whoami

I'm Andrew, a security researcher doing bug bounty and the occasional deep dive into whatever hardware is lying around the house.

Recent posts

• 2026-09-07 Can you remotely turn on a smart toothbrush? Reverse engineering the Oral-B iO
• 2026-07-20 wp2shell and bypassing Cloudflare's WAF with body padding
• 2026-06-29 Reflected XSS to account takeover on Whop via og-preview
• 2026-03-19 How I landed on NRK's Hall of fame!
• 2026-03-10 37 devices, zero passwords: auditing a smart home lab

all posts →

Projects

• Substation Simulator — An IEC 61850 digital substation playground for pentest-style research — Sampled Values (SV/SMV) and PTP time-sync attacks against a full station and process bus topology.
• Smart Home Assessment Lab — Smart home lab IoT assessment — router, NAS, smart-meter bridge, HomeMatic CCU — run on Red Code. Unauthenticated control of all 37 paired devices.
• Red Code — AI-orchestrated red team harness — a Claude Code fork with operator doctrine compiled in, running on the layered assessment scaffold from my master's thesis.

all projects →