My laptop just warned me that it's running low on energy while I was posting the previous toot.

Read the room, you little shit.

It's crazy how doomscrolling is such an energy burner. I hate myself, I doomscroll, I hate myself even more, but I'm too exhausted to stop.
Are there any physicists here trying to find the lowest possible form of self-esteem? Search no more.
And no, I tried opening IDA. Even that was too much effort. Back to TikTok. Watching dumb shit. Brain not found. 404.

Beauty of randomness.

Yeah, it works as expected. No metadata, nothing in the file.
The only weird thing is the entropy of the bmp file, but, hey it's modern art after all. Don't you find this cute?

#!/usr/bin/env python3

import sys
import os
import math
import struct
import subprocess
import tempfile
import getpass

HEADER_SIZE = 54
BITS_PER_PIXEL = 24
ITERATIONS = 200000

def bmp_geometry(size):
"""
Find a BMP geometry as close to a square as possible.
Each pixel row is aligned to a 4-byte boundary.
"""

target = math.sqrt(size * 4 / 3)
best = None

for width in range(max(1, int(target) - 2000),
int(target) + 2001):

stride = ((width * 3 + 3) // 4) * 4
height = (size + stride - 1) // stride
total = stride * height

score = abs(math.log(width / height)) + \
0.2 * (total - size) / size

if best is None or score < best[0]:
best = (score, width, height, stride, total)

return best[1:]

def main():

if len(sys.argv) != 3:
print(f"Usage: {sys.argv[0]} input_file output.bmp")
sys.exit(1)

source = sys.argv[1]
destination = sys.argv[2]
if not os.path.isfile(source):
sys.exit("Error: input file does not exist.")

password = getpass.getpass("Enter encryption password: ")
if not password:
sys.exit("Error: empty passwords are not allowed.")

# Encrypt the input file using OpenSSL.
print("Encrypting input file...")
with tempfile.NamedTemporaryFile() as tmp:
subprocess.run([
"openssl", "enc",
"-aes-256-cbc",
"-e",
"-nosalt",
"-pbkdf2",
"-iter", str(ITERATIONS),
"-pass", "stdin",
"-in", source,
"-out", tmp.name
], input=(password + "\n").encode(),
check=True)

tmp.seek(0)
ciphertext = tmp.read()

cipher_size = len(ciphertext)

# Calculate BMP dimensions.
width, height, stride, image_size = bmp_geometry(cipher_size)

# BMP file header (14 bytes).
file_header = struct.pack(
"<2sIHHI",
b"BM",
HEADER_SIZE + image_size,
0,
0,
HEADER_SIZE
)

# BITMAPINFOHEADER (40 bytes).
info_header = struct.pack(
"<IiiHHIIiiII",
40,
width,
height,
1,
BITS_PER_PIXEL,
0,
image_size,
2835,
2835,
0,
0
)

# Append zero padding to fill the BMP pixel array.
padding_size = image_size - cipher_size

with open(destination, "wb") as f:
f.write(file_header)
f.write(info_header)
f.write(ciphertext)
f.write(b"\x00" * padding_size)

print("\nBMP image successfully created.")
print(f"Output file : {destination}")
print(f"Image width : {width}")
print(f"Image height : {height}")
print(f"Ciphertext size : {cipher_size} bytes")
print(f"Padding size : {padding_size} bytes")
print(f"Ciphertext offset : {HEADER_SIZE}")

print("\nDecryption command:")
print(
f"dd if={destination} bs=1 skip=54 count={cipher_size} "
"| openssl enc -d -aes-256-cbc -nosalt -pbkdf2 "
f"-iter {ITERATIONS}"
)

print("\nThe password will be requested by OpenSSL during decryption.")

if __name__ == "__main__":
main()

Sometime you have to send a file. This file will be analyzed, scanned, dissected and so on. yeah yeah yeah, you can zip it with a password. I justtried to openssl enc a file, add a BMP header and transmit it. You have a real BMP file, no metadata, all data is encrypted, and file can be embed in a mail, put on a website, whatever. Next toot has code, next one explaination. (Disclaimer: I coded the tool, and asked AI to rewrite it for style)

And the day was as bad as expected. Sometimes, even the tiniest glimpse of hope should be abandoned.

https://atredis.com/blog/2026/10/22/dibs-on-the-fun-part/

food for thought

https://sites.google.com/site/zhiniangpeng/blogs/Hacking-with-LLMs-Eng

Interesting also.

However, and totally unrelated, without any context, this will be a hard day for me. Wish me luck.

I was so wrong about this (and the rest of my life).
There is indeed a leak in php2shell, and hype didn't fade this weekend.
Stealmybitcoin has its bitcoin stoled, and writeup is really impressive. I like this.
https://github.com/KillaBoi/StealMyBitcoin-PoC

well..

spent hours and finally got root. shell popped, netcat connected, whole thing worked exactly as planned. Dopamine lasted maybe 4 seconds.Now the only thing left is a terminal, cold coffee and the realization that tomorrow is gonna be exactly the same.

PHP2Shell status: all about code execution and RIP control.

Almost nothing about the leak needed to defeat ASLR. Why?

It's patched now anyway. Who cares? The hype will fade.

The real question isn't whether passkeys are magic. It's why we spent decades treating client certificates as an enterprise-only nightmare instead of making them usable everywhere. We didn't need a new cryptographic primitive. We needed better product management. And apparently, a new name. So, yes, that's just marketing, polished UI, and endless questions for average tech user (where are my passkeys? how do I save them, store them, use them, erase them?).

Passkeys sells phishing resistance as a top-notch quality above everything else? Yeah yeah yeah, visit a site that requests your certificate, and you can be authenticated without ever typing a password. No password to steal, no OTP to relay, no credentials to replay. With the right client and certificate-selection setup, you can even get seamless authentication. Passkeys bring origin binding and a polished UX to the same fundamental idea. That's useful engineering, but let's not pretend phishing-resistant public-key authentication was invented yesterday.

We already have public-key authentication, hardware-backed private keys, device-specific credentials, multiple keys per user, certificate issuance, expiration and revocation. None of this is new, and none of it is particularly complicated. Issue a client certificate, bind it to an identity, let the client prove possession of the private key. Store that key in a file, in a TPM, a secure enclave or a hardware token. Protect this key with a password, with biometric, with proof-of-presence, whatever. One certificate per device? Sure. Short-lived, long-lived, revocable? That's all standard PKI features, known for decades. And it's a standard protocol, supported across operating systems, browsers, servers and infrastructure.

Passkeys are client certificates with better marketing.

another night...
I need to read some code, to fill my head, to get rid of this emptiness, this void.

Another banger from watchtowr
https://labs.watchtowr.com/is-this-a-joke-in-the-auth-header-f5-big-ip-unauth-heap-overflow-to-rce-cve-2026-94127/
Keep up the good work, guys (and girls), you make me laugh way so much

another day. Feeling miserable. nothing good. Business as usual.

hxxps://spectra-vrg[.]org/hackers-handbook/AXD/x64/theartofexploitation.pdf
"The art of exploitation :-) Hype intensifies \o/ to cosmical levels"

First page, hype down to subterran levels