Enumerating Azure AD with ROADtools and AzureHound
Mapping a Microsoft cloud tenant from a single set of valid credentials, and reading the result as an attack graph.
Posts
Container Escapes: From Docker Socket Exposure to Host Compromise
The misconfigurations and kernel issues that turn ‘we run containers’ into ’the container is a perimeter you don’t have’.
NTLM Relay Attacks: Coercion, Poisoning, and Defenses
Why relaying NTLM authentication is still effective in 2022, and what actually stops it.
Spring4Shell (CVE-2022-22965): A Practical Exploitation Walkthrough
How Java Bean data binding turned into remote code execution on Spring MVC applications deployed as WAR files on Tomcat.
Log4Shell (CVE-2021-44228): Exploitation, Detection, and Mitigation
A week after disclosure, what we knew about the Log4j JNDI flaw, why the blast radius was so large, and how to find affected systems.
BloodHound and SharpHound: Mapping Active Directory Attack Paths
How to collect the right AD data once, then query it as a graph instead of guessing your way to Domain Admin.
ProxyLogon (CVE-2021-26855): Dissecting the Exchange SSRF Chain
Notes on the four-vulnerability chain that let an unauthenticated attacker take over on-premises Exchange servers in early 2021.
Kerberoasting: From SPN Enumeration to Offline Cracking
Why requesting service tickets for accounts with SPNs is still one of the most reliable ways to escalate from a domain user to plaintext credentials.
Subdomain Reconnaissance at Scale with Amass, Subfinder, and massdns
A practical pipeline for building and maintaining an accurate external asset inventory before you touch a single target.
Building a Home Pentest Lab: VirtualBox, Kali, and Network Segmentation
How I set up a repeatable home lab for practising internal network attacks without touching anything I don’t own.