The interesting detail.
A permission check. An unexpected response. A workflow that behaves differently across users. Small details can reveal the larger issue.
SECURITY RESEARCH / ASWSEC
Adam
Willard.
Penetration tester.
Security researcher.
I investigate how applications and systems behave when their assumptions are challenged. Here, I share the security research I pursue after hours.
RESEARCHER / FIELD NOTESAW — 01
THE THREAD THROUGH MY WORK
Understand the system.
Question the assumptions.
Follow the evidence.
CURIOSITY / PRECISION / PERSISTENCEASWSEC.
SELECTED PUBLIC RESEARCH & COMMUNITY CONTRIBUTIONSGet to know my work ↓
A selection of public work.
Open to exploration.
01 / The person behind the work
Curiosity,
with a purpose.
I’m a penetration tester and security researcher. I’m drawn to the places where software behaves differently from what its designers intended.
My work brings together hands-on testing, vulnerability research, and coordinated disclosure. I look closely at access controls, application logic, and the trust decisions that connect one part of a system to another.
ASWSEC brings together the research, disclosures, recognition, and community contributions I can share publicly. This is one part of my experience and capabilities.
Adam WillardTHE PERSON BEHIND ASWSEC
The reason it matters.
I care about reproducible behavior, the conditions that make a weakness possible, and the impact that follows.
The useful explanation.
A finding becomes more valuable when someone else can understand it, reproduce it, and use it to make a system stronger.
02 / Areas of expertise
Where I
focus.
Selected technical and research practices reflected in the work shared here.
LOGIC, IDENTITY & ACCESS
The behavior behind the interface.
I investigate authentication, authorization, and the application logic behind everyday workflows. The interesting questions often start with who can do what—and what happens when those boundaries are challenged.
- Authentication, sessions & object-level access
- API behavior & business logic
- Cross-site scripting, injection & data exposure
03 / How I think
A weakness is
part of a story.
I’m interested in how one condition leads to another: an entry point, a trust decision, an unintended path, and a consequence.
- Understand the context.What does the system expect, and where does it place trust?
- Follow the behavior.What changes when identity, access, or assumptions change?
- Explain the consequence.What does the evidence actually show?
ATTACK SURFACE EXPLORERILLUSTRATIVE
01
A valid login. The wrong access.
Trace how an authorization gap can expose another user’s data.
POSSIBLE ATTACK PATHEXPLORE THE CONNECTIONS ↑
HOW I COMMUNICATE A FINDING
The path from an observation to a useful explanation: behavior, evidence, impact, and remediation.
04 / Selected research
Research,
shared publicly.
Selected vendor advisories that acknowledge research I pursue after hours. These public examples represent part of my experience; each links to its original publication.
OrOracleAPR 2023
Siebel CRM · UI Framework
Security vulnerability · Critical Patch Update
AdAdobeJAN 2019
Experience Manager Forms
Stored cross-site scripting
JeJenkinsJAN 2019
Config File Provider
Stored cross-site scripting · SECURITY-1253
CiCiscoSEP 2018
Prime Collaboration Assurance
Cross-site scripting
Explore the public archive.
76 linked references, organized by vendor and publication.
Research acknowledgments reflect individual contributions to responsible disclosure.
05 / Selected public milestones
Public work.
Over time.
Selected milestones from the research and community contributions shared on this site.
Public vulnerability disclosures.
Published disclosures in the ASWSEC archive document research shared with the wider security community.
DC3 Researcher of the Month.
Recognition through the DC3 Vulnerability Disclosure Program.
View the recognitionAn Oracle Critical Patch Update.
CVE-2023-21909, one of the research references in a collection spanning 26 Oracle Critical Patch Updates.
Read the advisoryMicrosoft researcher recognition.
Ranked #108 on the Microsoft Security Researcher Leaderboard for Quarter 3, 2023.
Portal for ArcGIS security research.
The public record includes CVE-2024-25693 and the corresponding Portal for ArcGIS security update.
Read the security update06 / Recognition & industry involvement
Part of a
wider community.
Research is also a community. Recognition, conversations, and contributions connect my work to a much wider group of people.
DC3 VULNERABILITY DISCLOSURE PROGRAM2019Researcher
of the MonthMarch 2019 RSA CONFERENCE2014Conference
presenterSan Francisco
of the MonthMarch 2019 RSA CONFERENCE2014Conference
presenterSan Francisco
FEATURED IN
Tribe of Hackers
Red Team
Part of the published collection of perspectives from the offensive security community.
View the bookFEDERAL HACKING PROGRAMS
Contributing through
coordinated disclosure.
- Hack The Army
- Hack The Pentagon
- Hack The Air Force
Research, community & commentary
Credentials & certification records
GIAC certification history Active / inactive certificationsCompTIA Security+ View credential recordMicrosoft Online Services recognition
07 / Elsewhere on the web
Find me
in the work.
Public profiles, code, research, and conversations across the security community.