Dominic White

Found an issue in hostapd's PEAP crypto binding* implementation when using TLS 1.3 in preparation for a new wpa_sycophant release. Report & patch: lists.infradead.org/pipermail/ho... * crypto binding is the mechanism that prevents relay attacks against PEAP networks.

Agent swarms, sandboxes, and bad alignment - I had a lot of fun making sense of the current state of things with CheckPoint's AI security head Adam Ely and @techcentral.co.za's @fanievanrooyen.bsky.social in this podcast. techcentral.co.za/tcs-rogue-ai...

New gowitness, 3.20! github.com/sensepost/go...

I added post-quantum authentication (ML-DSA) checks to QuantumHello, thanks to the ML-DSA support in go 1.27 from @filippo.abyssdomain.expert and others. quantumhello.xyz

Dogpiling or harassing users is unacceptable. We have taken recent action against accounts for this behavior, and we will be increasing our efforts, consistent with our Community Guidelines.

I can finally talk about this, 3 years later... github.com/tailscale/ta... It's a library + CLI tool that's like netcat, but over Tailscale's data plane without any control plane (no accounts, no dependence on Tailscale the company, all open source) WireGuard + NAT traversal without IP addresses.

There’s this WiFi tool I always wanted to build. But it required a massive amount of frame and code analysis. It doesn’t require much intelligence just a big ol’ mapping. But now I can get a clanker to do it. It’s nearly ready. I’m excited for this to exist in the world.

Hi! I don't think so because generally you have to intentionally cause damage or intend to access the computer. And for civil cases "no action may be brought under this subsection for the negligent design or manufacture of computer hardware, computer software, or firmware."

Looks like the new deauth’er works on the BlackHat WPA3 network. Thanks for letting @shifttymike.bsky.social test it @darkmatter.bsky.social!

 The work from Mathy and friends showed that malicious channel switch announcements are a pretty good deauth primitive for management frame protection networks, so I added it to aircrack-ng: https://github.com/aircrack-ng/aircrack-ng/pull/2724

 The work from Mathy and friends showed that malicious channel switch announcements are a pretty good deauth primitive for management frame protection networks, so I added it to aircrack-ng: https://github.com/aircrack-ng/aircrack-ng/pull/2724

Heading to DEFCON. Couldn't find anyone that made this so I wrote it: A flipper zero NFC canary: keep it in your pocket or bag to keep track and alarm when someone tries to scan your gear while you're walking around the con. github.com/antitree/nfc...

Those “public wifi is fine now” people are going to hate Microsoft’s good advice for the SVR abuses of hospitality captive portals. www.microsoft.com/en-us/securi... “When traveling, users should treat hotel, conference, airport, & other guest wireless networks as untrustworthy.”

My fortune cookie is even giving me sh*t about maintaining our WiFi hacking course.

Year 25 of SensePost training at BlackHat, I think this is my 17th time.

BlackHat airport advertising is up but this is the only one that unintentionally makes any sense to a hacker.

Just saw a “woke is a mental disorder” shirt, scalded my mouth on a filthy cappuccino I had to negotiate for in a normal cup size, and had several pleasant conversations. Hi America!

I realised some people* were using a super out-of-date version of hostapd-mana based off the upstream 2.6 branch instead of the newer 2.10 branch. This was probably because I never made the 2.10 branch the main. Well that’s fixed now. github.com/sensepost/ho... * me - see last commit for an eg

I always love the care our training ops team puts into our BlackHat training swag but the war games mainframe and WiFi themes are both close to my heart. Thanks Darryn & Andre!

I’ve seen a few dry runs of the absolutely fire talk Reino has prepped for everyone at DEFCON this year. Want to see multiple exploit chains on a widely deployed PED device deemed so impactful the vendor asked us to wait two years to disclose, then catch “Very Pwned” info.defcon.org/defcon34/con...

It’s the default tool for WiFi hacking but there were a few things that bugged me, so I made it better. Then I made it nicer. Here’s the link: github.com/shifttymike/... Static bins available in releases :)

I really like this evaluation matrix from @RoelofTemmingh’s @BSidesJoburg keynote for judging quality in a flood of AI slop. The one that resonated with me in particular was: “Has this person ever paid a cost for being wrong”

Great writeup from @lorenzofb.bsky.social on the recent OpenAI vs. Hugging Face incident. Turns out it started with a human mistake at OpenAI: someone forgot to set up an isolated environment prior to testing a model; the model went rogue; and attacked Hugging Face. techcrunch.com/2026/07/22/h...

If the sandbox escape was so advanced then publish the details.

I put up a writeup of our @sensepost annual artwork up here sensepost.com/blog/2026/se... Free downloads if you like it.

Redteam tool wednesday’s - 💉 P³ — Shellcode Loader: Process Parameter Poisoning. This loader implements a code injection technique that leverages the Windows Process Parameters structure (PEB). sensepost.com/blog/2026/pr... github.com/Orange-Cyber... #redteam #loader #injection #edr #bypass #windows

Hooo boy looks like I was right and quantum computing is gonna be the next grift

let’s build something great this week!

Check whether a site supports post quantum crypto* quantumhello.xyz * Well hybrid PQ key exchange in the form of TLS 1.3 with X25519MLKEM768

I audibly eyeroll when most cyber people talk about post-quantum crypto, and it's even worse when they're talking big consulting engagement to do what? - update some openssl packages or makes a TLS key exchange explicit? Now you can give them pqc4free github.com/singe/pqc4free

Shadowserver is excited to share its cybersecurity insights and actionable recommendations in a report aimed at helping ECOWAS stakeholders make West Africa more secure! Read the report & accompanying fact sheets in English, French & Portuguese at www.shadowserver.org/news/shadows...

“I want conflict, I want dissent I want the scene to represent, Our hatred of authority Our fight against complacency” youtube.com/watch?v=spLm30…

Love me some clankers - a little optimisation to common-substrings for your password cracking pleasure github.com/sensepost/co...

Relax and unwind in the Tradecraft Garden aff-wg.org/2026/06/01/r... Celebrating one year of Tradecraft Garden. 40 blog posts. ~30 POCs/projects. A lot of thank you's inside. The release itself: stack unwinding data generation, reference relaxation in the linker, and COFF mixing (+disco baby!)

A fun gadget I found recently! The .NET JIT compiler makes sure there are no rwx pages by using a memfd, but that turns file writes into straight shellcode execution 🐚

Those aren’t version numbers, they’re multipliers to token cost.