I am Cursed — a red team operator and offensive security researcher operating out of Tokyo.
My focus sits at the intersection of adversary emulation, security-control evasion, purple teaming, and low-level attack surface exploration. My objective is not simply finding vulnerabilities; it is validating whether defensive architectures withstand real-world tradecraft, deconstructing attacker pathways, and translating offensive intelligence into measurable security posture improvements.
Active Research Vectors: Browser sandbox escapes, Win32 API abuse & internals, evasion of modern EDR/XDR telemetry, gRPC/API exploitation, and purple-team detection engineering loops.
- Role: Senior Cybersecurity Manager at Nomura Holdings
- Domain: Adversary simulation, penetration testing, and security architecture reviews across enterprise infrastructure
- Tradecraft: Developing offensive tooling, mapping custom attack scenarios against MITRE ATT&CK, and bridging the offensive-to-detection divide
- Philosophy: Ruthless technical verification over compliance theater
Purpose-built utilities for discovery, assessment, detection validation, and research workflows. Consult each project's documentation for setup, supported environments, limitations, and licensing.
- Custom Offensive Tooling - Practical scripts, loaders, and utilities engineered for automated reconnaissance, triage, and adversary emulation workflows.
- Penetration Testing Frameworks - Structured checklists, assessment templates, and PoCs covering active directory, cloud setups, web APIs, and mobile binaries.
- Security R&D Labs - Experimental exploits, Win32 API automation, and client-side research exploring attack surfaces across modern sandboxes.
- Open-Source Artifacts - Public contributions, detection validation templates, and research notes shared to advance empirical defensive and offensive engineering.
| Project | What it does |
|---|---|
| IPScan | Discovers responsive hosts using ICMP, ARP, or UDP probes, with hostname resolution, terminal summaries, and JSON export. |
| HolyScan | Scans TCP ports asynchronously, attempts service banner collection, and exports findings as JSON. |
| RiskIntel | Combines domain reconnaissance, infrastructure profiling, DNS and email checks, potential takeover identification, and Excel reporting. |
| EndScan | Enumerates cloud endpoints, Microsoft Entra tenant metadata, DNS assets, and potential exposed secrets in GitHub repositories. |
| ByteBack | Decodes supported F5 BIG-IP persistence cookies to reveal backend addresses and ports, and crafts IPv4 cookies for authorized testing. |
| Project | What it does |
|---|---|
| CipherStrike | Exercises ransomware-related behaviors, including actual file encryption, synthetic test data generation, recovery operations, and optional system changes for controlled detection testing. |
| DeadKey | Captures keystrokes and transmits them to a controlled server for timestamped logging during authorized purple-team and endpoint detection assessments. |
| MacroKey | Modifies VBA project protection records in supported macro-enabled Office containers to support authorized source inspection and analysis. |
| GlassGuard | Provides a browser workspace for framing tests, adjustable clickjacking demonstrations, decoy positioning, and standalone HTML PoC export. |
| ShellForge | CursedSec tool available through its dedicated website; functionality and placement in this category await verification. |
| Project | What it does |
|---|---|
| BenchParse | Extracts CIS Benchmark recommendations from PDFs into Excel assessment matrices with audit procedures, remediation guidance, and compliance status dropdowns. |
| BugDesk | Tracks programs, vulnerabilities, reports, and bounty payments through a local browser dashboard backed by SQLite, with JSON backups and recovery snapshots. |
| VaultPass | An archived educational password manager using local SQLite storage, AES-CBC password encryption, password generation, and an OS keyring workflow. |
| ReconVault | CursedSec repository included in the tool portfolio; its purpose, implemented capabilities, and category await verification. |
ⓘ Test only within explicitly authorized scope. CipherStrike encrypts files even in its default safe mode; use disposable test data and independently verified backups. DeadKey captures potentially sensitive keyboard input; use controlled test accounts and protect collected logs. VaultPass is an educational reference, not an independently audited production password manager.
|
|
|
|
|
|
I write rants, walkthroughs, and research notes about the gap between how attacks work and how security is often explained.
The opinion is the starting point, not the evidence. My aim is to make the technical details clear enough to investigate, reproduce, and discuss.
| Format | What to expect |
|---|---|
| Walkthroughs | Practical explanations of tooling, assessment workflows, and security concepts. |
| Research notes | Explorations of Windows internals, Win32 APIs, browser sandboxing, and attack surfaces. |
| Industry commentary | Direct takes on security theater, weak assumptions, and ineffective processes. |
| Educational material | Methodologies, checklists, and explanations connecting offensive and defensive work. |
- Browser sandbox boundaries and modern client-side attack surfaces.
- Windows internals and Win32 API-focused security scripting.
- Purple-team exercises connecting offensive actions to observable telemetry.
- Mobile application, API, and gRPC security assessment methodologies.
- Assessment automation, technical documentation, and cybersecurity education.
ⓘ These are areas of investigation, not claims of published vulnerabilities or completed exploit chains.
Interested in practical security research, technical writing, educational projects, or improving assessment workflows? Connect with me through LinkedIn or the relevant repository.
For reproducible tool bugs, use that repository’s issue tracker. Do not post credentials, client information, or sensitive vulnerability details in public issues. Check the repository’s security policy before reporting a security issue.
Built with curiosity. Tested with intent. Documented for the next person.
CursedSec.com · Cursed271 · Tokyo, Japan