AI-Assisted Pentesting: Where LLMs Help and Where They Fail
After a couple of years of using language models in real engagements, a candid assessment of the tasks they are genuinely good at and the ones they quietly make worse.
Posts
Kerberos Delegation Abuse: Unconstrained, Constrained, and RBCD
The three flavours of Kerberos delegation, what each one hands an attacker, and why resource-based delegation is both the safest and the most abusable.
CI/CD Pipeline Attacks: Hunting Secrets in GitHub Actions
Build pipelines hold credentials to everything, run code from untrusted contributors, and are rarely in scope. That combination is why they get compromised.
Building a Home Detection Lab with Sysmon, Zeek, and Sigma
A practical blueprint for a lab that lets you write a detection, generate the telemetry, and prove the rule fires — all on one machine.
Active Directory Certificate Services: ESC1 Through ESC8 in Practice
Why certificate services are the most reliable escalation path in enterprise AD, and the eight misconfigurations worth checking on every engagement.
SSRF to Cloud Metadata: Stealing IMDS Credentials
Why a server-side request forgery in a cloud workload is usually a full credential compromise, and how the three major providers differ.
Password Cracking at Scale: Hashcat Modes, Rules, and Masks
How to pick the right attack mode for a given hash set, and why the wordlist matters far less than the rule file.
XZ Utils Backdoor (CVE-2024-3094): A Supply Chain Post-Mortem
A near-miss that would have put a backdoor in sshd across major Linux distributions, undone by a curious engineer noticing sshd was 500ms slower.
EDR Telemetry: What Your Defenses Actually See
A look at the data EDR agents collect, and why understanding it is the difference between evasion research and guessing.
MOVEit Transfer (CVE-2023-34362): From SQL Injection to Web Shell
How a pre-authentication SQL injection in a managed file transfer product became one of the largest data theft campaigns of 2023.