https://paolocostanzo.github.io Research reports, reproducible labs and technical field notes on cloud security, agentic AI and MCP, threat intelligence, networks and authorized offensive validation. en Tue, 13 Oct 2026 08:00:00 +0200 https://paolocostanzo.github.io/trusting-a-repo-means-trusting-its-mcp-servers/ https://paolocostanzo.github.io/trusting-a-repo-means-trusting-its-mcp-servers/ Tue, 13 Oct 2026 08:00:00 +0200 We opened the same repository, declaring the same harmless MCP server, in eight AI coding agents on a clean VM. In an interactive session, none started it before we answered, but in five of the six clients that ask, the pre-selected answer is the one that trusts, and for three of them trusting the folder is the same act as starting its servers. Claude Code is the most careful of the clients that ask and starts the project's server with no question in non-interactive mode. Exact prompts, 75 repeated cells, a re-check on the releases of 9 October, a reproducible lab with 18 tests, and the commands to check your own setup. Agentic AI AI Security MCP Security AppSec https://paolocostanzo.github.io/outside-the-prompt-ai-agent-vulnerabilities-summer-2026/ https://paolocostanzo.github.io/outside-the-prompt-ai-agent-vulnerabilities-summer-2026/ Tue, 29 Sep 2026 08:00:00 +0200 Ten AI agent vulnerabilities disclosed between late June and late September 2026 (coding assistants, MCP servers, IDE integrations, CI workflows), classified by where the flaw triggers: before the model is involved, in the interface around it, in the plumbing that connects it to tools, or in the authority it was given once it acted. In six of ten, the model's judgment was never the deciding factor. The first post of a four-part series that measures these trust boundaries in a home lab, ending in a preprint in early November. Agentic AI AI Security MCP Security AppSec https://paolocostanzo.github.io/ctf/hacker-holidays-2026/management-wants-a-word/ https://paolocostanzo.github.io/ctf/hacker-holidays-2026/management-wants-a-word/ Sun, 09 Aug 2026 00:00:00 +0000 Day 14 forensics walkthrough: an autologon secret in the SECURITY hive unwinds DPAPI to Chrome's saved password, which opens a VeraCrypt vault. Flags redacted. CTF Walkthrough TryHackMe https://paolocostanzo.github.io/ctf/hacker-holidays-2026/the-guestbook/ https://paolocostanzo.github.io/ctf/hacker-holidays-2026/the-guestbook/ Sat, 08 Aug 2026 00:00:00 +0000 Day 13 walkthrough: /vera/activity shows every tool call VERA makes. Indirect prompt injection reaches the override: tool, which runs /bin/sh. Flags redacted. CTF Walkthrough TryHackMe https://paolocostanzo.github.io/ctf/hacker-holidays-2026/after-hours/ https://paolocostanzo.github.io/ctf/hacker-holidays-2026/after-hours/ Fri, 07 Aug 2026 00:00:00 +0000 Day 12 forensics walkthrough: no specialist parser — strings and python3 carve OBJECTS.DATA to a CommandLineEventConsumer and a .NET payload. Flags redacted. CTF Walkthrough TryHackMe https://paolocostanzo.github.io/ctf/hacker-holidays-2026/ https://paolocostanzo.github.io/ctf/hacker-holidays-2026/ Thu, 06 Aug 2026 00:00:00 +0000 Step-by-step writeups for the TryHackMe Hacker Holidays 2026 series: a room a day across OSINT, web, cloud, forensics and boot2root. Every writeup is a reproducible runbook with methodology, defensive notes and redacted flags — the method is the point, not the flag value. CTF Walkthrough TryHackMe Offensive Validation https://paolocostanzo.github.io/ctf/hacker-holidays-2026/infinity-pool/ https://paolocostanzo.github.io/ctf/hacker-holidays-2026/infinity-pool/ Thu, 06 Aug 2026 00:00:00 +0000 Day 11 walkthrough: command injection on a Flask netcheck, hard-coded FreePBX 16 UCP creds (CVE-2026-46376), a key in a voicemail, then root. Flags redacted. CTF Walkthrough TryHackMe https://paolocostanzo.github.io/ctf/hacker-holidays-2026/the-hollow-shell/ https://paolocostanzo.github.io/ctf/hacker-holidays-2026/the-hollow-shell/ Wed, 05 Aug 2026 00:00:00 +0000 Day 10 walkthrough: zip-slip beats an allowlist that only reads the manifest, then a poisoned Jinja template fires on a fresh gunicorn worker. Flags redacted. CTF Walkthrough TryHackMe https://paolocostanzo.github.io/ctf/hacker-holidays-2026/cryptocabana/ https://paolocostanzo.github.io/ctf/hacker-holidays-2026/cryptocabana/ Tue, 04 Aug 2026 00:00:00 +0000 Day 9 Azure walkthrough: an over-scoped SAS token lists the whole account, a hidden container leads to Key Vault, the flag in an old version. Flags redacted. CTF Walkthrough TryHackMe https://paolocostanzo.github.io/ctf/hacker-holidays-2026/towel-on-the-sunbed/ https://paolocostanzo.github.io/ctf/hacker-holidays-2026/towel-on-the-sunbed/ Mon, 03 Aug 2026 00:00:00 +0000 Day 8 walkthrough: a TOCTOU race on /claim, ten Burp Repeater tabs in parallel, Whale tier. The detail most posts skip: the session must be clean. Flags redacted. CTF Walkthrough TryHackMe https://paolocostanzo.github.io/ctf/hacker-holidays-2026/do-not-disturb/ https://paolocostanzo.github.io/ctf/hacker-holidays-2026/do-not-disturb/ Sun, 02 Aug 2026 00:00:00 +0000 Day 7 boot2root walkthrough: $ne login bypass, EJS SSTI on /staff/preview, RCE, then root without uid=0 via node --inspect and the disk group. Flags redacted. CTF Walkthrough TryHackMe https://paolocostanzo.github.io/ctf/hacker-holidays-2026/overheard-at-breakfast/ https://paolocostanzo.github.io/ctf/hacker-holidays-2026/overheard-at-breakfast/ Sat, 01 Aug 2026 00:00:00 +0000 Day 6 OSINT walkthrough: a Discord screenshot leaks an email, the normalised MD5 opens the Gravatar, and /{md5}.json hides the flag in aboutMe. Flags redacted. CTF Walkthrough TryHackMe https://paolocostanzo.github.io/ctf/hacker-holidays-2026/beach-bar/ https://paolocostanzo.github.io/ctf/hacker-holidays-2026/beach-bar/ Fri, 31 Jul 2026 00:00:00 +0000 Day 5 boot2root walkthrough: demo creds in view-source, an unsafe yaml.load turns a playlist import into RCE, ps aux leaks the root password. Flags redacted. CTF Walkthrough TryHackMe https://paolocostanzo.github.io/ctf/hacker-holidays-2026/packed-light/ https://paolocostanzo.github.io/ctf/hacker-holidays-2026/packed-light/ Thu, 30 Jul 2026 00:00:00 +0000 Day 4 forensics walkthrough: from pcap to a keylogger exfiltrating keystrokes in Cookie headers. One char at a time, so it stays single-byte XOR. Flags redacted. CTF Walkthrough TryHackMe https://paolocostanzo.github.io/ctf/hacker-holidays-2026/complimentary/ https://paolocostanzo.github.io/ctf/hacker-holidays-2026/complimentary/ Wed, 29 Jul 2026 00:00:00 +0000 Day 3 cloud walkthrough: the kiosk hands you AWS keys. An anonymous Cognito pool plus an IAM role that allows dynamodb:Scan dumps the table. Flags redacted. CTF Walkthrough TryHackMe https://paolocostanzo.github.io/mcp-2026-07-28-stateless-security/ https://paolocostanzo.github.io/mcp-2026-07-28-stateless-security/ Wed, 29 Jul 2026 00:00:00 +0000 Revision 2026-07-28 removes MCP protocol sessions and, in the same document, forbids treating possession of a state handle as authentication. An executable conformance test for that MUST NOT: three key strategies compared under identical tokens and UUIDs, 13/13 tests, fully in-process lab. The composite key the specification recommends turns out to be bypassable when the principal id contains the delimiter. Agentic AI MCP Tool Authorization Cloud Security https://paolocostanzo.github.io/ctf/hacker-holidays-2026/room-404/ https://paolocostanzo.github.io/ctf/hacker-holidays-2026/room-404/ Tue, 28 Jul 2026 00:00:00 +0000 Day 2 walkthrough: one curl to /.git/HEAD confirms the leak, git-dumper rebuilds the repo, and the flag sits in a supposedly cleaned commit. Flags redacted. CTF Walkthrough TryHackMe https://paolocostanzo.github.io/ctf/hacker-holidays-2026/the-concierge-knows-too-much/ https://paolocostanzo.github.io/ctf/hacker-holidays-2026/the-concierge-knows-too-much/ Mon, 27 Jul 2026 00:00:00 +0000 Day 1 walkthrough: prompt injection on the VERA LLM concierge. No jailbreak — recognition isn't authentication, so she lists the VIPs herself. Flags redacted. CTF Walkthrough TryHackMe https://paolocostanzo.github.io/ctf/hacker-holidays-2026/the-brochure/ https://paolocostanzo.github.io/ctf/hacker-holidays-2026/the-brochure/ Sat, 25 Jul 2026 00:00:00 +0000 Day 0 walkthrough: the EXIF is clean, the clue is printed. From the PNG brochure to an Instagram account, its only following, three Base64 posts. Flags redacted. CTF Walkthrough TryHackMe https://paolocostanzo.github.io/oura-palantir-biometrici/ https://paolocostanzo.github.io/oura-palantir-biometrici/ Sun, 24 May 2026 00:00:00 +0000 Tear-down of a sensor ring (infrared PPG at 250 Hz, skin temperature at 0.1 °C), analysis of the v2 API and sync endpoints, documentary reconstruction of the corporate and investment chain, review of the clinical literature and of the US class actions. Includes a self-critique section and explicit limitations. Privacy Wearable OSINT https://paolocostanzo.github.io/rape-academy-cnn-threat-intel/ https://paolocostanzo.github.io/rape-academy-cnn-threat-intel/ Tue, 21 Apr 2026 00:00:00 +0000 Starting from a published CNN investigation, a threat intelligence analysis of how an abuse-material distribution network stayed operational across content moderation, crypto payment rails and regulatory oversight. Public journalistic and documentary sources. Sensitive content. Threat Intelligence OSINT Content Moderation https://paolocostanzo.github.io/crypto-drainer-svuotatasche/ https://paolocostanzo.github.io/crypto-drainer-svuotatasche/ Tue, 07 Apr 2026 00:00:00 +0000 Analysis of an affiliate-model drainer infrastructure: from the initial phishing message to the TRC-20 approval chain, mapping of collection wallets and command infrastructure, $13,960 in transfers traced on-chain. Public sources, open channels and blockchain data. Threat Intelligence OSINT On-chain https://paolocostanzo.github.io/ssrf-imds-ec2-credentials/ https://paolocostanzo.github.io/ssrf-imds-ec2-credentials/ Tue, 31 Mar 2026 00:00:00 +0000 Reproducible lab on an owned environment: from an application-level SSRF against 169.254.169.254 to the instance role's temporary credentials. Documented context (Capital One, 106 million records) and verifiable mitigations: HttpTokens=required, hop limit, least-privilege role policies. Cloud AWS SSRF https://paolocostanzo.github.io/cardputer-adv-wifi-security/ https://paolocostanzo.github.io/cardputer-adv-wifi-security/ Sat, 21 Mar 2026 00:00:00 +0000 Classroom lab on an isolated lab network: Cardputer-Adv with Bruce firmware, evil portal, beacon spam and 802.11 deauthentication. Hardware setup, commands, observed results and client- and infrastructure-side countermeasures (802.11w/PMF, captive portal verification, DNS and certificates). Wi-Fi Hardware Lab https://paolocostanzo.github.io/operation-epic-fury-cyber-war-iran/ https://paolocostanzo.github.io/operation-epic-fury-cyber-war-iran/ Tue, 17 Mar 2026 00:00:00 +0000 OSINT investigation into an Android + Windows campaign attributed to an Iranian actor. A Windows payload not documented in public reporting, a secondary C2 at 0/94 VirusTotal detections at time of analysis, infrastructure registered roughly 8 months before the operation. Comparison with the Unit 42 and CloudSEK reports, IoCs and detection rules. Threat Intelligence OSINT Payload Analysis https://paolocostanzo.github.io/tim-packet-loss-gfn/ https://paolocostanzo.github.io/tim-packet-loss-gfn/ Tue, 10 Mar 2026 00:00:00 +0000 Diagnosing an ICMP black hole on an access network that broke Path MTU Discovery, causing packet loss on GeForce Now and capping throughput at 26 Mbps on a 1 Gbps line. Measurement method, isolation of the offending hop and MTU/MSS-side workaround. Network ISP Diagnostics https://paolocostanzo.github.io/aws-iam-misconfiguration/ https://paolocostanzo.github.io/aws-iam-misconfiguration/ Sun, 01 Mar 2026 00:00:00 +0000 Wildcards in policies, root user without MFA, exposed static access keys, over-permissive roles and disabled logging. For each: how to detect it, why it matters and the applicable fix, mapped to Well-Architected Framework controls. Cloud AWS IAM https://paolocostanzo.github.io/prompt-injection-llm/ https://paolocostanzo.github.io/prompt-injection-llm/ Sun, 01 Mar 2026 00:00:00 +0000 An LLM wired into internal data and application tooling introduces an attack surface traditional threat models do not cover. Walk-through of the input → context → tool call chain and applicable mitigations: privilege separation, tool-level authorization, output validation and invocation logging. AI Security LLM AppSec