KNOWLEDGE BASE
Notes
Technical notes on offensive security, AI, and agents: concepts, commands, and procedures.
Browse notes
Recently updated
25 notes- AI / Applied AIAPI PricingToken-cost calculation for one request and for agent sessions where context is processed repeatedly across many calls.
- AI / AgentsAgent StateWhat an application records so an agent can resume a task and verify changes in the system it acts on.
- AI / FundamentalsTokens & ContextHow input becomes tokens, what occupies a context window, and what happens as a session grows.
- AI / FundamentalsInferencePrefill processes input and decode generates output token by token; sampling, streaming, and TTFT help interpret behavior and performance.
- AI / Applied AILocal InferenceThe settings that most affect a local model: memory, quantization, offload, context, KV cache, and how to measure whether the configuration works.
- AI / AgentsModel Context Protocol (MCP)How MCP connects AI applications to external capabilities and what that connection means for context, execution, authorization, and trust.
- AI / FundamentalsContext EngineeringSelecting the context needed for the next decision without carrying the full repository, logs, and history into every call.
- AI / AgentsAgent LoopThe cycle of observing a result, choosing the next action, and repeating until a task completes or stops.
- AI / Applied AIModel APIsThe request and response behind a model integration, with practical handling of usage, streaming, tool calls, and OpenAI-compatible endpoints.
- AI / SecurityPrompt InjectionThird-party controlled content can try to change a model decision without having authority to do so; impact depends on what that decision can reach.
- AI / AgentsAgent HarnessThe layer that assembles context and tools, runs model-requested actions in a runtime, and returns results for the next step.
- AI / SecurityAgent PermissionsAn agent's real authority when an action passes through tools, policies, approval, and credentials with permissions of their own.
- Offensive Security / Web ApplicationsAPI Authorization TestingPrepare identities, replay requests, and verify object, function, property, and tenant access.
- AI / Applied AIStructured OutputsHow schema-constrained generation changes model output, and where validation and authorization still belong.
- AI / Applied AIDeployment ModelsA practical comparison of SaaS, APIs, gateways, and models you run yourself: where inference happens and which parts you operate.
- Offensive Security / Web ApplicationsPython eval Sandbox EscapesReason about namespaces, reachable objects, and capabilities when evaluating Python expressions.
- AI / SecuritySandboxing & EgressWhich resources code executed by an agent can reach and what it can send out: filesystem, runtime, credentials, and egress.
- AI / AgentsTool UseWhat a tool call contains, how it is validated and executed, and what result the model needs to continue.
- AI / AgentsInstructions, Skills and PluginsWhat enters context, what loads on demand, and what can execute code when using project instructions, skills, plugins, hooks, and MCP.
- AI / AgentsSubagentsDelegation with its own context for work that can be separated; the benefit depends on independence, coordination, and cost.
- AI / FundamentalsReasoningReasoning effort changes how much work a model spends on a request; evaluate it against quality, latency, and usage on the real task.
- Offensive Security / Web ApplicationsPHP Web TestingPHP-specific request parsing, loose comparison, dynamic evaluation, and stream-wrapper behaviors useful during web application testing.
- Offensive Security / ShellsRemote AccessOperational reference for turning reachable protocols and authentication material into remote sessions or execution.
- Offensive Security / File TransferWindows File TransfersPractical Windows file-transfer methods for shells, remote sessions, constrained networks, and common pentest fallback paths.
- Offensive Security / File TransferLinux File TransfersPractical Linux file-transfer methods for shells, SSH sessions, constrained hosts, and common pentest fallback paths.