collina.tech

                _ _ _             _            _
   ___ ___ | | (_)_ __   __ _  | |_ ___  ___| |__
  / __/ _ \| | | | '_ \ / _` | | __/ _ \/ __| '_ \
 | (_| (_) | | | | | | | (_| |_| ||  __/ (__| | | |
  \___\___/|_|_|_|_| |_|\__,_(_)\__\___|\___|_| |_|

// Field notes on offensive security & OSINT investigation — writeups, tooling, and tradecraft.

./writeups ./tags ./whoami

# latest

2026-07-03 Pentesting LLM Applications: A Field Methodology
#ai #llm #methodology #owasp
A repeatable, architecture-led workflow for testing LLM apps and agents — scoping a non-deterministic target, mapping the five attack surfaces, running OWASP LLM Top-10 …
2026-07-02 Prompt Injection & the Lethal Trifecta
#ai #llm #prompt-injection #agents
Why prompt injection has no clean fix, how indirect injection turns retrieved content into code, and how the 2025 zero-click incidents (EchoLeak, ShadowLeak, ForcedLeak) …
2026-07-01 The AI Testing Toolkit & Frameworks
#ai #llm #tooling #frameworks
The frameworks that give an AI pentest its vocabulary, the scanners that give it coverage, and a safe practice-lab recipe for rehearsing every attack offline.
2026-06-28 Hunting IDOR / BOLA in the Wild
#web #api #bola #methodology
A repeatable workflow for finding broken object-level authorization in modern APIs — from mapping object references to proving impact.
2026-06-20 OSINT: Pivoting From a Single Artifact
#osint #investigation #methodology #recon
How to turn one email, username, or image into a mapped network of entities — a disciplined pivot chain that avoids rabbit holes.
2026-06-12 A Recon Workflow That Actually Scales
#recon #web #tooling #methodology
Turning a wildcard scope into a prioritized attack surface without melting your VPS — passive first, resolve, probe, then triage.