Skip to content
View Karmaz95's full-sized avatar
🍎
🍎

Organizations

@afine-com

Block or report Karmaz95

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Please don't include any personal information such as legal names or email addresses. Maximum 100 characters, markdown supported. This note will be visible to only you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
Karmaz95/README.md

πŸ‘¨β€πŸ’» Β About Me

Head of Research at afine, specializing in 🍎 macOS security. Passionate about πŸ› οΈ Vulnerability Research, 🎯 Exploit Development, and πŸ” Reverse Engineering. My work focuses on macOS internals and advancing research in offensive security.

While research is my primary focus, I also work as an Offensive Security Engineer, identifying πŸ‘Ύ security flaws and developing πŸ€– tools to enhance security operations. This includes πŸ–₯️ Desktop Application Security, πŸ•ΈοΈ Web Application Security, πŸ’  Active Directory, and creating 🦠 malware to bypass πŸ›‘οΈ EDRs.


πŸ”­ Projects

I created some tools helpful for Offensive Security work, but there are two that I am the proudest of:

  • Snake&Apple - The code repository for the Snake&Apple article series documents my macOS security research.
  • Crimson - This was my first big thing. Currently, I am not focusing on this tool. However, it is still powerful. My friends and I are using it to this day. This is also a great place to start your journey with Application Security.

πŸ› CVE

As part of my daily work and free-time research, I am looking for bugs πŸ›. I have caught many of them so far, and some have even received a public CVE. I am particularly proud of CVE-2023-35359: Windows - Kernel Elevation of Privilege Vulnerability.


πŸ“– Blog & YT

In 2024, I wrote only on Medium. Now I am writing on Patreon. Sometimes I post Proof of Concepts as short recordings on my YouTube channel. You can subscribe to me using the banners below to receive notifications of the latest blogs or videos.

Patreon Medium YouTube Channel Subscribers


πŸŽ–οΈ Certs & CTFs & Courses

I have participated in multiple Capture the Flag (CTF) events, completed various courses, and obtained certifications through multiple platforms. Below are links that demonstrate some of these small accomplishments:

  • Certs - OSCEΒ³, eWPTxv2, OSCP, various OpenSecurityTraining2 certs
  • Pentesterlab - various web hacking courses & CTFs.
  • RPISEC/MBE - Modern Binary Exploitation - CSCI 4968
  • HTB - CTFs & Pro Labs
  • CS50 - Harvard University - Introduction to Computer Science

πŸ“« Social Media - Contact

Feel free to reach me on any of the platforms below. I also share new articles there, so you can stay up-to-date by following me.

X LinkedIn Mastodon


πŸ’° Funding

If you enjoy my work and want to help me grow, you can sponsor me using any of the options below:

Github-sponsors Patreon BuyMeACoffee

❗By subscribing to my Patreon, you will receive access to all of my published articles, and I've also been working on some exclusive content for my Elite Patrons - my "thank-you" to the folks who support me. I'm still building that out. You can read more about it here.

Pinned Loading

  1. Snake_Apple Snake_Apple Public

    Articles and tools related to research in the Apple environment (mainly macOS).

    Python 200 22

  2. crimson crimson Public

    Web Application Security Testing Tools

    Python 244 51

  3. evasion evasion Public

    AV EVASION TECHNIQUES

    C# 80 19

  4. crimson_lisp crimson_lisp Public

    Linux Post-Exploitation tools wrapper

    Shell 20

  5. crimson_wisp crimson_wisp Public

    Windows Post-Exploitation tools wrapper

    PowerShell 12

  6. crimson_cracking crimson_cracking Public

    All around cracking wordlist.

    29 5