mez0: infosec blog

Vulnify: Giving Your Agents a CVE Brain

Wed, 09 Jul 2026 00:00:00 GMT

Eight CVE data sources consolidated into a single SQLite database behind an MCP server, giving AI agents deterministic vulnerability answers. Full write-up on TrustedSec.

Coverage-Driven Sustained Testing (CDST): Agentic Workflows

Tue, 19 May 2026 00:00:00 GMT

A graph-oriented model for open-ended agentic workflows. Work expands from a Neo4j coverage graph instead of being consumed from a static task list. Full write-up on TrustedSec.

Benchmarking Self-Hosted LLMs for Offensive Security

Tue, 14 Apr 2026 00:00:00 GMT

Self-hosted models via Ollama, a minimal two-tool harness against OWASP Juice Shop, and 4,800 runs across six models and eight challenges. Full write-up on TrustedSec.

Building Micro-teams with Nova: Agent Development Kit

Thu, 19 Mar 2026 00:00:00 GMT

A walkthrough of Nova, a plan-and-execute agent framework.

Malvecdb: Malware and Vectorstores for semantic querying

Thu, 19 Dec 2025 00:00:00 GMT

Exploring how vector stores can be used for semantic querying of malware datasets, combining MongoDB for structured queries and ChromaDB for similarity search.

Using EMBER2024 to evaluate red team implants

Thu, 26 Sep 2025 00:00:00 GMT

As EDR detections get better and utilise ML extensively, its important to understand what makes a sample good or bad. This blog looks at EMBER2024 and how it can be used to evaluate red team implants.

Exploring Agentic C2 Operations

Thu, 06 Mar 2025 00:00:00 GMT

Exploring how agentic support can be integrated into C2 operations for enhanced automation and analysis capabilities.

MCP: An Introduction to Agentic Op Support

Fri, 28 Mar 2025 00:00:00 GMT

I read about MCP a while ago and had some time to build something out. In this blog, I go over a basic setup of an MCP agent which is capable of answering network based questions like where is the domain controller.

From RAGs to Riches: Using LLMs and RAGs to Enhance Your Ops

Tue, 11 Feb 2025 00:00:00 GMT

In this blog, I will explore Retrieval-Augmented Generation (RAG) and how it can be applied to research capabilities. RAG is a framework that integrates retrieval-based models with generative AI to provide accurate and context-aware responses by storing and retrieving snippets of relevant information prior to prompting.

Citadel: Binary Static Analysis Framework

Wed, 15 Jan 2025 00:00:00 GMT

Citadel is a payload analysis framework that I built to enable me to review payloads prior to using them on engagements. The inner PE parsing logic will also be used for future projects and will act as a core component to my research projects.

Offensively Groovy

Tue, 22 Oct 2024 00:00:00 GMT

Offensively Groovy is a repository that documents how to use Groovy scripts for post-exploitation purposes. The project explores malicious capabilities of Groovy both for Windows and none-specific Operating Systems.

Categorising DLL Exports with an LLM

Sun, 01 Sep 2024 00:00:00 GMT

Using an LLM to categorise Windows DLL Exports for malware analysis.

Execution Guardrails: No One Likes Unintentional Exposure

Sun, 01 Sep 2024 00:00:00 GMT

Discussing the importance of Guardrails in red team implants with some POCs.

From Chaos to Clarity: Organizing Data With Structured Formats

Sun, 01 Sep 2024 00:00:00 GMT

Organising penetration testing data for data science, analysis, and reporting.

Maelstrom: A C2 Series

Wed, 01 Mar 2023 00:00:00 GMT

The Maelstrom C2 series published at pre.empt.blog where we discussed the internals of C2, evasion, and general implant development for red and blue.

Windows Processes, Nefarious Anomalies, and You: Threads

Thu, 03 Nov 2022 00:00:00 GMT

Looking at Windows processes and how they can be used to detect nefarious activity: threads edition.