AI Security

It started with a chatbot. It ended with an enterprise password vault decrypted without its master password. Everything in between involved an FTP jail escape, an Electron AppImage, a native Node.js add-on and a custom cipher that collapsed under its own mathematics. I recently worked through OffSec’s Living Off the Vault challenge, and it had one of the strangest technical progressions I have seen in a lab so far. The first page looked like a normal support portal. A few stages later, I was analyzing an affine substitution box and using the application’s own native encryption primitive against it.

Four investigations. Four completely different environments. One lesson that kept returning: follow the evidence, not the loudest alert. Over the last few weeks, I worked through OffSec’s Dune Phantom challenge series. I considered writing four separate walkthroughs. Instead, I wanted to capture the investigation as a single story—because what made the series memorable was not any individual answer. It was how radically the environment changed from one week to the next while the investigative method stayed the same.