AI-Assisted Pentesting: Where LLMs Help and Where They Fail
After a couple of years of using language models in real engagements, a candid assessment of the tasks they are genuinely good at and the ones they quietly make worse.
Pentesting
CI/CD Pipeline Attacks: Hunting Secrets in GitHub Actions
Build pipelines hold credentials to everything, run code from untrusted contributors, and are rarely in scope. That combination is why they get compromised.
SSRF to Cloud Metadata: Stealing IMDS Credentials
Why a server-side request forgery in a cloud workload is usually a full credential compromise, and how the three major providers differ.
Password Cracking at Scale: Hashcat Modes, Rules, and Masks
How to pick the right attack mode for a given hash set, and why the wordlist matters far less than the rule file.
Container Escapes: From Docker Socket Exposure to Host Compromise
The misconfigurations and kernel issues that turn ‘we run containers’ into ’the container is a perimeter you don’t have’.
Kerberoasting: From SPN Enumeration to Offline Cracking
Why requesting service tickets for accounts with SPNs is still one of the most reliable ways to escalate from a domain user to plaintext credentials.
Subdomain Reconnaissance at Scale with Amass, Subfinder, and massdns
A practical pipeline for building and maintaining an accurate external asset inventory before you touch a single target.
Building a Home Pentest Lab: VirtualBox, Kali, and Network Segmentation
How I set up a repeatable home lab for practising internal network attacks without touching anything I don’t own.