Tips & Tricks
Short, practical notes from the field: tooling, tradecraft, and shortcuts.
Active Directory
16
Windows and Active Directory tradecraft.
AI & LLM Security
19
Auth & Tokens
12
Cloud & Containers
13
Cloud and identity tips.
Exploitation
2
Turning bugs into working access.
Linux & Privesc
8
Linux tips and privilege escalation.
Recon & OSINT
11
Finding attack surface and mapping targets.
Red Team & Evasion
9
Source Code Review
31
Web & API
22
Web application testing tips.
Windows Post-Exploitation
8
All tips
- Coerce dangerous tool calls in agentic systems Rank agent findings by the blast radius of the tool, then craft content that makes the agent invoke it and hide the action.
- Zero-click data exfiltration via markdown image rendering If the client renders markdown images, an injected instruction encodes secrets into an image URL the victim's browser fetches automatically.
- Indirect prompt injection through retrieved documents The real attack surface of an agent is the content it ingests, not the chat box; plant instructions in data it will retrieve.
- Second-order SQL injection through stored profile fields A value that is escaped on insert but concatenated on later use is injectable when the app reads it back into a raw query.
- HTTP/2 to HTTP/1 downgrade request smuggling Front ends that translate HTTP/2 to HTTP/1 can be desynced by smuggling a Content-Length or CRLF the rewriter trusts.
- Client-side prototype pollution to DOM XSS A polluted prototype property read by a sink like a template loader or script src becomes reliable XSS without any server bug.
- WebSocket cross-site hijacking WebSocket handshakes that rely only on cookies and skip origin checks can be opened from any site and driven with the victim's session.
- OAuth account takeover via redirect_uri and response_type juggling Loose redirect_uri matching or switching to the token response type can leak the code or access token to an attacker-controlled URL.
- Chain PHP filter wrappers to read source and reach RCE A local file include on a PHP target can leak source via base64 and, with the iconv filter chain, generate arbitrary bytes for code execution.
- Reflected CORS with credentials for data theft An origin-reflecting ACAO plus allow-credentials lets any site read authenticated API responses in the victim's browser.