ls -la /blog/

Security Research & Insights

Technical deep-dives, vulnerability research, and insights from our offensive security experts.

prodefense://blog/13 files

The GCP Service Account That Could Read Everything

Dec 20, 2025Matthew Keeley3 min read

A short story about Artifact Registry reader access, container images, and why build history quietly leaks secrets.

Red TeamCloudRed Teaming

ZBT WE1626 Wireless Router CVE Disclosures (CVE-2022-45551)

Jun 30, 2024Matthew Keeley, Ryan Jones12 min read

A detailed analysis of three critical vulnerabilities discovered in the ZBT WE1626 Wireless Router, including unauthenticated remote code execution, insufficient debug interface protection, and UART interface vulnerabilities.

Vulnerability ResearchResearch

Building an AppSec Program: Part 1 of a 4-Part Series on Application Security

Jun 16, 2024Matthew Keeley12 min read

A comprehensive guide to building an application security program from the ground up, covering team structure, roles, metrics, KPIs, and best practices for scaling security with your organization.

Application SecurityAppSecSecurity Program

Hawk's Prey: Snatching SSH Credentials

Apr 26, 2024Matthew Keeley5 min read

Introducing Hawk, a Golang tool for monitoring /proc to capture SSH, SU, Sudo, and Passwd credentials on Linux systems in real-time, designed for red team operations and network privilege escalation.

Tool ReleaseRed TeamTool

Accessing Hundreds of RDS Databases with AD Credentials Using Python and JDBC

Mar 20, 2024Matthew Keeley4 min read

A guide to accessing hundreds of RDS databases at scale using Python, JDBC, and Active Directory credentials, with practical code examples and solutions.

EngineeringPythonJDBC

Stay Updated on Security Research

Subscribe to receive our latest vulnerability research, threat intelligence, and security insights.