Early Research Mobile Security Smart Contracts AI & Agents Writings Theory of Everything Learning Platforms

Bernhard Mueller, Chief Hacking Officer

Selected Works

Two decades of breaking things for a living — from bricking Nokias via MMS, to teaching machines to find zero-days, with a Pwnie Award along the way.

Pwnie Award 2009
Best Research — From 0 to 0Day on Symbian
Pwnie Nominated 2018
Smashing Ethereum Smart Contracts
OWASP Flagship
MASTG & MASVS Project Leader
Early Security Research 2005 — 2013 · SEC Consult

Vulnerability research across enterprise software, embedded systems, and mobile platforms. 20 published advisories covering Flash, SQL Server, Nokia firmware, WAFs, and more.

Improved DNS Spoofing Using Node Re-Delegation
Whitepaper · 2008

A technique to make DNS cache poisoning more reliable. SEC Consult was among the first to write a working "fast cache poisoning" exploit after Dan Kaminsky's coordinated multi-vendor disclosure.

"By combining the birthday attack with node re-delegation, we reduced the average time to poison a DNS cache from hours to under a minute. The technique bypasses the source port randomization defense that most resolvers had deployed as a countermeasure." — Improved DNS Spoofing Using Node Re-Delegation, SEC Consult, 2008

Vulnerability Advisories (SEC Consult, 2005–2013)

Nov 2005toendaCMS — Username/password theft, directory traversal, arbitrary file upload
Apr 2006Opera Browser — CSS attribute integer wrap / buffer overflow
May 2006Symantec Enterprise Firewall — Internal IP leak of NATted machines
Oct 2006PHP exec/system/popen — File descriptor bug, overwrites Apache log
Mar 2007MySQL — Information schema DoS via null-pointer dereference
Dec 2008Fujitsu-Siemens WebTransactions — Remote command injection
Nov 2012dotDefender WAF — Format string vulnerability
Dec 2012IBM System Director Agent — DLL injection (Metasploit module)
Mobile Security 2014 — 2018 · Vantage Point / OWASP

Created the OWASP Mobile Application Security Testing Guide and Verification Standard — now the industry-standard references for mobile app security, used by enterprises and regulators worldwide.

Hacking Soft Tokens
Paper + Talk · HITB GSEC 2016 Singapore

Research demonstrating attacks against mobile 2FA/OTP tokens — from classical reverse engineering to custom kernel sandboxes and full-system emulation. Included PoC exploits for tokens from major banking vendors.

"We show that software-based OTP tokens on mobile devices offer weaker security guarantees than their hardware counterparts. By combining static analysis of the token apps with dynamic instrumentation and custom system-level sandboxing, we extract the seed values and replicate token generation on attacker-controlled hardware." — Hacking Soft Tokens, HITB GSEC 2016
Attacking Software Tokens
HITB GSEC 2016 · Singapore
Frida Detection
Tool · 493 stars

Reference implementations for detecting the Frida dynamic instrumentation framework on Android. Foundational for OWASP MASTG anti-tampering content.

Obfuscation Metrics
Research Tool

Framework for measuring and evaluating code obfuscation effectiveness. Directly related to the MASTG Reverse Engineering chapter.

More Mobile Tools
apkx · Android Security Checklist · Uncrackable Apps

apkx (290 stars): One-step APK decompilation. Android App Security Checklist (891 stars): Widely-referenced security checklist. Uncrackable Apps: Challenge crackmes for MASTG training.

Vantage Point Advisories

Smart Contract Security 2017 — 2020 · ConsenSys Diligence

Built Mythril, the first widely-used open-source symbolic execution engine for Ethereum smart contracts. Spoke at DEF CON 27 and HITB Amsterdam. Nominated for a Pwnie Award.

The Ether Wars
Talk · DEF CON 27 · 2019 · with Daniel Luca

Talk on the adversarial landscape on Ethereum — exploits, counter-exploits, and honeypots. Demonstrated the Scrooge McEtherface auto-exploitation bot live on stage.

"Ethereum's mainnet is an adversarial jungle. Automated bots front-run transactions, honeypot contracts lure in greedy attackers, and counter-exploit bots race to drain vulnerable contracts before the original exploiter can. We built Scrooge McEtherface to play this game — a bot that uses Z3 to automatically find and exploit contracts holding unprotected ETH." — The Ether Wars, DEF CON 27, 2019
The Ether Wars
DEF CON 27 · Las Vegas · 2019
Scrooge McEtherface
Tool · 153 stars

Ethereum auto-looter using symbolic execution and Z3 solver to automatically extract ETH from vulnerable contracts.

More Contract Tools
SolFuzz · DeFi Hacking Playground · Rektosaurus · Storm

SolFuzz (32 stars): Hybrid fuzzer with symbolic analysis. DeFi Hacking Playground (32 stars): Flash loan attack lab. Rektosaurus (51 stars): NFT metadata XSS testing. Storm (39 stars): EVM node stress-testing/fuzzing.

AI & Autonomous Agents 2023 — Present · Sherlock

Building AI agents that find security vulnerabilities autonomously. From viral early agent experiments to production-grade security auditors with published research.

ScaBench
Creator · 100 stars

Benchmarking framework for evaluating AI smart contract audit agents against real-world vulnerability datasets.

Darwin GPT
Experiment · 62 stars

Experiment in AI self-replication — a GPT-based agent that can spawn copies of itself.

Legion
Tool · 129 stars

AI-assisted web3 bug bounty hunting assistant. Tracks live bounties and deploys autonomous agents to find vulnerabilities.

Mancala Deep-Q
Reinforcement Learning Experiment

Solving the ancient board game Mancala using deep Q-learning. Includes OpenAI Gym environment, agent vs. agent self-play, and PyGame UI.

Rage of the Machine
Music AI · TransformerXL

Polyphonic, multi-instrument music transformer trained on 3,604 metal/grunge/punk MIDI songs. Custom tokenizer, 200 hours on 4x Nvidia T4 GPUs. Generates original metal, industrial, punk, and electronic tracks.

"The model learned to produce plausible song structures — intros, verses, breakdowns, and codas — across multiple simultaneous instruments. While it occasionally hallucinates impossible guitar stretches, the generated drum patterns are surprisingly groovy." — Rage of the Machine: An AI Makes Metal, Medium
Writings Medium & Beyond

Technical deep-dives, malware analysis, and occasional satire.

Smart Contract Security
2017Introducing Mythril
2017What Killed the Parity Multisig Wallet
~2018Analyzing Ethereum Smart Contracts for Vulnerabilities
2018Practical Smart Contract Security Analysis and Exploitation — Part 1
~2018Detecting Integer Arithmetic Bugs (batchOverflow)
~2019Catching Weird Security Bugs with Global Invariant Checks
~2019Automated Smart Contract Looting with SMT Solvers
~2019Advanced Smart Contract Security Verification in Remix
~2019Ethereum Security Tools Built by ConsenSys Diligence
Web3 Analysis
2021Is Tether a Black Swan?
2022Building a Secure NFT Gaming Experience — Herdsman's Diary
2022Wolf Game — Herdsman's Report
2024A Brief Analysis of Angel Drainer
2024Reverse Engineering Inferno Drainer
AI Security Auditing
2025Unleashing the Hound: AI Agents Find Deep Logic Bugs
2025Hunting for Security Bugs with AI Agents: Full Walkthrough
Zero-Knowledge Proofs
2025The Security Researcher's Guide to Mathematics
2025STARK Lab: An Interactive Deep Dive into ZK Proofs
2026A Practical Guide to Finding Soundness Bugs in ZK Circuits
AI & Music
Rage of the Machine: An AI Makes Metal
Satire & Misc
I Asked GPT-3 for the Question to "42"
~2017The Definitive Guide to Becoming a Crypto Maximalist
How to Become a Cryptocurrency Thought Leader on Twitter
~2017To Fork or Not to Fork? Bitcoin/Ethereum Community Survey
Theory of Everything 2025 — Present

Because why stop at breaking software when you can try to reverse-engineer reality itself? Observer Patch Holography (OPH) is a candidate theory of everything that unifies quantum mechanics and general relativity from first principles.

Interactive Learning Platforms 2025 — Present · floatingpragma.io

Open-source interactive tutorials for complex topics, built to make hard things intuitive.

STARK Lab
Interactive Tutorial

Interactive, step-by-step tutorial for understanding STARK proofs intuitively. Build traces, constraints, and FRI from scratch.

Awesome ZK Proofs
Curated Learning Path

Curated learning path for zero-knowledge proofs. Three parallel tracks: SNARKs, STARKs, and Bulletproofs.

Awesome AI Security
Curated Learning Path

Curated learning path for AI security. Adversarial attacks, prompt injection, and AI-powered pentesting.