Jack Sessions
I break things, write up how, and talk about it — DFIR and vulnerability research by day, talks, video, and music the rest of the time.
Latest writing
all posts →My Own Website Got Flagged as Malware. Here's the Incident Response.
A security product blocked a script on my site as a dangerous page. I took it apart, proved it was a false positive, fixed the real issues I found along the way, and got one thing embarrassingly wrong.
At 22, I've Published Two DFIR Tools on PyPI. This Is Just the Start
What it took to ship Hayabusa Lens and PhantomTrace, the mistake I made on release day, and what I'm building next.
Building This Site With Astro and Cloudflare
How this site is actually built and deployed: Astro, content collections for blog posts and projects, and Cloudflare Workers redeploying on every push to main.
On stage
all talks →Prove or Delete: Ending the Guesswork in Mobile Pentesting
BizComm Track talk on replacing guesswork in mobile pentesting with evidence you can prove.
sudo help -m 'Forensics??': A Guide to Linux Forensics
A guide to Linux forensics, hosted at Google Australia by the Sydney Linux User Group.
Counterintelligence in the Age of JucheNet: Signals, Spoofs, and Subversion
Conference talk on counterintelligence: signals, spoofing, and subversion.
Selected work
all projects →ManifestTrace
Android manifest exposure scanner, generalising my own CVE-2025-50861 and CVE-2025-50862 into five checks against a from-scratch AXML parser. On PyPI.
pipx install manifest-traceRuntimeTrace
eBPF-powered runtime consistency checker for Linux: does the kernel's own view of what's running agree with ps, lsmod and friends? On PyPI.
sudo runtime-trace --watch 30Hayabusa Lens
A dashboard for Hayabusa and Chainsaw: a 3D attack map and an AI investigator that keeps an audit trail of every question it asks. Local-first, MIT, on PyPI.
pipx install hayabusa-lensGet in touch
JackSessions@protonmail.com