Hi, I'm Ahmet Göker. I run CSINT Research on my own.

Most of what I do is digging into real events, files and odd software behaviour with public records, then writing it up so you can check every step yourself. On the side I build small defensive tools and practice labs, mainly for OSINT and for reviewing AI automation workflows.

CSINT Research (English) · CSINT Research (Türkçe) · LinkedIn · X

An n8n AI workflow can turn risky between two releases without anyone noticing. The scanner reads an exported workflow on your machine, never runs it, and shows where outside input reaches a model or where a model can write somewhere without anyone approving it.

There's a pull-request check for GitHub, a sample review, and a scan of the 100 most-viewed public AI Agent templates. The scan report also says what it can't tell you.

A shared VM image can quietly carry someone's cookies, keys and shell history. So this one is a setup script you can read before running it on a clean Ubuntu 24.04 machine. It also sets up case folders and templates for the boring but important parts: evidence log, source reliability, timeline, final report.

Grab the latest release, or read the project page first. I made it while studying GIAC GOSI material. It isn't a certification and it isn't affiliated with GIAC.

My undergraduate thesis at Erciyes University, finished in October 2025. I looked at what a small DynamoRIO client really records while a Linux binary runs, wrote down where my prototype fell short, and sketched a thread-aware version. The full PDF is in the repo.

• Same JPEG, different pixels (English, Türkçe)
  If you decode only part of a JPEG, the edge columns don't match a crop of the full image. I counted how many pixels change and found the reason in libjpeg-turbo's machine code.
• Which uppercase I does Windows use? (English, Türkçe)
  izmir.txt and İZMİR.txt can live in the same NTFS folder as two separate files, even though Turkish rules say they're the same name. The volume's own $UpCase table predicted the result for all six pairs I tested.

Everything else is in the research archive (Türkçe).

• N4TIVE: six Android challenges hidden in native .so libraries, from a simple overflow up to a tiny custom VM.
• Linux Kernel Exploitation CTF Lab: five buggy kernel modules in QEMU, with mitigations turned on one at a time.
• Operation Glass Harbor: a made-up incident to investigate. All the people, domains and logs in it are fake.
• OWASP LLM Security Lab (in Turkish): one lab per item of the OWASP Top 10 for LLM Applications 2025. It runs locally with a built-in simulator, so you don't need an API key.
• RAGPoison Lab (in Turkish): try to slip a poisoned document into a chatbot's knowledge base. Play it in the browser.
• WhenFree: nothing to do with security. A little Windows tool that finishes a delete, move or rename once the file is no longer locked.

Older reverse-engineering experiments are still in the repositories tab.