Tips & Tricks
Short, practical notes from the field: tooling, tradecraft, and shortcuts.
Active Directory
16
Windows and Active Directory tradecraft.
AI & LLM Security
19
Auth & Tokens
12
Cloud & Containers
13
Cloud and identity tips.
Exploitation
2
Turning bugs into working access.
Linux & Privesc
8
Linux tips and privilege escalation.
Recon & OSINT
11
Finding attack surface and mapping targets.
Red Team & Evasion
9
Source Code Review
31
Web & API
22
Web application testing tips.
Windows Post-Exploitation
8
All tips
- Patch AMSI in memory before loading tooling A single-byte patch to AmsiScanBuffer in the current process disables the scan for every script and assembly you load afterwards.
- Restore clean syscalls by unhooking ntdll EDRs patch userland ntdll functions; mapping a fresh copy from disk removes their hooks before you make sensitive calls.
- Stage and execute with signed LOLBins Trusted Windows binaries fetch and run code, avoiding a fresh unsigned executable on disk.
- Fingerprint egress channels before delivering a payload Learn which outbound paths a host allows first, then pick a C2 channel that blends with normal traffic.
- Query internet scanners for the org’s exposed panels Precise Shodan and Censys queries surface login portals, dev tools, and databases tied to the target without touching it.
- Correlate people and breaches for credential access Map employees to email formats, then check breach and combo data to seed targeted password spraying.
- Find virtual hosts hidden behind shared IPs One IP can serve many sites keyed by Host header; brute the header to reach internal apps not in DNS.
- Hunt organization secrets across GitHub Employees leak keys in personal repos, gists, and commit history; search by org, domain, and internal identifiers.
- Discover cloud storage by permutation Generate likely bucket and blob names from the org's keywords, then check S3, GCS, and Azure for readable or writable stores.
- Recover historical endpoints and parameters from archives Old crawls hold deprecated endpoints and parameter names that are frequently still live and less guarded.