American Fuzzy Lop, a remarkably nice guided fuzzing tool.
The Tangled Web, a lovingly-crafted book on web security.
Guerrilla Guide to CNC and its electronics-related counterpart.
Passive OS fingerprinter, better known as p0f.
Doomsday preparedness, a guide for regular folks.
My blog and my Twitter feed, for semi-frequent updates on security research, privacy, and other stuff.
American Fuzzy Lop, a fuzzer with an impressive track record of finding bugs.
P0f, a popular tool for passively detecting operating systems on remote machines.
Skipfish, a web security testing tool is now a cog in the Google Cloud Security Scanner.
Ratproxy, a neat but non-maintained passive web vulnerability detection tool.
Memfetch, a simple utility to take non-destructive snapshots of process address space.
Stompy, a fairly sophisticated token randomness evaluation tool.
Assorted purpose-built fuzzers: too many to list, but some of the most successful examples are cross_fuzz, ref_fuzz, mangleme, DOM checker, canvas fuzzer, jsfuzz, or transition fuzz.
Tools of historical interest: tmin, fl0p, 0trace, Fenris, unlocker, fakebust, snowdrop, bugger, the revisionist, poink, bunny, unicorns.
World's best exploit: ld-expl. It still works - amaze your friends!
The Tangled Web, a holistic treatment of the web security model.
A write-up on web tracking, a pretty thorough and balanced overview of where we are.
Notes from the post-XSS world, on the limitations of anti-XSS mechanisms such as CSP.
Doing algebra with CSS colors to steal your browsing history.
Silence on the Wire, my much earlier, 2005 book on reconnaissance and info leaks.
My 2001 ISN research and a 2002 followup, dealing with weaknesses in TCP/IP.
IP fragmentation flaw, an irreparable glitch affecting fragmented TCP packets.
Delivering signals for fun and profit, an early note about an interesting class of security bugs.
Cracking safes with thermal imaging, a whimsical experiment from 2005.
Lack of fdunlink() and its implications for local privilege escalation bugs.
Mostly of historical interest: BSH, strike that out, parasitic storage, rise of the robots, mobp.
My blog is a good way to stay in the loop on my security work and on individual vulns.
Guerrilla guide to CNC, an epic 60,000-word summary of my adventures making stuff.
Perpetual robot works, a behind-the-scenes story of how it all started.
My Make articles on 3d printing, resin casting, part design part I, and part II.
Concise electronics for geeks, a quick primer on basic concepts in circuit design.
Robotics-related projects: omnibot mk II, tinybot mk III, depth-augmented photography, cycloid gears, Shannon's ultimate machine, misc woodworking, and assorted build process pics.
Other experiments: dining table, Silicon Valley radiation levels, snapping droplets of water, Geiger-Mueller mood lamp, DHS tribute threat indicator, LED light surfaces, figuring out Intel Edison, infinity mirror, plasma glow.
My photo gallery. Photography is my long-time hobby, going back to the 90s.
Assorted essays about Poland, Europe, and the United States.
What to do when the zombies come, a guide to level-headed disaster preparedness (+ an addition on radios).
NEW! The hyperinflation gallery, a semi-pointless stroll through the history of economic collapses.
NEW! Blood is the Harvest, some esoteric privately-published anti-communist propaganda from the year 1950.
My LinkedIn profile. I am currently at Snap Inc, looking after a good chunk of security work.
Ancient or pointless non-security stuff: evil finder, catty, blog generator, Stella, eProvisia, Argante, hc, VLSS, and other assorted stuff in this directory.
If you want to get in touch, ping me at lcamtuf@coredump.cx.
That's all. You are a visitor number 20750922.