I'm chern0bit, a security researcher with 18 years on the offensive side: red teaming, bug hunting, and exploit development. Not all of it is technical, though. Deep writeups sit next to quick notes, tools, and the odd post about whatever else is on my mind.
A JSON dashboard-import API hid a Java deserialization RCE: a Base64+DEFLATE blob deserialized by a background worker, past a WAF and a serialization filter guarding the wrong service. Confirmed with URLDNS, then escalated to…
Where Okta stops and the application starts. A practical black-box methodology for OIDC and SAML integrations: token and assertion validation, direct-origin bypasses, JIT provisioning, and lifecycle drift, with the exact commands to test each…
A hands-on methodology for pentesting apps behind identity-aware proxies: Cloudflare Access, Okta, Entra Application Proxy, Google Cloud IAP, and Zscaler Private Access. Commands, requests, tokens, and a small replay harness for fingerprinting the front…
There is no excerpt because this is a protected post.
A deep security research writeup of two independent remote code execution paths into WildFly application servers: an unauthenticated IIOP/CORBA deserialization flaw, and a jackson-databind polymorphic typing bypass in the web tier. Full technical tracing,…
Saved RDP, web, and network credentials in the Vault are DPAPI-protected but decrypt trivially in the user's own session.
Dumping tickets from LSA gives you TGTs to pass, and requesting them for kerberoastable SPNs yields hashes to crack offline.
On a multi-user host, duplicating the primary token of another session lets you act as that user, including a domain admin who…
A filter-to-consumer binding stored in the WMI repository runs your payload on an event trigger with no file on disk and no…