Disclosed vulnerabilities, taken apart properly.
A vulnerability is disclosed. A CVE number appears, a version range, two paragraphs of prose. What is usually missing is everything that matters: how the bug actually works, what reaching it requires, and whether the vendor's fix holds.
That gap is our work. We pick vulnerabilities worth understanding, rebuild them, and publish what we find.
Rebuilt, not read about. Every vulnerability becomes a containerised lab with the affected and the fixed release running side by side. The analysis is written against something we can actually observe.
The exploit is ours. Written from the patch and the source. We do not repackage someone else's proof-of-concept.
The fix is verified, not assumed. Each exploit is proven against the vulnerable build, then re-run unchanged against the patched one. If a fix turns out to be incomplete, that is worth knowing, and it is the kind of thing this method finds.
Credit goes to the finder. We are not the people who discovered these bugs. Where the original researcher is known, they are named.
The engine behind the pipeline. ÂLIM runs the work as a chain of agents - triage, research the patch, build the lab, develop the exploit, score the result - and hands back an analysis that has been checked against both builds rather than argued for on paper.
Its output feeds the public dashboard, where the catalogue is browsable and anyone can request an analysis of a specific CVE.
(ÂLIM is not an acronym. It is the Arabic-rooted word for scholar - one who knows.)
| Write-ups | Root-cause analyses, in full |
| 1day-archive | Dockerfiles and reproduction artifacts - rebuild any lab yourself |
| advisories | Findings and disclosures of our own |
| Dashboard | The catalogue, and the request queue |
Proof-of-concepts are also submitted to Exploit-DB and Packet Storm, and detection templates to projectdiscovery/nuclei-templates.
Requests for a specific CVE go through the dashboard - it is the fastest route, and you get a mail when the analysis is ready.
If you are a vendor and something we published needs correcting, write to the address above and it gets fixed.