Tips & Tricks
Short, practical notes from the field: tooling, tradecraft, and shortcuts.
Active Directory
16
Windows and Active Directory tradecraft.
AI & LLM Security
19
Auth & Tokens
12
Cloud & Containers
13
Cloud and identity tips.
Exploitation
2
Turning bugs into working access.
Linux & Privesc
8
Linux tips and privilege escalation.
Recon & OSINT
11
Finding attack surface and mapping targets.
Red Team & Evasion
9
Source Code Review
31
Web & API
22
Web application testing tips.
Windows Post-Exploitation
8
All tips
- Password reset poisoning via unkeyed Host header If the reset email builds its link from the Host header and the CDN does not key on it, you can poison the link or steal…
- Web cache deception on authenticated pages Trick a CDN into caching a victim's private page by appending a static-looking extension the origin ignores but the cache keys on.
- Defeat SSRF allow-lists with DNS rebinding When the server validates a hostname then fetches it separately, a TTL-0 record that flips to an internal IP wins the race between the two lookups.
- Turn blind SSRF into RCE with a gopher payload to Redis When a blind SSRF can reach an internal Redis with no auth, gopher lets you write a cron job or webshell and get code execution.
- Enumerate IAM before you escalate In the cloud, privilege escalation is a graph problem. Map what your identity can do first.
- Check GTFOBins before giving up on a binary A boring binary with the wrong sudo rule or SUID bit is often a shell in disguise.
- Kerberoast only what you can crack Requesting every SPN ticket is loud and mostly useless. Target accounts with weak, human-set passwords.
- Spot SSRF in URL preview features Link previews, webhooks, and image proxies are the quiet SSRF factories of modern apps.
- Look at what the platform opens, not just what you deploy The app on :8080 is rarely the whole attack surface. Enumerate every listener the server itself owns.
- Match the gadget to the target library version serialVersionUID mismatches quietly kill deserialization payloads. Here is how to stop guessing.