Senior Security Researcher · Offensive Security
Finding the bugs that
everyone else walked past.
I'm Dennis Schäfer. For seven years I've worked in offensive security and vulnerability research, building fuzzing harnesses for targets that didn't have one and taking what they find through to disclosure. This is where I write it up.
- Years in security
- 7+Years in security
- Published CVEs
- 5Published CVEs
- Security engagements
- 200+Security engagements
- Certifications
- OSCP · OSEDCertifications
Published CVEs
Vulnerabilities I found, reported, and saw through coordinated disclosure.
Buffer overflow in the service telegram handling, reachable over Bluetooth and RS-232. Found with a purpose-built fuzzer during a paid engagement.
Confidential, no public write-upXML External Entity injection allowing remote disclosure of file contents from the host.
Read the write-up ›Integer underflow and invalid memory read in the PPMd codec, surfaced through AFL++ coverage-guided fuzzing.
Read the write-up ›Hardcoded backdoor PIN in the Android vault app granted access to every user’s protected files.
Read the write-up ›Insecure backup configuration (android:allowBackup) exposed stored cleartext data through ADB backup.
Read the write-up ›Recent writing
9 write-ups, oldest from 2016.
Why RAID 5 is Risky in 2025: Understanding Unrecoverable Read Errors (UREs)
Drive capacities kept growing; unrecoverable read error rates did not. The arithmetic behind why a RAID 5 rebuild on modern disks is a bet you may lose.
Diving Deep into VEEAM Backup Service: Features against ransomware attacks
A look inside VEEAM Backup Service's defences against ransomware: inline encryption detection, the incident API, and what they realistically catch.
XML External Entity Injection (XXE) in Magic® xpi Integration Platform (CVE-2023-52239)
An XML External Entity injection in the Magic xpi Integration Platform, found during an assessment: path disclosure, outbound connections, and the road to CVE-2023-52239.
Unveiling Vulnerabilities: A Deep Dive into WiFi Camera Security
Teardown and firmware analysis of a consumer WiFi camera: exposed services, the WLAN key stored in plaintext, and an admin password baked into the mobile app.
What I'm working on
Fault injection against secure boot
Most recently a voltage glitch that walked past a U-Boot password prompt. Write-up in progress.
Fuzzing embedded firmware
Custom harnesses and frameworks for proprietary protocols that no off-the-shelf fuzzer understands. That approach is what found CVE-2025-3496.
Supply chain & SBOM analysis
Mapping what is actually inside embedded and IoT products, and which of it has known problems.
Let's talk security
Always happy to talk about vulnerability research, interesting targets, or roles where this kind of work matters.