Tips & Tricks
Short, practical notes from the field: tooling, tradecraft, and shortcuts.
Active Directory
16
Windows and Active Directory tradecraft.
AI & LLM Security
19
Auth & Tokens
12
Cloud & Containers
13
Cloud and identity tips.
Exploitation
2
Turning bugs into working access.
Linux & Privesc
8
Linux tips and privilege escalation.
Recon & OSINT
11
Finding attack surface and mapping targets.
Red Team & Evasion
9
Source Code Review
31
Web & API
22
Web application testing tips.
Windows Post-Exploitation
8
All tips
- Targeted Kerberoasting by writing an SPN With write access to a user object, set a fake SPN, roast the ticket offline, then remove the SPN.
- Shadow Credentials for a quiet takeover Write access to msDS-KeyCredentialLink lets you add your own key and authenticate as the object via PKINIT without touching its password.
- Resource-based constrained delegation from a single GenericWrite One writable computer object plus a controlled account lets you S4U your way to any user on that host.
- Write a custom Semgrep rule to track a real taint path When the codebase has a project-specific source or sink, a five-line taint rule finds every instance faster than reading files.
- Confirm authorization on GraphQL resolvers per field Route-level auth misses GraphQL entirely; each resolver that returns sensitive data needs its own check.
- Verify webhooks and callbacks check signatures Inbound webhook handlers that skip signature verification let anyone forge events like payment success.
- Find mass assignment in strongly-typed frameworks Binders that map the whole request to a model let attackers set fields the form never exposed, like role or price.
- Review logging for sensitive data and log injection Logging raw request data can leak secrets and lets attackers forge or break log lines with CRLF.
- Trace command injection through format strings Any place a shell command is assembled from input with interpolation is injectable regardless of language.
- Check CORS and security headers set in code A reflected Access-Control-Allow-Origin with credentials, set in application code, is a data-theft primitive.