I find the assets nobody has on record, work out who owns them and follow their vulnerabilities through to the fix. When a scanner doesn't cover something, I build the missing piece. When that scanner is open source, I send the fix upstream.
My work lives between offensive security and infrastructure vulnerability management. Previously: pentests, OSINT, social engineering and incident investigations at Innopolis University. Now: making sense of the infrastructure at RWB (Wildberries & Russ), including systems that arrive through acquisitions.
A few things I've built for that work:
- Shadow IT discovery. A scanner and a process for finding assets and services missing from the inventory.
- Perimeter monitoring. A scanner that watches open ports on the external perimeter.
- Asset enrichment. A tool that connects an asset to its owner and context, used by VM, SOC and AppSec.
I contribute to ProjectDiscovery, including naabu, nuclei and httpx. The fixes come from using these tools against real infrastructure.
| Tool | A contribution that's been merged |
|---|---|
| naabu | Make stream mode respect the exclusion list |
| nuclei | Pin a target to a specific IP |
| httpx | Support IP-pinned targets in JSON input |
More upstream work
- naabu: OS fingerprints in output, upload chunk boundaries, standalone dashboard uploads, timeout parsing.
- nuclei: randomised payload combinations, template info placeholders, progress reporting.
- httpx: configurable metrics port.
- fastdialer: cache keys for pinned IPs.
- clistats: caller-provided metrics.
I've also reported a vulnerability that's currently under triage.
Outside the day job, I explore agentic coding, autonomous agents and OSINT. I like tools that turn an investigation into something repeatable.
More of the picture: mzr.sh ↗