Melvin Lammerts
I build things that watch the internet and write about what they find.
Latest ·‘ OR 1=1 Still Works in 2026: Pre-Auth SQLi in Moodle (CVE-2026-7274)
On February 13, 2026, I reported a pre-authentication SQL injection in Moodle’s auth_db plugin to the Moodle bug bounty program on Bugcrowd. It was the kind of…
Read this post →Projects
Looks up the subnets announced by an Autonomous System Number, straight from the command line.
A passive subdomain index over the Certificate Transparency firehose, with years of history backfilled in.
Blocks ads and trackers for every app on an Android phone, from a local VPN tunnel over a Rust packet core. No root, and nothing leaves the phone.
Pulls paths out of exposed status pages — Apache, PHP-FPM, Prometheus — for recon.
A speed-tuned fork of Subfinder: keyless passive sources, silent by default, subdomains in seconds.