https://book.llcczz.org/posts/Recent content in Posts on lcz's BlogHugoen-USTue, 09 Jun 2026 00:00:00 +0000https://book.llcczz.org/posts/ai-assisted-pentesting/Tue, 09 Jun 2026 00:00:00 +0000https://book.llcczz.org/posts/ai-assisted-pentesting/After a couple of years of using language models in real engagements, a candid assessment of the tasks they are genuinely good at and the ones they quietly make worse.https://book.llcczz.org/posts/kerberos-delegation-abuse/Tue, 20 Jan 2026 00:00:00 +0000https://book.llcczz.org/posts/kerberos-delegation-abuse/The three flavours of Kerberos delegation, what each one hands an attacker, and why resource-based delegation is both the safest and the most abusable.https://book.llcczz.org/posts/cicd-github-actions-secrets/Fri, 28 Nov 2025 00:00:00 +0000https://book.llcczz.org/posts/cicd-github-actions-secrets/Build pipelines hold credentials to everything, run code from untrusted contributors, and are rarely in scope. That combination is why they get compromised.https://book.llcczz.org/posts/detection-lab-sysmon-zeek-sigma/Mon, 11 Aug 2025 00:00:00 +0000https://book.llcczz.org/posts/detection-lab-sysmon-zeek-sigma/A practical blueprint for a lab that lets you write a detection, generate the telemetry, and prove the rule fires — all on one machine.https://book.llcczz.org/posts/adcs-esc1-esc8-abuse/Wed, 18 Dec 2024 00:00:00 +0000https://book.llcczz.org/posts/adcs-esc1-esc8-abuse/Why certificate services are the most reliable escalation path in enterprise AD, and the eight misconfigurations worth checking on every engagement.https://book.llcczz.org/posts/ssrf-cloud-metadata-imds/Tue, 19 Nov 2024 00:00:00 +0000https://book.llcczz.org/posts/ssrf-cloud-metadata-imds/Why a server-side request forgery in a cloud workload is usually a full credential compromise, and how the three major providers differ.https://book.llcczz.org/posts/hashcat-password-cracking-workflows/Tue, 30 Jul 2024 00:00:00 +0000https://book.llcczz.org/posts/hashcat-password-cracking-workflows/How to pick the right attack mode for a given hash set, and why the wordlist matters far less than the rule file.https://book.llcczz.org/posts/xz-utils-backdoor-cve-2024-3094/Fri, 05 Apr 2024 00:00:00 +0000https://book.llcczz.org/posts/xz-utils-backdoor-cve-2024-3094/A near-miss that would have put a backdoor in sshd across major Linux distributions, undone by a curious engineer noticing sshd was 500ms slower.https://book.llcczz.org/posts/edr-telemetry-fundamentals/Fri, 27 Oct 2023 00:00:00 +0000https://book.llcczz.org/posts/edr-telemetry-fundamentals/A look at the data EDR agents collect, and why understanding it is the difference between evasion research and guessing.https://book.llcczz.org/posts/moveit-cve-2023-34362/Mon, 05 Jun 2023 00:00:00 +0000https://book.llcczz.org/posts/moveit-cve-2023-34362/How a pre-authentication SQL injection in a managed file transfer product became one of the largest data theft campaigns of 2023.https://book.llcczz.org/posts/azure-ad-enumeration-roadtools/Sat, 18 Feb 2023 00:00:00 +0000https://book.llcczz.org/posts/azure-ad-enumeration-roadtools/Mapping a Microsoft cloud tenant from a single set of valid credentials, and reading the result as an attack graph.https://book.llcczz.org/posts/container-escape-techniques/Fri, 25 Nov 2022 00:00:00 +0000https://book.llcczz.org/posts/container-escape-techniques/The misconfigurations and kernel issues that turn ‘we run containers’ into ’the container is a perimeter you don’t have’.https://book.llcczz.org/posts/ntlm-relay-attacks/Sun, 14 Aug 2022 00:00:00 +0000https://book.llcczz.org/posts/ntlm-relay-attacks/Why relaying NTLM authentication is still effective in 2022, and what actually stops it.https://book.llcczz.org/posts/spring4shell-cve-2022-22965/Wed, 30 Mar 2022 00:00:00 +0000https://book.llcczz.org/posts/spring4shell-cve-2022-22965/How Java Bean data binding turned into remote code execution on Spring MVC applications deployed as WAR files on Tomcat.https://book.llcczz.org/posts/log4shell-cve-2021-44228/Wed, 15 Dec 2021 00:00:00 +0000https://book.llcczz.org/posts/log4shell-cve-2021-44228/A week after disclosure, what we knew about the Log4j JNDI flaw, why the blast radius was so large, and how to find affected systems.https://book.llcczz.org/posts/bloodhound-ad-attack-paths/Thu, 22 Jul 2021 00:00:00 +0000https://book.llcczz.org/posts/bloodhound-ad-attack-paths/How to collect the right AD data once, then query it as a graph instead of guessing your way to Domain Admin.https://book.llcczz.org/posts/proxylogon-cve-2021-26855/Wed, 10 Mar 2021 00:00:00 +0000https://book.llcczz.org/posts/proxylogon-cve-2021-26855/Notes on the four-vulnerability chain that let an unauthenticated attacker take over on-premises Exchange servers in early 2021.https://book.llcczz.org/posts/kerberoasting-spn-enumeration/Tue, 08 Dec 2020 00:00:00 +0000https://book.llcczz.org/posts/kerberoasting-spn-enumeration/Why requesting service tickets for accounts with SPNs is still one of the most reliable ways to escalate from a domain user to plaintext credentials.https://book.llcczz.org/posts/subdomain-recon-amass-subfinder/Sun, 20 Sep 2020 00:00:00 +0000https://book.llcczz.org/posts/subdomain-recon-amass-subfinder/A practical pipeline for building and maintaining an accurate external asset inventory before you touch a single target.https://book.llcczz.org/posts/home-pentest-lab-virtualbox-kali/Sun, 15 Mar 2020 00:00:00 +0000https://book.llcczz.org/posts/home-pentest-lab-virtualbox-kali/How I set up a repeatable home lab for practising internal network attacks without touching anything I don’t own.