2026-08-04 6 min
[notes]
AD CS Beyond ESC1: ESC2 Through ESC8 Explained
AD CS past ESC1: what ESC2 through ESC8 each abuse, how Certipy groups them, and what Strong Certificate Mapping changed about older material.
tail -f /var/log/hos
retired boxes, exploit notes, tooling we wrote because nothing else did the job.
324
posts
11
authors
weekly
cadence
grep all HackTheBox OSCP Preparation Privilege Escalation Linux Web Windows RCE Easy Active Directory Information Disclosure SSH Medium
> latest
2026-07-31 5 min
[notes]
Secrets in CI/CD Pipelines: How They Leak
Why a masked CI/CD variable is still readable by the job, how secrets leak through artifacts, shared runners and logs, and how to cut the blast radius.
2026-07-28 6 min
[notes]
Golden, Silver and Diamond Tickets in Kerberos
Golden, Silver and Diamond Tickets compared: which key forges each one, what the PAC carries, and why krbtgt rotation has to be done twice.
2026-07-24 6 min
[notes]
GraphQL for Pentesters: Schema, Resolvers and Batching
GraphQL pentesting: schema discovery without introspection, resolver level authorization, aliases and batching, and query complexity limits.
2026-07-21 6 min
[notes]
Kerberos Delegation: Unconstrained, Constrained, RBCD
The three Kerberos delegation models compared: what each one trusts, how to enumerate them and what to look for in each during a pentest.