Tips & Tricks
Short, practical notes from the field: tooling, tradecraft, and shortcuts.
Active Directory
16
Windows and Active Directory tradecraft.
AI & LLM Security
19
Auth & Tokens
12
Cloud & Containers
13
Cloud and identity tips.
Exploitation
2
Turning bugs into working access.
Linux & Privesc
8
Linux tips and privilege escalation.
Recon & OSINT
11
Finding attack surface and mapping targets.
Red Team & Evasion
9
Source Code Review
31
Web & API
22
Web application testing tips.
Windows Post-Exploitation
8
All tips
- Plant a root SUID over an NFS no_root_squash export When an export is shared with no_root_squash, a SUID binary you create as root on your own box stays root-owned on the server.
- Hijack a writable or PATH-relative systemd unit A root-run service with a writable unit file or a relative ExecStart lets an unprivileged user execute code as root on the next start.
- Break out of a container through the Docker socket A mounted or reachable docker.sock is root on the host, because you can start a container that bind-mounts the host filesystem.
- Root via pkexec argument confusion (PwnKit) A memory-corruption flaw in the SUID pkexec turns any local account into root on unpatched polkit installations.
- Escalate through Linux file capabilities A binary carrying cap_setuid or cap_dac_read_search grants root-equivalent power without any SUID bit, and defenders rarely audit it.
- Blend C2 into trusted traffic with domain fronting A TLS SNI for a high-reputation CDN domain with a Host header pointing at your backend routes command traffic through infrastructure defenders trust.
- Encrypt beacon memory during sleep to defeat scanners Encrypting your implant's pages while it waits and restoring RW to RX only during execution hides it from periodic memory scans.
- Kill EDR from kernel space with a vulnerable driver A signed but exploitable driver gives you kernel primitives to terminate or blind protected security processes user mode cannot touch.
- Spoof the parent process and block non-Microsoft DLLs Reparenting a spawned process under explorer.exe and setting the block-non-Microsoft-DLL policy breaks EDR user-mode hooks and heuristics at once.
- Blind ETW to strip .NET and process telemetry Neutering EtwEventWrite in your process stops the CLR and many sensors from reporting your activity to userland providers.