Hi, I'm Philip Dietzel.
I break in so they can't._
Independent offensive-security researcher behind Dietzel Security. I hunt web vulnerabilities, chain them into full compromise, and write up every machine end to end — each finding paired with a clear, verified fix.
Offensive security, done in the open
I'm an independent penetration tester and vulnerability researcher focused on web applications and APIs. My approach is hands-on and evidence-driven — no scanner dumps, no boilerplate.
Every engagement ends with findings your engineers can actually action: severity, CVSS, a working proof-of-concept, and a fix I verify on re-test. When I find something in software you depend on, I disclose responsibly and publish only once it's patched.
I document my work publicly through full HackTheBox writeups — recon to root — because the best way to prove you can break something is to show the exact path.
HackTheBox writeups
Retired machines documented end to end — recon, exploitation, and root. Published after official retirement, per HTB's Terms of Service.
Altered
Chains a client-side rate-limit bypass and PHP type juggling into UNION SQLi RCE, then roots via DirtyPipe (CVE-2022-0847).
Read the Altered writeupEditorial
SSRF into an internal API leaks credentials; privilege escalation through exposed git history and a GitPython RCE (CVE-2022-24439).
Instant
Reverse-engineer an Android APK for a hardcoded JWT, abuse arbitrary file read, then decrypt Solar-PuTTY 3DES sessions for root.
Trick
A DNS zone transfer exposes a vhost; an SQLi auth bypass and LFI filter bypass land a shell, then fail2ban group abuse yields root.
Tools I build
Recon and security checks shouldn't be manual. I write tooling that scales the boring parts — open-source on GitHub.
subtake
A subdomain takeover scanner (detection only). Resolves the DNS CNAME chain, fetches each host over HTTPS/HTTP, and matches the response against a 44-service fingerprint database — GitHub Pages, S3, Heroku, Azure, Vercel and more — then reports a clear VULNERABLE / POTENTIAL verdict. Concurrent, with JSON export for pipelines.
Run it: python subtake.py -l subs.txt -t 40 -o results.json → or pipe from subfinder
CNAME resolution
Resolves the DNS CNAME chain per host and flags dangling records that no longer resolve (NXDOMAIN).
HTTP fingerprinting
Fetches each host over HTTPS/HTTP and matches the response body against a 44-service fingerprint database.
Verdict & export
Reports a VULNERABLE / POTENTIAL verdict with a configurable thread pool and optional JSON export.
Certifications & tooling
HTB Certified Web Exploitation Specialist
CWES is Hack The Box's advanced certification for real-world web application exploitation — chaining injection, authentication, and business-logic flaws into full compromise against hardened, modern targets.
Daily drivers: Burp Suite Pro · sqlmap · nuclei · ffuf · semgrep · BloodHound. Methodology aligned to OWASP WSTG & PTES.
Let's find it before they do.
Tell me about your stack and timeline — I'll come back with a scope and a fixed quote within two business days.