Top all-time · #2258
Doyensec's Blog
Company blog · blog.doyensec.comsecurityprogramming
Doyensec's Blog is the company blog at blog.doyensec.com, writing about security and programming. Since 2017, 34 different Hacker News readers have linked it 63 times, most often “Comparing Semgrep and CodeQL”. It is still writing: the last post was on 2026-10-26, and you can follow it by feed.
Too few sampled comments (7) to say how often HN recommends it.?
Why HN links it
HN readers link Doyensec's posts on security research: ASN.1 and telecom protocol fuzzing, Electron app security, and kernel and eBPF topics. Most commenters cite them as sources or supporting links.
Summarised by Claude from a sample of 7 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Doyensec's Blog :: Doyensec is an independent security research and development company focused on vulnerability discovery and remediation.
Most-linked posts?
- Comparing Semgrep and CodeQL3 people · 3 mentions · first linked 2022-10-06
- On Bypassing eBPF Security Monitoring3 people · 3 mentions · first linked 2022-10-12
- Regexploit: DoS-Able Regular Expressions3 people · 3 mentions · first linked 2021-03-11
- Turning XSS into RCE in All Electron-Based Apps3 people · 3 mentions · first linked 2017-08-05
- Fuzzing TLS certificates from their ASN.1 grammar2 people · 6 mentions · first linked 2020-05-24
- Using Client-Side Path Traversal for CSRF – Doyensec2 people · 3 mentions · first linked 2024-07-02
- Playing It Sfape: Code Execution in Isolated User Mode2 people · 2 mentions · first linked 2026-10-14
- Electron Windows Protocol Handler RCE and MITM (bypass for CVE-2018-1000006 Fix)2 people · 2 mentions · first linked 2018-05-24
What Hacker News says?
> but not TLS, X509, ASN1 etc (yet) then this may interest you: https://blog.doyensec.com/2020/05/14/asn1fuzz.html ^^ ASN1 is really the bees-knees for fuzzing telecoms protocols in UMTS/LTE/5G etc and doesn't get enough love in other domains. It's a high learning curve but once you get beyond the "standardese" language in the docs it's opening doors to opportunities in so many industries. > BoringSSL has fewer bugs…
Comment linking /2020/05/14/asn1fuzz.html
on “What changed in OpenSSL after heartbleed”Submitted FIDO2 security key company publishes results of internal security audit as a story · 136 points
HN discussionThis is a good write-up and I like the diagrams. What appears to still be notably missing from eBPF is an "off switch". AFAIK there are still no kernel boot time commands [0] to disable eBPF entirely. I have to recompile the kernel to disable it and it is known that most people will not do this. eBPF has the potential for file-less malware to run hidden from detection and I foresee the ability to tickle ring -3 (and…
Comment linking /2022/10/11/ebpf-bypass-security-monitoring.html
on “eBPF – Adding functionality to OS at runtime”Submitted Regexploit: DoS-Able Regular Expressions as a story · 83 points
HN discussionyeah especially since the whole point of ASN.1 is the agreement of the format of data structures so this means they never get the value out of ASN.1 that they potentially could. A big problem IMO is that it's hard to find a good implementation of ASN.1 compilers that will work across (sub-)systems and that as a FOSS project gets properly maintained. If this can be solved it would open up incredible possibilities suc…
Comment linking /2020/05/14/asn1fuzz.html
on “The kernel has 6 separate ASN.1 parsers”Submitted On Bypassing eBPF Security Monitoring as a story · 71 points
HN discussionAh, yes, Electron, where a simple XSS can quickly turn into full account compromise and RCE? :O https://blog.doyensec.com/2017/08/03/electron-framework-secu...
Comment linking /2017/08/03/electron-framework-security.html
on “Remote zero-click JavaScript code execution on Signal desktop”Submitted Electron Windows Protocol Handler RCE and MITM (bypass for CVE-2018-1000006 Fix) as a story · 14 points
HN discussionthis is focused on LTE. for telecommunications the most useful approach I have found to date was to fuzz using ASN.1[1][2]. Everything in telecoms is ASN.1 and vendors usually write their own parser generators. [1] this is focused on X.509/TLS but the approach is the same https://blog.doyensec.com/2020/05/14/asn1fuzz.html
Comment linking /2020/05/14/asn1fuzz.html
on “BaseSAFE: Baseband SAnitized Fuzzing Through Emulation”Submitted Ksmbd – Exploiting CVE-2025-37947 as a story · 10 points
HN discussionI was in the theater when that first played. Half of the theater were cheering, some standing up. Many movie-goers were very confused. Yes she used nmap [1] and then sshnuke [2] and given she was hacking a power company it would not surprise me if that exploit worked in some utility companies today. [1] - https://nmap.org/movies/ [2] - https://blog.doyensec.com/2025/03/04/exploitable-sshd.html
Comment linking /2025/03/04/exploitable-sshd.html
on “Nitpicking the shell history scene in 'Tron: Legacy'”Submitted Inql: Introspection GraphQL Scanner Released as a story · 10 points
HN discussion"Movie Hacker" should perhaps include nmap and sshnuke [1] despite being a real command and a real skiddie exploit [2]. When that that first played in the movies (The Matrix) people in the bay area theaters were standing up and cheering. People not familiar with the tools were very confused as to what was going on. [1] - https://nmap.org/movies/ [2] - https://blog.doyensec.com/2025/03/04/exploitable-sshd.html
Comment linking /2025/03/04/exploitable-sshd.html
on “Typing Speed Test, but for Developers”Submitted Abusing WiFi Direct for Fun and Profit as a story · 6 points
HN discussionCSRF in modern web apps? It's still possible! Our latest research by Maxence Schmitt dives into using Client-Side Path Traversal to perform CSRF. Check out our latest blogpost and brand new Burp extension for finding bugs. https://blog.doyensec.com/2024/07/02/cspt2csrf.html
Comment linking /2024/07/02/cspt2csrf.html
on “Using Client-Side Path Traversal for CSRF – Doyensec”Submitted Fuzzing TLS certificates from their ASN.1 grammar as a story · 4 points
HN discussionSubmitted Using Security Engineering to Prevent Phishing – Doyensec as a story · 3 points
HN discussionSubmitted PoIEx(tool) – maps code and IaC intersection from Doyensec as a story · 3 points
HN discussionSubmitted XSS to Full RCE in VSCode via Jupyter Notebook Support as a story · 3 points
HN discussionSubmitted On Bypassing eBPF Security Monitoring as a story · 3 points
HN discussionSubmitted OSS-Fuzz LibreSSL: a short bounty story as a story · 3 points
HN discussionSubmitted Turning XSS into RCE in All Electron-Based Apps as a story · 3 points
HN discussionSubmitted Fuzzing TLS certificates from their ASN.1 grammar as a story · 2 points
HN discussionSubmitted Regexploit: A tool for finding DoS-able regular expressions as a story · 2 points
HN discussionSubmitted Doyensec – Securing Applications Against DB Race Conditions as a story · 2 points
HN discussionSubmitted SSO IdP compromise research from Doyensec as a story · 2 points
HN discussionSubmitted Session Hijacking Visual Exploitation as a story · 2 points
HN discussionSubmitted Comparing Semgrep and CodeQL as a story · 2 points
HN discussionSubmitted Apache Pinot SQLi and RCE Cheat Sheet as a story · 2 points
HN discussionSubmitted Regexploit – ReDoS Tool Release as a story · 2 points
HN discussion
