Tips & Tricks
Short, practical notes from the field: tooling, tradecraft, and shortcuts.
Active Directory
16
Windows and Active Directory tradecraft.
AI & LLM Security
19
Auth & Tokens
12
Cloud & Containers
13
Cloud and identity tips.
Exploitation
2
Turning bugs into working access.
Linux & Privesc
8
Linux tips and privilege escalation.
Recon & OSINT
11
Finding attack surface and mapping targets.
Red Team & Evasion
9
Source Code Review
31
Web & API
22
Web application testing tips.
Windows Post-Exploitation
8
All tips
- Escape a privileged pod to the node A privileged or hostPath-mounting pod is a foothold on the node; mount the host filesystem or use host namespaces.
- Abuse a mounted Kubernetes service account token A shell in a pod usually has a service account token; check what it can do against the API before anything else.
- GCP privilege escalation with serviceAccounts.getAccessToken iam.serviceAccounts.getAccessToken over a more privileged service account lets you mint its token and inherit its access.
- Harvest an Azure managed identity token from IMDS On a compromised Azure VM or App Service, the metadata endpoint issues tokens for the attached identity.
- Steal cloud credentials through SSRF and IMDS A server-side fetch on an EC2 instance reaches the metadata service and its role credentials.
- AWS privilege escalation via iam:PassRole and Lambda If you can pass a more privileged role and create or invoke a function, you inherit that role's credentials.
- Cross-subdomain cookie theft via scoping A session cookie scoped to the parent domain is readable and settable by any subdomain, including one you can control.
- OAuth device code phishing Start a device authorization flow and get the victim to approve your code, yielding tokens for their account.
- Predictable password reset tokens Reset tokens derived from time, user id, or a fast RNG can be predicted or brute forced within the validity window.
- Session fixation across the login boundary If the session id is not rotated on authentication, an attacker who plants a known id before login rides the victim's session after.