · 05/08/2026

The work from Mathy and friends showed that malicious channel switch announcements are a pretty good deauth primitive for management frame protection networks, so I added it to aircrack-ng: github.com/aircrack-ng/aircrack-ng/…

A screenshot of the new CSA deauth tool running, showing a wpa_supplicant with management frame protection connected to a hostapd with management frame protection getting deauthed. The handshake is captured in shifttymike’s new airodump-ng TUI at the bottom.

022

Dominic White @singe.bsky.social · 01/08/2026

My fortune cookie is even giving me sh*t about maintaining our WiFi hacking course.

A fortune cookie wrapped that reads “You will obtain you goal if you maintain your course”

040

Dominic White @singe.bsky.social · 01/08/2026

Year 25 of SensePost training at BlackHat, I think this is my 17th time.

160

Dominic White @singe.bsky.social · 30/07/2026

BlackHat airport advertising is up but this is the only one that unintentionally makes any sense to a hacker.

An advert for a hidden speakeasy (lol) with the text “You’re only a password away”

040

Dominic White @singe.bsky.social · 29/07/2026

I always love the care our training ops team puts into our BlackHat training swag but the war games mainframe and WiFi themes are both close to my heart. Thanks Darryn & Andre!

Two T-shirts, several playing cards, a lanyard and sticker all WOPR/Wargames movie themed and the WiFi cards have lots of WiFi references.

022

Dominic White @singe.bsky.social · 29/07/2026

I’ve seen a few dry runs of the absolutely fire talk Reino has prepped for everyone at DEFCON this year. Want to see multiple exploit chains on a widely deployed PED device deemed so impactful the vendor asked us to wait two years to disclose, then catch “Very Pwned” info.defcon.org/defcon34/con...

Everyday billions of credit card transactions are made worldwide, with the vast majority being done on purpose-built card machines. In the USA alone, nearly 400 million transactions are performed per day on these popular devices present in nearly every retail store. In this talk, I’ll focus on a widely deployed Verifone product line of card machines, with an estimated global deployment of over one million units. For several consecutive years I conducted an annual security assessment on these devices, until a pattern emerged: I'd arrive at the assessment, find a fresh set of vulnerabilities, gain root access, and then have Verifone patch the devices — only for me to return the following year and gain root access in a new way. I’ll demonstrate the three separate attack chains I discovered, two of which only required network access to the target. I’ll also detail additional vulnerabilities that could be used to disable hardening features such as grsecurity, including the ability to modify the file system to gain persistent access. Next, I’ll show how an attacker could leverage this access to continuously capture credit card information - contrary to the device’s security claims. Finally, in a homage to trixr4skids' DEF CON 25 talk in which he hacked an older series of Verifone's devices, I'll also run Doom.

111

Dominic White @singe.bsky.social · 27/07/2026

Every time we give our wifi hacking training @blackhatevents.bsky.social, we need to help people understand the vagaries of aircrack's airodump-ng, until now, because @shifttymike.bsky.social fixed it!

230

Dominic White @singe.bsky.social · 25/07/2026

I really like this evaluation matrix from @RoelofTemmingh’s @BSidesJoburg keynote for judging quality in a flood of AI slop. The one that resonated with me in particular was: “Has this person ever paid a cost for being wrong”

010

Dominic White @singe.bsky.social · 13/06/2026

Check whether a site supports post quantum crypto* quantumhello.xyz * Well hybrid PQ key exchange in the form of TLS 1.3 with X25519MLKEM768

104

Dominic White @singe.bsky.social · 09/06/2026

Whoa “describe an extension” just worked.

000

Dominic White @singe.bsky.social · 09/06/2026

A quick run through the new iOS 27 beta system settings and I noticed: 1 You need to join a waitlist to access new Siri 2 it now shows what type of WiFi is in use when connected 3 it may not be new - but there’s an “impersonation risk detection” feature that can be shared with apps

100

Dominic White @singe.bsky.social · 08/03/2026

We must never again allow ourselves to dehumanise each other.

Our government is treating the suffering of the Iranian people as a backdrop for our own entertainment, as if it's just another piece of content to be swiped through while we're waiting in line at the grocery store. But, in the end, we lose our humanity when we are thrilled by the destructive power of our military. We become addicted to the
"spectacle" of explosions. And the price of this habit is almost unnoticeable, as we become desensitized to the true costs of war. But the longer we remain blind to the terrible consequences of war, the more we are risking the most precious gift God gave us:
our humanity.

120

Dominic White @singe.bsky.social · 08/03/2026

We’re in the third cycle of the cybers it seems.

000

Dominic White @singe.bsky.social · 05/03/2026

Time to exploit reducing? Zero day clock? Pepperidge farm remembers the early 2000’s.

A graph from Gerhard Eshelbeck’s 2005 Insecure Mag article on the reducing exploit window. First presented at BlackHat 2003.

010

Dominic White @singe.bsky.social · 28/02/2026

I AI generated this punk song a week ago. Kind of saw it coming. Wish we could move on from rhyming the death and misery.

Maybe World War
Alnge
TRADE ROUTES, NOT TRENCH COATS
We're marching to the drumbeat of a maybe
World War,
While the suits keep score from the safest upper floor.
Learn the damn lessons written in the mud and wire:
Talk beats trenches, trade beats fire.
Shut down the drone, pick up the phone-No more "us and them," no more blood for a throne.
[Verse 2]
They're power-hungry kings in modern tailored wear,
Trading lives for leverage like nobody's there.
Sanctions, counter-sanctions, "peace" in quotation marks,
Another "precision" conflict lighting global

000

Dominic White @singe.bsky.social · 22/02/2026

Over the years I’ve always used some app to prevent my Mac from locking during long running tasks like password cracking sessions or more recently agentic workflows. But they’re poorly maintained or over complicated. So I made my own. NoLock does what it says on the tin github.com/singe/NoLock

The app icon. A picture of a crescent moon and an open padlock with the text NoLock below it.

181

Dominic White @singe.bsky.social · 18/02/2026

I'm impressed by how light weight the Apple on-device Foundation LLM is for Apple Intelligence, so I vibe'd a small macOS tool (26.0+) to interact with them. It supports GUI and CLI and tool calling. Even big responses fail to move the CPU/GPU by a single percentage. Link below.

A screenshot of the GUI searching the web for information about Hari Seldon

154

Dominic White @singe.bsky.social · 26/01/2026

I updated that Burp Global Match & Replace plugin to use the Montoya API, be able to target specific Burp tools (or apply globally), extend the rule matching syntax, and give you a view per request and response of the changes. github.com/singe/burp_g...

A screenshot of the rule editing dialog with all the options described in the readme.

021

Dominic White @singe.bsky.social · 19/01/2026

In Portswigger's Burp I needed a way to do Match & Replace globally across all utilities, not just the proxy so I wrote an extension github.com/singe/burp_g...

040

Dominic White @singe.bsky.social · 16/01/2026

The number of times people have tried to kill Net-NTLMv1 eh? youtu.be/lm7Cuktpnb4?...

142

Dominic White @singe.bsky.social · 15/01/2026

I figure the conical burr cup has a mix of extraction flavours all mixed together (due to the initial distribution and higher number of fines). The flat burr made my boring beans taste boring and punished sooner with wrong grind size (but rewards so much more on right). Enjoying these at the moment.

4 coffees two from Dark Matter roasters UK and two from Father Coffee roasters ZA.

000

Dominic White @singe.bsky.social · 01/11/2025

T’was 0xC0N Jozi today. That makes number 9, finally beating ZaC0N’s run of 8 years. It’s such a special con because it’s small and full of passionate attendees - no corporate wage slaves there for a day off work, just a bunch of hackers new and old.

shifttymike’s weaponised infrared remote no touch sensor trigger turned into a key fob. These were the speaker gifts.

050

Dominic White @singe.bsky.social · 28/10/2025

Just added SOCKS support to this reverse tunnelling tool github.com/singe/contun...

Three terminals stack on top of eachother. The top is running hub.pl on the host. The middle is running pool.pl on the “hacker” server. And the bottom shows a connection from the host through the hacked server to a target server over SOCKS.

021

Dominic White @singe.bsky.social · 19/10/2025

I missed Spinach & was tired of writing hard code that LLMs struggled to help with. So I decided to recreate the functionality of Spinach in a discord world. And so Cabbage was born. Cabbage is private for now, but it’s been so cathartic writing something easy and fun. And vhata saved Spinach’s DB!

A screenshot of the mobile view of GitHub looking at a private repo for the cabbage bot with 10 plugins in the plugins folder.

120

Dominic White @singe.bsky.social · 12/09/2025

I had occasion to hack on some Wordpress’es and realised there’s a ton of surface area exposed over the "new" REST interfaces. Here's a small utility to convert it into a OpenAPI/Swagger file so you can explore it in your pentests/bug bounty work. github.com/sensepost/wp...

It turns this into this, with two screenshots, one of a browser showing the /wp-json endpoint and the other with a swagger-ui view of the same.

0142

Dominic White @singe.bsky.social · 08/09/2025

Cyble wanted this blog post taken down … Barbra Streisand (woo ooh ooh woo woo)

060

Dominic White @singe.bsky.social · 07/09/2025

Total eclipse blood moon our side of the planet right now.

0111

Dominic White @singe.bsky.social · 15/08/2025

Interested in the release of hashcat 7 I retested my (now three year old) ntcrack against it. It made me smile to see it's still faster. github.com/sensepost/ntcrack

Output from multiple runs of hyperfine invoking and timing ntcrack with various different hash lists and word lists.

A screenshot of terminal output showing multiple hyperfine runs invoking and timing hashcat with a variety of hash and word lists. In all cases it’s slower than ntcrack.

030

Dominic White @singe.bsky.social · 09/08/2025

Later today, as Las Vegas hovers at its peak temperature on the 33rd iteration of DEFCON, @leonjza.bsky.social will take everyone in Track 4 on a wild ride through vuln ridden bloatware installed on many of the machines in the room and the world. info.defcon.org/content/?id=60380

7 Vulns in 7 Days: Breaking Bloatware Faster Than It’s Built

Sat, Aug 9 at 16:30 – 17:15 PDT
LVCC - L1 - Exhibit Hall West 3 - Track 4
DEF CON Official Talk
Demo 💻
Exploit 🪲
Description

Bloatware. We all hate it, and most of us are good at avoiding it. But some vendor tools – especially those managing critical drivers – can be useful when the Windows Update versions aren’t good enough for performance-critical computing.

What started as a routine driver update took a sharp turn when I confirmed a reboot modal… from my browser. Wait, my browser shouldn’t be able to do that!? To my disappointment (and maybe some surprise), it turned out to be arbitrary code execution – right from the browser. This kicked off a week-long deep dive, uncovering seven CVEs in seven days across several prominent vendors, all exploiting a common pattern: privileged services managing software on Windows with little regard for security.

040

Dominic White @singe.bsky.social · 28/07/2025

My attempt to create a custom feed to group skeets by semantic similarity using embeddings is so far better at finding bots than it is at grouping meaningful content.

111

Dominic White @singe.bsky.social · 20/07/2025

The original poster was circa 1987 groups.google.com/g/comp.unix.... and contained way more nuance and in-jokes.

A wizard pouring things into a cauldron. But the cauldron is a shell. There are pipes over head with a cat in the bottom right. Incredibly detailed with all sorts of in jokes.

140

Dominic White @singe.bsky.social · 20/07/2025

An AI remix of an old unix magazine cover somewhat updated for the modern age.

A Linus Torvalds looking wizard holding a wand and coaxing smoke from a cauldron. The cauldron has the word Linux on it and the smoke rising from it has the names of various unix commands like xargs, grep, awk and cat. The text at the bottom says “UNIX is magic”

290

Dominic White @singe.bsky.social · 28/06/2025

This mural in our Paris office is getting me excited. I’m done with this northern hemisphere heat wave. Bring on the cold!

030

Dominic White @singe.bsky.social · 15/06/2025

Today in unexpected things vuln researchers can use LLM’s for.

020

Dominic White @singe.bsky.social · 04/06/2025

Wifi hacking can be a useful tool, but people are out here grinding on WPA2 handshake cracking tutorials & menu driven attack tooling. When we built the 3rd and latest iteration of the wifi hacking course for BlackHat - we did it to show what really works and how it really works. 1/7

A DALL-E generated image of a hooded person behind a computer with a large glowing wifi symbol on it. In the background are neon posters with the words WPA2 handshake cracking, PEAP relay access, certificate bypass and BLACK HAT. The style is neon cyberpunk.

132

Dominic White @singe.bsky.social · 31/05/2025

I’ve been playing with LLM agents for cyber tasks and found models that work to be inconsistently ok and very expensive and @nickpending.bsky.social’s blogs perfectly echo what I’ve been feeling nickpending.substack.com/p/the-syst…

The Humbling Reality Check

Throughout this process, one observation kept nagging at me: AI is never going to take over the world if it can't properly parse help files and construct valid commands.

Here I was, an expert in both cybersecurity and AI, spending weeks struggling to get multiple sophisticated language models to correctly interpret httpx --help output and translate requirements into proper syntax. Even with the optimal approach, only 80% success rate.

The systematic testing revealed that the gap between AI capabilities and reliable technical execution is larger than the marketing suggests. Current models exhibit this weird capability inversion:

Can reason about abstract security concepts ✅
Can engage in sophisticated strategic dialogue ✅
Can generate creative problem-solving approaches ✅
Cannot reliably parse documentation and construct valid commands ❌

030

Dominic White @singe.bsky.social · 28/05/2025

Jeff @thedarktangent.bsky.social raises a possible driver for vigilante hack back - ineffectual law enforcement response. Super powered organisations may resort to “private armies”.

010

Dominic White @singe.bsky.social · 22/05/2025

I’m really enjoying nerve for building agents, but found myself wanting to limit tool output to reduce input tokens or avoid tripping message length limits, so I made this PR github.com/evilsocket/nerve/pull/58 For example, this page parameter was auto added by nerve.

002

Dominic White @singe.bsky.social · 14/05/2025

If you're Russian and encrypted, it's for free, if you're Russian gov and you're encrypted, it's for free. If you're Russian and encrypted, and you really can't decrypt it, if you're Russian and encrypted - it's for free.

031

Dominic White @singe.bsky.social · 09/05/2025

Some of these lockbit ransom negotiations are … This one from a financial services company that definitely knows better.

020

Dominic White @singe.bsky.social · 17/04/2025

Weird. I'm using 0.9.2 and thee free plan.

100

Dominic White @singe.bsky.social · 16/04/2025

Finally getting to play with evilsocket's nerve. As usual he's provided a super accessible way to play with something that otherwise needs a lot more scaffolding. Here it is doing a code audit of jollyexec and producing six patches to correct the issues.

A screenshot of Claude Desktop showing it running two commands list_folder_contents and read_file. Both commands highlighted as being executed from the nerve-tools local mcp. On the right is a code canvas listing six code patches to correct vulnerabilities identified in the code.

120

Dominic White @singe.bsky.social · 14/04/2025

Amazing that despite numerous C2 comms to this IP from malware, it's still clean as a whistle on VT. So much for all that vaunted threat intel helping us clean up malicious comms. www.virustotal.com/gui/ip-addre...

VirusTotal page for the IP 45.144.53.145. Showing 21 malicious files as confirmed communicating with it.

020

Dominic White @singe.bsky.social · 03/04/2025

That @staaldraad.conch.cloud, always ahead of his time. This time by 15 years.

150