2026-07-17 6 min
[notes]
GitHub Actions Security: Pwn Requests and Token Abuse
GitHub Actions as an attack surface: pull_request_target pwn requests, GITHUB_TOKEN scope, expression injection and self hosted runner risk.
tail -f /var/log/hos
retired boxes, exploit notes, tooling we wrote because nothing else did the job.
324
posts
11
authors
weekly
cadence
grep all HackTheBox OSCP Preparation Privilege Escalation Linux Web Windows RCE Easy Active Directory Information Disclosure SSH Medium
> latest
2026-07-14 5 min
[notes]
RBCD Explained: Resource-Based Constrained Delegation
Resource-Based Constrained Delegation from the ground up: where the config lives, why write access to the target matters, and S4U2Self with S4U2Proxy.
2026-07-10 6 min
[notes]
Blind SSRF: Proving Impact Without Seeing a Response
Blind SSRF without a visible response: DNS and HTTP out of band signals, timing side channels, redirects, and what the report can actually claim.
2026-07-07 6 min
[notes]
NTLM Relay in Practice: SMB, LDAP and HTTP Targets
NTLM Relay in practice: what makes a relay path viable, how SMB signing and LDAP channel binding change it, and a lab walkthrough with ntlmrelayx.
2026-07-03 6 min
[notes]
API Security for Pentesters: BOLA, BFLA and Beyond
API pentesting for BOLA, BFLA and property level authorization, why two accounts are mandatory, and where object IDs hide outside the URL.