Research
Notes from the field
Writing on offensive tradecraft, cloud security, threat intelligence, and what it actually takes to run a security program that survives contact with real attackers.
Why Per-Account Lockouts Fail Against Password Spraying (And the Math Behind It)
Per-account lockout policies don't stop password spraying. Here is the math behind why horizontal attacks succeed and how to detect tenant-wide signal.
Beyond the Packer Myth: Architectural EDR Evasion and Durable Telemetry
An analysis of why userland EDR evasion succeeded, how modern bypasses function theoretically, and why durable defense relies on kernel telemetry.
Building a High-Signal External Recon Pipeline That Actually Scales
Stop drowning in subdomains. Learn a repeatable methodology to query CT logs, resolve DNS, fingerprint services, and rank attack surface.
Demystifying Evil Twin Attacks and the Enterprise Controls That Neutralize Them
Explore how rogue APs exploit client auto-connect mechanics and why enterprise controls like 802.1X and cert validation render them useless.
Why WPA3 SAE Kills the Offline Hashcat Attack Vector
A technical breakdown of WPA2 PMKID exposure, offline hashcat mechanics, and how WPA3 SAE Dragonfly renders packet capture useless.
Theft by Parameter: Exploiting Loose OAuth Redirect Validation
Learn how partial matching in OAuth redirect_uri parameters exposes authorization codes to account takeover, and how to enforce strict validation.
Offense and Defense in GraphQL: Introspection, Batching, and Depth Abuse
Learn how GraphQL features like introspection, aliasing, and query depth are abused by attackers, and how to implement robust server-side controls.
Fixing the Three Persistent JWT Flaws: From Key Confusion to Weak Secrets
Learn how JWT parsers fail under alg:none, RS256/HS256 confusion, and weak secrets, and write verification code that rejects all three.
Beyond URL Fetching: How IMDSv1 Turns SSRF into Full Cloud Compromise
An analysis of how Server-Side Request Forgery accesses instance metadata in IMDSv1 versus how IMDSv2 and egress controls mitigate the attack path.
Windows Persistence Demystified: Run Keys, Scheduled Tasks, Services, and WMI
Learn how attackers establish Windows persistence using native tools, where artifacts live in the registry and disk, and exact KQL queries to hunt them.
Hands-On NTLM Relaying: From RPC Coercion to Domain Admin
A practical guide to NTLM relay attacks using PetitPotam and ntlmrelayx, plus the exact two GPO configurations required to stop them.
Breaking Active Directory Attack Paths: From SharpHound Data to Choke-Point Remediation
Learn how to collect Active Directory graph data with SharpHound, analyze attack paths in BloodHound, and remediate critical ACL choke points.
No posts match your search.