Update MCP exploit authors
Updated the authors for the 3 MCP exploits

Updated the authors for the 3 MCP exploits
2025-12-17 04:15:27 +00:00 · 2025-12-16 08:29:16 -09:00 · 2025-08-27 11:03:30 -04:00 · 2019-11-16 08:17:46 -07:00 · 2025-02-24 16:20:17 -05:00 · 2025-12-04 10:32:38 -05:00
diff --git a/.github/workflows b/.github/workflows
hwomackToB ed14dd90ac Update MCP exploit authors Updated the authors for the 3 MCP exploits		2025-12-16 08:29:16 -09:00
.github/workflows	Update Claude workflow: enable sticky comments, remove automated PR review	2025-08-27 11:03:30 -04:00
datasets/smart_contract_audit_findings	initial examination of chainsecurity and consensys audits	2019-11-16 08:17:46 -07:00
papers	papers: copy recursion whitepaper into repo	2025-02-24 16:20:17 -05:00
presentations	Add presentation materials and README for One, Two, TEE: Trust in Numbers Meets Hardware Security presented at DeCompute 2025.	2025-12-04 10:32:38 -05:00
public-comments	Added two public comments and a conference presentation I authored in 2023. (#321 )	2023-12-01 11:02:06 -05:00
reports	Add case studies section to README; add case study info to new section	2025-09-25 05:29:14 -05:00
reviews	Add Zoo KittyCAD report and update README	2025-12-16 09:03:12 -05:00
service-overviews	Created a folder for one pagers and added AI training document (#354 )	2024-08-06 11:58:54 -04:00
workshops	update link to empirehacking slack (#253 )	2023-07-14 16:18:04 -04:00
.gitignore	.	2018-09-11 16:15:23 -04:00
assurance_overview.pdf	add new citation guidelines	2020-09-25 01:45:45 -04:00
citation_guidelines.pdf	Further updates to citation guidelines	2025-08-12 10:53:18 -05:00
CLAUDE.md	Update CLAUDE.md with comprehensive guidelines from recent interactions	2025-07-15 19:24:56 -04:00
LICENSE	Adds a CC-BY-SA 4.0 license. (#78 ) (#97 )	2020-06-01 01:35:13 -04:00
README.md	Update MCP exploit authors	2025-12-16 08:29:16 -09:00
Paper Title	Venue	Publication Date
A Broad Comparative Evaluation of Software Debloating Tools	USENIX Security 2024	2024
PolyTracker: Whole-Input Dynamic Information Flow Tracing	ISSTA 2024	2024
Endokernel: A Thread Safe Monitor for Lightweight Subprocess Isolation	Usenix Security 2024	2024
Design and Implementation of a Coverage-Guided Ruby Fuzzer	CSET 24	2024
Test Harness Mutilation	Mutation 2024	2024
VAST: MLIR compiler for C/C++	EuroLLVM Devs' Meeting 2024	2024
PoTATo: Points-to analysis via domain specific MLIR dialect	EuroLLVM Devs' Meeting 2024	2024
Careful with MAc-then-SIGn: A Computational Analysis of the EDHOC Lightweight Authenticated Key Exchange Protocol	Euro S&P 2023	2023
Weak Fiat-Shamir Attacks on Modern Proof Systems	IEEE S&P 2023	2023
Endoprocess: Programmable and Extensible Subprocess Isolation	NSPW 2023	2023
CIVSCOPE: Analyzing Potential Memory Corruption Bugs in Compartment Interfaces	SOSP KISV 2023	2023
Detecting variability bugs through hybrid control and data flow analysis	LangSec 2023	2023
Blind Spots: Automatically detecting ignored program inputs	LangSec 2023	2023
Efficient Proofs of Software Exploitability for Real-world Processors	PETS 2023	2023
Toward Comprehensive Risk Assessments and Assurance of AI Systems	arXiv	2023
A Broad Comparative Evaluation of x86-64 Binary Rewriters	CSET 22	2022
On the Optimization of Equivalent Concurrent Computations	PLDI EGRAPHS 2022	2022
Evaluating Static Analysis Tools via Differential Mutation	QRS 2021	2021
echidna-parade: Diverse multicore smart contract fuzzing	ISSTA 2021	2021
Differential analysis of x86-64 instruction decoders	LangSec 2021	2021
Echidna: effective, usable, and fast fuzzing for smart contracts	ISSTA 2020	2020
ICARUS: Understanding De Facto Formats By Way of Feathers and Wax	LangSec 2020	2020
Toward Automated Grammar Extraction via Semantic Labeling of Parser Implementations	LangSec 2020	2020
What are the Actual Flaws in Important Smart Contracts?	FC 2020	2020
Echidna: A Practical Smart Contract Fuzzer	FC 2020	2020
RSA GTFO	PoC\|\|GTFO 0x20	2020
Manticore: Symbolic Execution for Binaries and Smart Contracts	ASE 2019	2019
Slither: A Static Analysis Framework For Smart Contracts	WETSEB 2019	2019
Toward Smarter Vulnerability Discovery Using Machine Learning	AISec 2018	2018
The Past, Present, and Future of Cyberdyne	IEEE S&P	2018
DeepState - Symbolic Unit Testing for C and C++	BAR 2018	2018
Cyber-Deception and Attribution in Capture-the-Flag Exercises	FOSINT-SI 2015	2015
Paper Title	Author(s)	Publication Date
Detecting Implicit Conversions in OpenVPN2 Using CodeQL	Paweł Płatek	September 2025
Preventing Account Takeovers on Centralized Cryptocurrency Exchanges Recommended Practices	Shaun Mirani, Kelly Kaoudis, and Evan Sultanik	Feb 2025
Input-Driven Recursion: Ongoing Security Risks	Alexis Challande and Brad Swain	Dec 2024
OpenSearch Benchmark Assessment	Evan Downing, Riccardo Schirone, Francesco Bertolaccini, and Ronald Eytchison	Aug 2024
Cedar, Rego, and OpenFGA Policy Languages: Comparative Language Security Assessment	Ian Smith and Kelly Kaoudis	Aug 2024
Toward Comprehensive Risk Assessments and Assurance of AI-Based Systems	Heidy Khlaaf	Mar 2023
Are Blockchains Decentralized? Unintended Centralities in Distributed Ledgers	Evan Sultanik et al.	Jun 2022
Do You Really Need a Blockchain? An Operational Risk Assessment	Evan Sultanik and Mike Myers	Jun 2022
Link	Description
Testing Handbook	Guides for configuring and automating static and dynamic analysis tools
ZKDocs	Interactive documentation on zero-knowledge proof systems
Building Secure Smart Contracts	Best practices for developing secure smart contracts
CTF Field Guide	Field guide to winning at Capture The Flag competitions
Ruby Security Field Guide	Practical Ruby security guide
Presentation Title	Author(s)	Year
Buttercup: Autonomously Finding and Fixing Bugs at Scale in Open-Source Software	Ronald Eytchison	2025
Our experience competing in the AI Cyber Challenge	Michael Brown et al.	2025
Your Mitigations are My Opportunities	Yarden Shafir	2023
Detecting variability bugs with hybrid control and data flow	Kelly Kaoudis, Henrik Brodin, Evan Sultanik	2023
Blind Spots: Identifying Exploitable Program Inputs	Henrik Brodin, Evan Sultanik, and Marek Surovič	2023
MLIR is the future of program analysis	Peter Goodman	2023
A Sermon on the Indulgences of Computational Sacrifice; or, The Superabundant Benedictions of Programming an Absurd NES Game	Evan Sultanik	2021
Differential analysis of x86-64 instruction decoders	William Woodruff, Niki Carroll, Sebastiaan Peters	2021
How to find bugs when (ground) truth isn't real	William Woodruff	2020
The Treachery of Files and Two New Tools that Tame It	Evan Sultanik	2019
Symbolically Executing a Fuzzy Tyrant	Stefan Edwards	2019
Kernel space fault injection with KRF	William Woodruff	2019
Binary Symbolic Execution With KLEE-Native	Sai Vegasena	2019
Going sicko mode on the Linux Kernel	William Woodruff	2019
Vulnerability Modeling with Binary Ninja	Josh Watson	2018
File Polyglottery; or, This PoC is also a picture of cats	Evan Sultanik	2017
Be a binary rockstar	Sophia D'Antoine	2017
Symbolic Execution for Humans	Mark Mossberg	2017
The spirit of the 90s is still alive in Brooklyn	Ryan Stortz, Sophia D'Antoine	2017
The dream of a static and dynamic analysis shootout	Ryan Stortz	2016
Binary constraint solving for automatic exploit generation	Sophia D'Antoine	2016
The Smart Fuzzer Revolution	Dan Guido	2016
Making a scaleable automated hacking system	Artem Dinaburg	2016
Cyberdyne - Automatic bug-finding at scale	Peter Goodman	2016
McSema: Static translation of x86 to LLVM IR	Andrew Ruef, Artem Dinaburg	2014
Presentation Title	Author(s)	Year
Test your tests: the do's and don'ts of testing	Kurt Willis	2023
Slither: a static analysis tool for Vyper and Solidity	Troy Sargent	2023
Roundme: rounding analysis made simpler	Josselin Feist	2023
Smart Contracts: The Beta	Nat Chin	2023
Fuzzing like a security engineer	Nat Chin	2023
Write better smart contracts with Slither's Python API	Troy Sargent	2022
Building Secure Cairo	Filipe Casal, Simone Monica	2022
How to fuzz like a pro	Josselin Feist, Nat Chin	2022
Demystifying Fuzzing	Nat Chin	2022
Building a Practical Static Analyzer for Smart Contracts	Josselin Feist	2021
Testing and Verifying Smart Contracts: From Theory to Practice	Josselin Feist	2021
Safely integrating with ERC20 tokens	Josselin Feist	2021
Detecting transaction replacement attacks with Manticore	Sam Moelius	2020
Fantastic Bugs and How to Squash Them; or, the Crimes of Solidity	Evan Sultanik	2019
SlithIR: High-Precision Security Analysis with an IR for Solidity	Josselin Feist	2019
Slither: A Static Analysis Framework for Smart Contracts	Josselin Feist	2019
What blockchain got right	Dan Guido	2019
Property-testing of smart contracts	JP Smith	2018
Anatomy of an unsafe programming language	Evan Sultanik	2018
Contract upgrade risks and recommendations	Josselin Feist	2018
Blackhat Ethereum	Ryan Stortz, Jay Little	2018
Blockchain Autopsies - Analyzing Smart Contract Deaths	Jay Little	2018
Rattle - an Ethereum EVM binary analysis framework	Ryan Stortz	2018
Securing value on the Ethereum blockchain	Dan Guido	2018
Binary analysis, meet the blockchain	Mark Mossberg	2018
Automatic bug finding for the blockchain	Felipe Manzano, Josselin Feist	2017
Presentation Title	Author(s)	Year
A Broad Comparative Evaluation of Software Debloating Tools	Michael D. Brown, Adam Meily, Eric Kilmer, Ronald Eytchison	2024
Repurposing LLVM analyses in MLIR: Also there and back again across the tower of IRs	Henrich Lauko	2024
VAST: MLIR for program analysis of C/C++	Henrich Lauko	2022
A Broad Comparative Evaluation of x86-64 Binary Rewriters	Michael D. Brown	2022
On the Optimization of Equivalent Concurrent Computations	Henrich Lauko, Lukáš Korenčik, Peter Goodman	2022
Presentation Title	Author(s)	Year
One, Two, TEE: Trust in Numbers Meets Hardware Security	Paul Bottinelli	2025
Weak Fiat-Shamir attacks on modern proof systems	Jim Miller	2024
Building a Rusty path validation library for PyCA Cryptography	William Woodruff	2024
Implementing X.509 path validation for Python	William Woodruff	2024
Careful with MAc-then-SIGn	Marc Ilunga	2023
die, PGP, die	William Woodruff	2022
Seriously, stop using RSA	Ben Perez	2019
Best Practices for Cryptography in Python	Paul Kehrer	2019
Analyzing the MD5 collision in Flame	Alex Sotirov	2012
Presentation Title	Author(s)	Year
Repeatable Benchmarking: An Exploration of OpenSearch vs Elasticsearch	Evan Downing	2025
Linux Security Event Monitoring with osquery	Alessandro Gario	2019
osql: The community oriented osquery fork	Stefano Bonicatti, Mark Mossberg	2019
Getting started with osquery	Lauren Pearl, Andy Ying	2018
osquery Super Features	Lauren Pearl	2018
osquery Extension Skunkworks	Mike Myers	2018
Build it Break it Fix it	Andrew Ruef	2014
Presentation Title	Author(s)	Year
Introduction to Semgrep and Semgrep Practice Exercises	Maciej Domański, Matt Schwager, Spencer Michaels	2024
A mostly gentle introduction to LLVM	William Woodruff	2022
JWTs, and why they suck	Rory M	2021
The Joy of Pwning	Sophia D'Antoine	2017
How to CTF - Getting and using Other People's Computers (OPC)	Jay Little	2014
Low-level Security	Andrew Ruef	2014
Security and Your Business	Andrew Ruef	2014
Bringing nothing to the party	Vincenzo Iozzo	2013
From One Ivory Tower to Another	Vincenzo Iozzo	2012