Articles 63
- Forgotten Infrastructure and Dangling Records
- Exposed Datastores: Redis, Mongo, Elastic, Firebase
- Electron, Desktop Apps and Browser Extensions
- Mobile Application Attack Surface: Android and iOS
- ML Infrastructure and Model Supply Chain
- Prompt Injection and LLM Application Security
- WebSockets, gRPC and GraphQL Authorization
- API Authorization: BOLA, BFLA and Mass Assignment
- SSRF Beyond the Fetch: Renderers, Hooks, Rebinding
- File Uploads, Path Traversal and Archive Extraction
- XML Parsers and Deserialization Gadget Chains
- SQL, NoSQL and Command Injection in Modern Stacks
- JWT, Sessions and Account Recovery
- OAuth, OIDC and SAML: Where Federated Trust Breaks
- DOM XSS, Prototype Pollution and Client-Side Gadgets
- Browser Trust Boundaries: CORS, CSRF and Redirects
- Reverse Proxy and Web Server Misconfigurations
- HTTP Request Smuggling and Cache Attacks
- CI/CD and Software Supply Chain Attack Surface
- Serverless, Queues and CDN Origin Exposure
- Cloud Secrets, Storage and Key Management
- Cloud IAM: Pivoting Between Identities
- Kubernetes Attack Paths: RBAC, Tokens and Identity
- Linux Privilege Escalation and Container Escapes
- Windows Local Privilege Escalation: Seven Paths
- Active Directory Trusts and Lateral Movement Paths
- NTLM Coercion and Relay in Active Directory
- Active Directory Credential Attacks: A Field Reference
- Mobile API Pentesting: App, Protocol and Backend
- Secret Leakage in LLM Applications: Prompts and RAG
- Model Serialization Risks: Pickle, Joblib and PyTorch
- MCP Servers as an Attack Surface: Tools and Tokens
- Race Conditions in Web Applications: Finding the Window
- BloodHound Beyond Pretty Graphs: Validating Edges
- Server-Side Template Injection: Detection to RCE
- NTLM Relay to AD CS: The ESC8 Attack Explained
- OAuth Account Takeover Chains: state, PKCE and Linking
- Business Logic Vulnerabilities: Attacking the Rules
- AWS IAM for Pentesters: AssumeRole and PassRole Paths
- MSSQL in Active Directory: Linked Servers and Privesc
- Kubernetes for Pentesters: RBAC, Secrets and Pods
- AD CS Beyond ESC1: ESC2 Through ESC8 Explained
- Secrets in CI/CD Pipelines: How They Leak
- Golden, Silver and Diamond Tickets in Kerberos
- GraphQL for Pentesters: Schema, Resolvers and Batching
- Kerberos Delegation: Unconstrained, Constrained, RBCD
- GitHub Actions Security: Pwn Requests and Token Abuse
- RBCD Explained: Resource-Based Constrained Delegation
- Blind SSRF: Proving Impact Without Seeing a Response
- NTLM Relay in Practice: SMB, LDAP and HTTP Targets
- API Security for Pentesters: BOLA, BFLA and Beyond
- Shadow Credentials in Active Directory Explained
- Linux Privilege Escalation Beyond sudo -l
- Kerberos for Offensive Security: How the Protocol Works
- SSRF to Cloud Metadata: Reaching IMDS Through One Request
- AD CS ESC1 Explained: Exploiting Certificate Templates
- JWT Attacks for Pentesters: Beyond the none Algorithm
- Active Directory ACL Abuse: From Permission to Domain Admin
- TryHackMe Wreath Writeup: pivoting a three host network
- Reviewing TryHackMe's PT1 Certification
- Log4Shell Reverse Shell PoC Walkthrough
- JexBoss: JBoss and Java Deserialization Exploit Tool
- Mimikatz Cheat Sheet and Build Guide
