<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:atom="http://www.w3.org/2005/Atom">
  <channel>
    <title>nullpt.rs • blog</title>
    <link>https://nullpt.rs</link>
    <description></description>
    <lastBuildDate>Wed, 17 Dec 2025 08:37:38 GMT</lastBuildDate>
    <docs>https://validator.w3.org/feed/docs/rss2.html</docs>
    <generator>https://github.com/jpmonette/feed</generator>
    <language>en</language>
    <copyright>CC BY-NC-SA 4.0</copyright>
    <atom:link href="https://nullpt.rs/feed.rss" rel="self" type="application/rss+xml"></atom:link>
    <item>
      <title>
        <![CDATA[Anatomy of a Supreme Bot (Part 1)]]>
      </title>
      <link>https://nullpt.rs/anatomy-of-a-supreme-bot-part-1</link>
      <guid>anatomy-of-a-supreme-bot-part-1</guid>
      <pubDate>Mon, 24 Sep 2018 00:00:00 GMT</pubDate>
      <content:encoded>
        <![CDATA[The Supreme bot market has become flooded with bots. They all do the same thing and claim to be better than the next. How do they work exactly? Good question.]]>
      </content:encoded>
    </item>
    <item>
      <title>
        <![CDATA[Anatomy of a Supreme Bot (Part 2)]]>
      </title>
      <link>https://nullpt.rs/anatomy-of-a-supreme-bot-part-2</link>
      <guid>anatomy-of-a-supreme-bot-part-2</guid>
      <pubDate>Tue, 25 Sep 2018 00:00:00 GMT</pubDate>
      <content:encoded>
        <![CDATA[The ultimate goal of a bot is to make it to checkout. Let’s get started on that!]]>
      </content:encoded>
    </item>
    <item>
      <title>
        <![CDATA[Anatomy of a Supreme Bot (Part 3)]]>
      </title>
      <link>https://nullpt.rs/anatomy-of-a-supreme-bot-part-3</link>
      <guid>anatomy-of-a-supreme-bot-part-3</guid>
      <pubDate>Thu, 25 Oct 2018 00:00:00 GMT</pubDate>
      <content:encoded>
        <![CDATA[What happens when we checkout an item that’s out of stock? Only one way to find out.]]>
      </content:encoded>
    </item>
    <item>
      <title>
        <![CDATA[Tackling JavaScript Client-side Security (Part 1)]]>
      </title>
      <link>https://nullpt.rs/tackling-javascript-client-side-security-pt-1</link>
      <guid>tackling-javascript-client-side-security-pt-1</guid>
      <pubDate>Mon, 18 Feb 2019 00:00:00 GMT</pubDate>
      <content:encoded>
        <![CDATA[Jscrambler, a leader in JavaScript Client-side security makes claims to “Bullet-proof your Web Application in 2 minutes” but what have they done to make these claims? And does it really bulletproof your application?]]>
      </content:encoded>
    </item>
    <item>
      <title>
        <![CDATA[Compiling a Custom Browser to Bypass Anti-Bot Measures]]>
      </title>
      <link>https://nullpt.rs/compiling-browser-to-bypass-antibot-measures</link>
      <guid>compiling-browser-to-bypass-antibot-measures</guid>
      <pubDate>Fri, 11 Aug 2023 00:00:00 GMT</pubDate>
      <content:encoded>
        <![CDATA[In this blog post, I will be documenting the journey veritas and I took to extract the AES keys and browser flags/fingerprint from the Supreme anti-bot system.]]>
      </content:encoded>
    </item>
    <item>
      <title>
        <![CDATA[Evading JavaScript Anti-Debugging Techniques]]>
      </title>
      <link>https://nullpt.rs/evading-anti-debugging-techniques</link>
      <guid>evading-anti-debugging-techniques</guid>
      <pubDate>Tue, 01 Aug 2023 00:00:00 GMT</pubDate>
      <content:encoded>
        <![CDATA[Debuggers serve as invaluable tools that empower developers to halt code execution and thoroughly analyze its behavior at any given moment. By utilizing debuggers, developers can efficiently identify and resolve issues within their code, making it an indispensable part of their toolkit.]]>
      </content:encoded>
    </item>
    <item>
      <title>
        <![CDATA[Hacking GTA V RP Servers Using Web Exploitation Techniques]]>
      </title>
      <link>https://nullpt.rs/hacking-gta-servers-using-web-exploitation</link>
      <guid>hacking-gta-servers-using-web-exploitation</guid>
      <pubDate>Mon, 28 Aug 2023 00:00:00 GMT</pubDate>
      <content:encoded>
        <![CDATA[FiveM provides a powerful framework to create game experiences not otherwise possible in Grand Theft Auto. However, this power can be abused by attackers through the use of XSS in vulnerable NUI resources.]]>
      </content:encoded>
    </item>
    <item>
      <title>
        <![CDATA[Breaking the 4Chan CAPTCHA]]>
      </title>
      <link>https://nullpt.rs/breaking-the-4chan-captcha</link>
      <guid>breaking-the-4chan-captcha</guid>
      <pubDate>Fri, 29 Nov 2024 00:00:00 GMT</pubDate>
      <content:encoded>
        <![CDATA[In this blog post, I will talk about my successful experiment in machine learning using TensorFlow to automate solving the 4Chan CAPTCHA.]]>
      </content:encoded>
    </item>
    <item>
      <title>
        <![CDATA[Forging Passkeys: Exploring the FIDO2 / WebAuthn Attack Surface]]>
      </title>
      <link>https://nullpt.rs/forging-passkeys</link>
      <guid>forging-passkeys</guid>
      <pubDate>Fri, 20 Jun 2025 00:00:00 GMT</pubDate>
      <content:encoded>
        <![CDATA[Passwords are dying and passkeys are taking over. In this post we tear apart WebAuthn and build our own software FIDO2 authenticator from scratch.]]>
      </content:encoded>
    </item>
    <item>
      <title>
        <![CDATA[Reverse Engineering Vercel's BotID]]>
      </title>
      <link>https://nullpt.rs/reversing-botid</link>
      <guid>reversing-botid</guid>
      <pubDate>Mon, 30 Jun 2025 00:00:00 GMT</pubDate>
      <content:encoded>
        <![CDATA[Vercel recently announced BotID, an anti-bot meant to protect against bots without requiring manual intervention. This post reverse-engineers the script and takes a peek inside.]]>
      </content:encoded>
    </item>
    <item>
      <title>
        <![CDATA[I'm Building a Browser for Reverse Engineers]]>
      </title>
      <link>https://nullpt.rs/reverse-engineering-browser</link>
      <guid>reverse-engineering-browser</guid>
      <pubDate>Mon, 06 Oct 2025 00:00:00 GMT</pubDate>
      <content:encoded>
        <![CDATA[In the expanding world of AI my heart still lies in AST transforms, browser fingerprinting, and anti-bot circumvention. But my workflow felt... primitive.]]>
      </content:encoded>
    </item>
    <item>
      <title>
        <![CDATA[The Modernization of the Latrine]]>
      </title>
      <link>https://nullpt.rs/the-modernization-of-the-latrine</link>
      <guid>the-modernization-of-the-latrine</guid>
      <pubDate>Wed, 31 Mar 2021 00:00:00 GMT</pubDate>
      <content:encoded>
        <![CDATA[It's no question that bathrooms are a necessity for a business to accommodate their customers. However, a question stands- how much do these bathrooms really accommodate people?]]>
      </content:encoded>
    </item>
    <item>
      <title>
        <![CDATA[Reverse Engineering Tiktok's VM Obfuscation (Part 1)]]>
      </title>
      <link>https://nullpt.rs/reverse-engineering-tiktok-vm-1</link>
      <guid>reverse-engineering-tiktok-vm-1</guid>
      <pubDate>Thu, 22 Dec 2022 00:00:00 GMT</pubDate>
      <content:encoded>
        <![CDATA[TikTok has a reputation for its aggressive data collection. The platform has implemented various methods to make it difficult for reverse-engineers to understand exactly what data is being collected and how it is being used.]]>
      </content:encoded>
    </item>
    <item>
      <title>
        <![CDATA[Devirtualizing Nike.com's Bot Protection (Part 1)]]>
      </title>
      <link>https://nullpt.rs/devirtualizing-nike-vm-1</link>
      <guid>devirtualizing-nike-vm-1</guid>
      <pubDate>Fri, 06 Jan 2023 00:00:00 GMT</pubDate>
      <content:encoded>
        <![CDATA[In this blog post, we'll examine the virtualization obfuscation used by Nike]]>
      </content:encoded>
    </item>
    <item>
      <title>
        <![CDATA[Devirtualizing Nike.com's Bot Protection (Part 2)]]>
      </title>
      <link>https://nullpt.rs/devirtualizing-nike-vm-2</link>
      <guid>devirtualizing-nike-vm-2</guid>
      <pubDate>Thu, 12 Jan 2023 00:00:00 GMT</pubDate>
      <content:encoded>
        <![CDATA[Last time, we went over performing string extraction on the VM, and scratched the surface of analyzing the execution itself. However, this leaves the significant problem of actually devirtualizing the bytecode. For instance, we mentioned that individual strings are difficult to extract in a static manner—as specific values of the instruction pointer are required—but this difficulty also applies to opcodes and registers. As the bytecode is a stream of numbers, it's impossible to determine whether a number indicates a register, opcode, or constant without knowing what came before it.]]>
      </content:encoded>
    </item>
  </channel>
</rss>
