Tips & Tricks
Short, practical notes from the field: tooling, tradecraft, and shortcuts.
Active Directory
16
Windows and Active Directory tradecraft.
AI & LLM Security
19
Auth & Tokens
12
Cloud & Containers
13
Cloud and identity tips.
Exploitation
2
Turning bugs into working access.
Linux & Privesc
8
Linux tips and privilege escalation.
Recon & OSINT
11
Finding attack surface and mapping targets.
Red Team & Evasion
9
Source Code Review
31
Web & API
22
Web application testing tips.
Windows Post-Exploitation
8
All tips
- Find open redirects and unsafe forward targets Redirects built from request parameters enable phishing and can bootstrap OAuth token theft.
- Detect catastrophic backtracking regular expressions Nested quantifiers and overlapping alternations on user input cause exponential regex time and denial of service.
- Audit GitHub Actions for injection and privilege pull_request_target with checkout of untrusted code, and expressions built from PR text, hand attackers your CI secrets.
- Grep git history and CI for leaked secrets A rotated secret still lives in history; scan commits, not just the current tree.
- Review .NET for BinaryFormatter and typed serializers BinaryFormatter, LosFormatter, and type-permissive JSON settings are direct RCE in .NET applications.
- Review Ruby for send, YAML.load, and mass assignment Dynamic send on user input, YAML or Marshal load, and permit! are the highest-yield Ruby and Rails findings.
- Review Go for command and template injection exec with sh -c, and text/template used where html/template is required, are the two classic Go review findings.
- Spot TOCTOU and check-then-act races in code Balance checks, file existence checks, and uniqueness checks that are separate from the action are exploitable windows.
- Find JWT verification that trusts the token Decode-without-verify, accepting alg none, and hardcoded secrets are the three JWT review killers.
- Catch insecure randomness for security tokens Session ids, reset tokens, and API keys generated from non-cryptographic RNGs are predictable.