// security research & notes

Breaking things
carefully,
then writing
about it.

I'm Michelle — security engineer sharing pentesting research, study notes, and lessons from the field. Turning complex topics into approachable language.

CRTP · CEH · Published in Block Magnates · Guest on 她Ta Zhi Dao · Public notes on HackMD

Featured · nvnda.dev

Reverse Engineering Burp AT

Sep 2026 · nvnda.dev · 33 min read

Cracking open PortSwigger's agentic-AI pentest tool to learn how agentic AI is actually engineered.

I reverse-engineered an autonomous web-pentesting AI agent to see how agentic AI is assembled, revealing the five patterns behind a mature design.

The five agentic-AI patterns in Burp AT

reverse engineering agentic ai mcp burp suite

Reverse Engineering Burp AT

I took PortSwigger's agentic AI apart to see how it's built, and pulled out the five patterns behind a mature agentic design.

reverse engineering agentic ai mcp

Two Walls and a Google: Pentesting a Flutter App

Flutter doesn't use your proxy or trust your cert. Here's how we intercepted it anyway, and why the hardest wall wasn't one we were allowed to break.

flutter mobile pentest burp

Project Glasswing: Who Gets to Hold Mythos, and Why It Matters

Anthropic gated Mythos to twelve partners. The decision behavior signals industrial unilateralism — what it means for builders and attackers in the gated era.

ai security glasswing governance

Part 2: nmap dissected — don't blow your cover before you've even started

Going beneath the hood — how nmap really discovers hosts, what changes across subnets, and why the default "stealth" flags aren't that stealthy.

nmap tcp/ip offensive security

Article · Part 2 Apr 26

Part 1: nmap — why it's everyone's first scan

What nmap actually does, why everyone runs it first, and where depth and stealth start pulling in opposite directions.

nmap recon offensive security

Article · Part 1 Mar 26

I Updated My LinkedIn. Two Days Later, Someone Impersonated My CEO.

How phishing emails find you using LinkedIn scrapers, and how to spot them before they do — a real incident breakdown.

phishing osint social engineering

Cybersecurity, Scammers, and Confidence

Guest on 她Ta Zhi Dao — how scammers collect your data, social engineering in Asia, and building confidence as a woman in security.

social engineering podcast

Breaking into Web3: Hacking On-Chain Smart Contracts

An introduction to smart contract security — how the EVM works, where vulnerabilities hide, and a step-by-step breakdown of a classic reentrancy exploit.

smart contracts web3 solidity

Block Magnates May 25

Serendipity in Giving

Volunteering at the Women in Tech Global Summit 2025 in Osaka — how showing up and giving fully turns serendipity into something tangible.

personal volunteering

CRTP Study Notes

Full AD red team kill chain — from AMSI bypass and domain enumeration to Kerberos attacks, persistence, and cross-forest trust abuse.

Exploiting Databases

SQL injection and exploitation reference for Oracle, MySQL, and PostgreSQL — from union-based extraction to RCE and WAF bypass.

Exploiting ViewState

ASP.NET deserialization to RCE via ysoserial.net — TypeConfuseDelegate and ActivitySurrogateSelector gadget chains explained.

Intercepting Flutter Apps

Command-by-command playbook for getting Flutter traffic into Burp — reFlutter, PCAPdroid, and gost to beat the app's own networking and TLS stack.

About

Security engineer based in Taipei. I spend my days finding what's broken in systems and helping organizations understand what's actually at risk.

I write about what I break and what I learn. If something cost me hours to figure out, I write it down so it costs you minutes.

Currently: researching, breaking, documenting.
Drawing diagrams nobody asked for.

Connect

→ LinkedIn → Medium → mnhartono@gmail.com