Tomer Bar
Security researcher & engineer, breaking and securing emerging threats
Open Source
EDR-evading password hash dumper for macOS
Obsidian brain for smart contract auditing
Burp Suite extension exposing the Montoya API as a local REST API
JXA-based macOS persistency for EDR bypass security testing
AI agent instructions for security audits
A static analysis tool for rust, anchor, stylus, and solidity smart contracts
Analysis and real-time monitoring for Safe{wallet} multisigs
Static analysis for Solidity smart contracts
Hands-on Kubernetes attack & defense CTF labs in disposable microVMs
EDR-evading password hash dumper for macOS
Obsidian brain for smart contract auditing
Burp Suite extension exposing the Montoya API as a local REST API
JXA-based macOS persistency for EDR bypass security testing
AI agent instructions for security audits
A static analysis tool for rust, anchor, stylus, and solidity smart contracts
Analysis and real-time monitoring for Safe{wallet} multisigs
Static analysis for Solidity smart contracts
Hands-on Kubernetes attack & defense CTF labs in disposable microVMs
Shared Miniapps
Audits
Majority of my work in the past decade of breaking and fixing things across every layer of the stack, is under NDA agreements and can't be ethically shared.
Long-Form Security Research
Cloud Security
Development & Engineering
Offensive Security
Defensive & Response
Training & Workshops
CVEs
Research & Talks
Security Researcher Training with AI, Despite AI
EDR-Evasive MacOS Hash Dumping in 2026
Here's How Your Devs Should Sandbox Agents
8 Agentic Harness Engineering Patterns You Should Know
Radar: Static Analysis of Smart Contracts in the era of AI
Azure AD Privilege Escalation through Auto Assignment Policies
Offensively Navigating Azure
Evilginx2 - Modern Day Phishing vs 2FA Protections
Hooking with Frida