Tips & Tricks
Short, practical notes from the field: tooling, tradecraft, and shortcuts.
Active Directory
16
Windows and Active Directory tradecraft.
AI & LLM Security
19
Auth & Tokens
12
Cloud & Containers
13
Cloud and identity tips.
Exploitation
2
Turning bugs into working access.
Linux & Privesc
8
Linux tips and privilege escalation.
Recon & OSINT
11
Finding attack surface and mapping targets.
Red Team & Evasion
9
Source Code Review
31
Web & API
22
Web application testing tips.
Windows Post-Exploitation
8
All tips
- Extract endpoints and secrets from JavaScript bundles Front-end bundles list API routes, parameters, and sometimes keys the rest of the site never links to.
- Pivot on favicon hashes to find related hosts A favicon hash uniquely fingerprints an app, so searching for it in Shodan or Censys surfaces every host running the same stack.
- Pivot from ASN to the full external footprint Start from the organization's ASN to enumerate owned IP ranges, then scan those for assets DNS does not reveal.
- Mine certificate transparency for hidden subdomains CT logs record every issued certificate, exposing internal and staging hostnames DNS brute force never finds.
- Reach the node role from inside EKS or GKE A pod without IMDS restrictions can grab the node instance role, which is usually far more privileged than the pod identity.
- Enumerate what a stolen AWS key can actually do Before escalating, map the identity's real permissions with low-noise calls to avoid dead ends and access-denied storms.
- Read secrets from Terraform state State files store resource attributes in clear, including passwords, keys, and tokens created during apply.
- Pivot with AWS SSM instead of SSH With ssm:StartSession or SendCommand you get shells on instances without keys, ports, or touching the network.
- Find and take over dangling S3 references Deleted buckets still referenced by a CNAME or app config can be re-created by anyone, yielding content control.
- Container breakout through a mounted docker socket A container with /var/run/docker.sock can start a new privileged container that mounts the host root.