Tips & Tricks
Short, practical notes from the field: tooling, tradecraft, and shortcuts.
Active Directory
16
Windows and Active Directory tradecraft.
AI & LLM Security
19
Auth & Tokens
12
Cloud & Containers
13
Cloud and identity tips.
Exploitation
2
Turning bugs into working access.
Linux & Privesc
8
Linux tips and privilege escalation.
Recon & OSINT
11
Finding attack surface and mapping targets.
Red Team & Evasion
9
Source Code Review
31
Web & API
22
Web application testing tips.
Windows Post-Exploitation
8
All tips
- Flag weak cryptography and password hashing MD5 or SHA1 for passwords, ECB mode, and static IVs are review red flags that indicate broader crypto misuse.
- Verify XML parsers disable external entities An XML parser is XXE-safe only if external entities and DTDs are explicitly disabled at construction.
- Audit SQL construction for concatenation and raw ORM Parameterized queries are safe; string building and raw ORM escapes are where injection hides.
- Detect path traversal in file operations File reads and writes that join a base directory with user input are traversal bugs unless the resolved path is re-checked.
- Find SSRF sinks where the URL is user-shaped Any HTTP client call whose URL derives from input is SSRF unless the host is validated after DNS resolution.
- Separate authentication from authorization in review Most access bugs are objects fetched by id without an ownership check, not missing login gates.
- Review Node child_process and dynamic requires exec with a string, dynamic require, and vm without a sandbox are the Node sinks that turn input into code.
- Spot template injection in Python web code render_template_string or f-string templates built from user input give Jinja SSTI and full RCE.
- Catch Python’s unsafe loaders and shell calls pickle.loads, yaml.load, and subprocess with shell True are the three highest-yield greps in a Python review.
- Find JNDI lookups that take remote input Any Context.lookup or logging pattern that interpolates user data can be steered to a malicious LDAP or RMI server.