Tips & Tricks
Short, practical notes from the field: tooling, tradecraft, and shortcuts.
Active Directory
16
Windows and Active Directory tradecraft.
AI & LLM Security
19
Auth & Tokens
12
Cloud & Containers
13
Cloud and identity tips.
Exploitation
2
Turning bugs into working access.
Linux & Privesc
8
Linux tips and privilege escalation.
Recon & OSINT
11
Finding attack surface and mapping targets.
Red Team & Evasion
9
Source Code Review
31
Web & API
22
Web application testing tips.
Windows Post-Exploitation
8
All tips
- Mass assignment to escalate your own role Endpoints that bind the whole request body to a model often accept fields the UI never sends, like role or isAdmin.
- NoSQL operator injection for auth bypass When JSON bodies flow into a Mongo query unfiltered, operator objects turn a login into an always-true match.
- Server-side prototype pollution to RCE in Node A polluted Object.prototype can inject options into a later child_process call, turning a merge bug into command execution.
- Confirm SSTI fast, then jump straight to RCE A polyglot probe tells you the engine in one shot; from Jinja2 or Freemarker the path to command execution is short.
- XXE through SVG and Office file uploads Any feature that parses SVG, DOCX, or XLSX server side is an XML parser you can feed an external entity to.
- Blind XXE exfiltration with external parameter entities When inline DTDs are blocked and there is no output, an external DTD with parameter entities exfiltrates files over your own channel.
- Single-packet race conditions over HTTP/2 Send 20 to 30 requests in one TCP packet so they hit the same pre-commit window with near-zero jitter.
- Recover a hidden GraphQL schema from field suggestions Introspection off is not the schema hidden; did-you-mean errors leak field and type names one guess at a time.
- Abuse GraphQL aliasing to smash rate limits Aliases let you run the same mutation hundreds of times in one HTTP request, sailing past per-request throttles on OTP or login.
- Detect CL.TE request smuggling without breaking the app A timing-safe CL.TE probe confirms desync by making the front end wait for a body the back end already considers finished.