https://chern0b.it/blog/ 2026-09-04T08:55:10+00:00 https://chern0b.it/java-deserialization-behind-json-api/ 2026-09-07T15:03:54+00:00 https://chern0b.it/wp-content/uploads/2026/09/bounty1.png https://chern0b.it/wp-content/uploads/2026/09/bounty1.png https://chern0b.it/pentesting-identity-aware-proxies/ 2026-09-05T06:31:30+00:00 https://chern0b.it/pentesting-okta-protected-applications-a-practical-black-box-guide/ 2026-09-04T10:20:00+00:00 https://chern0b.it/loot-the-credential-manager-and-windows-vault/ 2026-08-28T15:35:17+00:00 https://chern0b.it/extract-kerberos-tickets-and-keys-from-lsa-with-rubeus/ 2026-08-28T12:39:58+00:00 https://chern0b.it/move-as-another-logged-on-user-by-stealing-their-token/ 2026-08-27T21:36:40+00:00 https://chern0b.it/persist-with-a-wmi-permanent-event-subscription/ 2026-08-27T19:55:47+00:00 https://chern0b.it/escalate-through-weak-service-permissions-and-unquoted-paths/ 2026-08-27T16:53:54+00:00 https://chern0b.it/seimpersonate-to-system-with-a-potato-technique/ 2026-08-27T14:29:06+00:00 https://chern0b.it/decrypt-dpapi-secrets-with-the-domain-backup-key/ 2026-08-26T19:40:00+00:00 https://chern0b.it/dump-lsass-quietly-with-the-comsvcs-minidump-export/ 2026-08-26T11:15:06+00:00 https://chern0b.it/inject-into-a-root-process-with-cap_sys_ptrace/ 2026-08-25T21:38:34+00:00 https://chern0b.it/abuse-sudo-ld_preload-and-ld_library_path/ 2026-08-24T16:19:33+00:00 https://chern0b.it/plant-a-root-suid-over-an-nfs-no_root_squash-export/ 2026-08-24T11:10:02+00:00 https://chern0b.it/hijack-a-writable-or-path-relative-systemd-unit/ 2026-08-21T10:25:27+00:00 https://chern0b.it/break-out-of-a-container-through-the-docker-socket/ 2026-08-20T08:41:19+00:00 https://chern0b.it/root-via-pkexec-argument-confusion-pwnkit/ 2026-08-20T07:37:00+00:00 https://chern0b.it/escalate-through-linux-file-capabilities/ 2026-08-19T18:58:07+00:00 https://chern0b.it/blend-c2-into-trusted-traffic-with-domain-fronting/ 2026-08-18T20:08:33+00:00 https://chern0b.it/encrypt-beacon-memory-during-sleep-to-defeat-scanners/ 2026-08-18T16:47:08+00:00 https://chern0b.it/kill-edr-from-kernel-space-with-a-vulnerable-driver/ 2026-08-16T16:10:43+00:00 https://chern0b.it/spoof-the-parent-process-and-block-non-microsoft-dlls/ 2026-08-16T15:06:40+00:00 https://chern0b.it/blind-etw-to-strip-net-and-process-telemetry/ 2026-08-16T12:07:46+00:00 https://chern0b.it/patch-amsi-in-memory-before-loading-tooling/ 2026-08-16T11:25:46+00:00 https://chern0b.it/restore-clean-syscalls-by-unhooking-ntdll/ 2026-08-15T22:07:58+00:00 https://chern0b.it/stage-and-execute-with-signed-lolbins/ 2026-08-15T20:00:57+00:00 https://chern0b.it/fingerprint-egress-channels-before-delivering-a-payload/ 2026-08-15T08:42:16+00:00 https://chern0b.it/query-internet-scanners-for-the-orgs-exposed-panels/ 2026-08-15T08:02:02+00:00 https://chern0b.it/correlate-people-and-breaches-for-credential-access/ 2026-08-14T20:47:28+00:00 https://chern0b.it/find-virtual-hosts-hidden-behind-shared-ips/ 2026-08-14T16:15:47+00:00 https://chern0b.it/hunt-organization-secrets-across-github/ 2026-08-13T20:25:25+00:00 https://chern0b.it/discover-cloud-storage-by-permutation/ 2026-08-12T08:12:42+00:00 https://chern0b.it/recover-historical-endpoints-and-parameters-from-archives/ 2026-08-10T12:01:20+00:00 https://chern0b.it/extract-endpoints-and-secrets-from-javascript-bundles/ 2026-08-08T21:18:05+00:00 https://chern0b.it/pivot-on-favicon-hashes-to-find-related-hosts/ 2026-08-07T18:25:45+00:00 https://chern0b.it/pivot-from-asn-to-the-full-external-footprint/ 2026-08-07T13:47:38+00:00 https://chern0b.it/mine-certificate-transparency-for-hidden-subdomains/ 2026-08-07T11:08:04+00:00 https://chern0b.it/reach-the-node-role-from-inside-eks-or-gke/ 2026-08-07T08:56:06+00:00 https://chern0b.it/enumerate-what-a-stolen-aws-key-can-actually-do/ 2026-08-06T22:04:23+00:00 https://chern0b.it/read-secrets-from-terraform-state/ 2026-08-06T19:12:17+00:00 https://chern0b.it/pivot-with-aws-ssm-instead-of-ssh/ 2026-08-06T11:52:52+00:00 https://chern0b.it/find-and-take-over-dangling-s3-references/ 2026-08-06T10:51:23+00:00 https://chern0b.it/container-breakout-through-a-mounted-docker-socket/ 2026-08-05T23:49:59+00:00 https://chern0b.it/escape-a-privileged-pod-to-the-node/ 2026-08-05T21:26:40+00:00 https://chern0b.it/abuse-a-mounted-kubernetes-service-account-token/ 2026-08-05T13:19:16+00:00 https://chern0b.it/gcp-privilege-escalation-with-serviceaccounts-getaccesstoken/ 2026-08-05T08:06:13+00:00 https://chern0b.it/harvest-an-azure-managed-identity-token-from-imds/ 2026-08-04T23:05:38+00:00 https://chern0b.it/steal-cloud-credentials-through-ssrf-and-imds/ 2026-08-03T15:38:37+00:00 https://chern0b.it/aws-privilege-escalation-via-iampassrole-and-lambda/ 2026-08-02T07:53:15+00:00 https://chern0b.it/cross-subdomain-cookie-theft-via-scoping/ 2026-08-01T07:28:14+00:00 https://chern0b.it/oauth-device-code-phishing/ 2026-07-30T11:41:40+00:00 https://chern0b.it/predictable-password-reset-tokens/ 2026-07-29T16:40:37+00:00 https://chern0b.it/session-fixation-across-the-login-boundary/ 2026-07-28T14:15:56+00:00 https://chern0b.it/2fa-bypass-through-flow-and-response-manipulation/ 2026-07-27T08:10:04+00:00 https://chern0b.it/saml-nameid-comment-injection/ 2026-07-24T22:15:25+00:00 https://chern0b.it/saml-signature-wrapping-xsw/ 2026-07-23T21:49:21+00:00 https://chern0b.it/pkce-downgrade-on-public-oauth-clients/ 2026-07-23T16:47:14+00:00 https://chern0b.it/oauth-redirect_uri-and-response_type-juggling/ 2026-07-23T10:19:59+00:00 https://chern0b.it/jwt-kid-injection-to-path-traversal-or-sql/ 2026-07-23T10:17:25+00:00 https://chern0b.it/jwt-header-injection-via-jku-and-x5u/ 2026-07-22T09:16:35+00:00 https://chern0b.it/jwt-algorithm-confusion-rs256-to-hs256/ 2026-07-20T23:30:43+00:00 https://chern0b.it/password-spraying-that-respects-lockout-policy/ 2026-07-20T21:33:49+00:00 https://chern0b.it/relay-ntlm-to-ldap-to-configure-rbcd/ 2026-07-20T17:20:55+00:00 https://chern0b.it/map-acl-attack-paths-with-bloodhound-before-touching-anything/ 2026-07-18T20:16:06+00:00 https://chern0b.it/dnsadmins-to-domain-controller-via-server-level-dll/ 2026-07-18T10:45:20+00:00 https://chern0b.it/abuse-writable-gpos-for-code-execution-on-an-ou/ 2026-07-14T22:31:06+00:00 https://chern0b.it/read-laps-passwords-with-extended-rights/ 2026-07-14T13:09:35+00:00 https://chern0b.it/samaccountname-spoofing-nopac-to-impersonate-a-dc/ 2026-07-11T11:40:17+00:00 https://chern0b.it/dcsync-with-replication-rights/ 2026-07-11T10:19:27+00:00 https://chern0b.it/abuse-unconstrained-delegation-with-a-coerced-dc/ 2026-07-10T22:22:09+00:00 https://chern0b.it/esc8-coerce-a-dc-and-relay-to-ad-cs-web-enrollment/ 2026-07-10T15:51:26+00:00 https://chern0b.it/esc1-certificate-template-abuse-for-domain-admin/ 2026-07-10T10:30:31+00:00 https://chern0b.it/as-rep-roast-accounts-without-preauth/ 2026-07-09T18:17:35+00:00 https://chern0b.it/targeted-kerberoasting-by-writing-an-spn/ 2026-07-08T23:30:22+00:00 https://chern0b.it/shadow-credentials-for-a-quiet-takeover/ 2026-07-08T14:20:40+00:00 https://chern0b.it/resource-based-constrained-delegation-from-a-single-genericwrite/ 2026-07-06T23:04:15+00:00 https://chern0b.it/write-a-custom-semgrep-rule-to-track-a-real-taint-path/ 2026-07-06T22:07:57+00:00 https://chern0b.it/confirm-authorization-on-graphql-resolvers-per-field/ 2026-07-05T16:41:42+00:00 https://chern0b.it/verify-webhooks-and-callbacks-check-signatures/ 2026-07-04T22:09:47+00:00 https://chern0b.it/find-mass-assignment-in-strongly-typed-frameworks/ 2026-07-04T14:45:11+00:00 https://chern0b.it/review-logging-for-sensitive-data-and-log-injection/ 2026-07-04T09:10:52+00:00 https://chern0b.it/trace-command-injection-through-format-strings/ 2026-07-03T15:44:54+00:00 https://chern0b.it/check-cors-and-security-headers-set-in-code/ 2026-07-02T15:29:06+00:00 https://chern0b.it/find-open-redirects-and-unsafe-forward-targets/ 2026-07-01T18:28:49+00:00 https://chern0b.it/detect-catastrophic-backtracking-regular-expressions/ 2026-07-01T18:12:29+00:00 https://chern0b.it/audit-github-actions-for-injection-and-privilege/ 2026-07-01T09:16:27+00:00 https://chern0b.it/grep-git-history-and-ci-for-leaked-secrets/ 2026-07-01T07:39:14+00:00 https://chern0b.it/review-net-for-binaryformatter-and-typed-serializers/ 2026-06-30T10:06:15+00:00 https://chern0b.it/review-ruby-for-send-yaml-load-and-mass-assignment/ 2026-06-30T08:50:02+00:00 https://chern0b.it/review-go-for-command-and-template-injection/ 2026-06-29T16:02:34+00:00 https://chern0b.it/spot-toctou-and-check-then-act-races-in-code/ 2026-06-29T07:43:43+00:00 https://chern0b.it/find-jwt-verification-that-trusts-the-token/ 2026-06-27T07:49:51+00:00 https://chern0b.it/catch-insecure-randomness-for-security-tokens/ 2026-06-26T18:52:06+00:00 https://chern0b.it/flag-weak-cryptography-and-password-hashing/ 2026-06-26T17:43:18+00:00 https://chern0b.it/verify-xml-parsers-disable-external-entities/ 2026-06-26T16:46:30+00:00 https://chern0b.it/audit-sql-construction-for-concatenation-and-raw-orm/ 2026-06-26T12:22:26+00:00 https://chern0b.it/detect-path-traversal-in-file-operations/ 2026-06-25T17:00:50+00:00 https://chern0b.it/find-ssrf-sinks-where-the-url-is-user-shaped/ 2026-06-23T14:21:04+00:00 https://chern0b.it/separate-authentication-from-authorization-in-review/ 2026-06-22T17:34:37+00:00 https://chern0b.it/review-node-child_process-and-dynamic-requires/ 2026-06-22T08:53:03+00:00 https://chern0b.it/spot-template-injection-in-python-web-code/ 2026-06-21T13:03:26+00:00 https://chern0b.it/catch-pythons-unsafe-loaders-and-shell-calls/ 2026-06-20T22:23:38+00:00 https://chern0b.it/find-jndi-lookups-that-take-remote-input/ 2026-06-20T15:17:12+00:00 https://chern0b.it/trace-spel-and-ognl-expression-injection-in-java/ 2026-06-20T13:09:55+00:00 https://chern0b.it/flag-java-deserialization-and-unsafe-jackson-typing/ 2026-06-19T23:12:48+00:00 https://chern0b.it/hunt-php-object-injection-at-every-unserialize/ 2026-06-16T17:00:36+00:00 https://chern0b.it/review-by-sources-and-sinks-not-top-to-bottom/ 2026-06-14T16:27:55+00:00 https://chern0b.it/break-output-guardrails-by-controlling-the-answer-channel/ 2026-06-13T22:51:48+00:00 https://chern0b.it/turn-model-file-access-into-local-file-read/ 2026-06-13T20:33:35+00:00 https://chern0b.it/model-denial-of-wallet-through-expensive-prompts/ 2026-06-13T15:05:37+00:00 https://chern0b.it/cross-tenant-leakage-through-a-shared-vector-store/ 2026-06-13T08:20:39+00:00 https://chern0b.it/adversarial-suffixes-against-an-llm-judge/ 2026-06-10T15:37:38+00:00 https://chern0b.it/structured-output-smuggling-in-json-mode/ 2026-06-08T23:23:21+00:00 https://chern0b.it/prompt-injection-in-code-assistants-through-comments/ 2026-06-07T23:35:21+00:00 https://chern0b.it/poison-shared-few-shot-templates/ 2026-06-07T18:20:08+00:00 https://chern0b.it/confused-deputy-data-leak-across-an-agents-contexts/ 2026-06-06T22:52:26+00:00 https://chern0b.it/insecure-output-handling-llm-response-to-stored-xss/ 2026-06-06T16:00:15+00:00 https://chern0b.it/ssrf-and-internal-access-through-an-llm-url-fetch-tool/ 2026-06-04T16:55:11+00:00 https://chern0b.it/hide-injections-in-invisible-unicode-tag-characters/ 2026-06-01T14:11:48+00:00 https://chern0b.it/multi-turn-crescendo-jailbreak/ 2026-06-01T12:43:43+00:00 https://chern0b.it/bypass-content-filters-with-encoding-and-token-splitting/ 2026-06-01T11:10:19+00:00 https://chern0b.it/extract-the-system-prompt-with-output-format-coercion/ 2026-05-31T13:55:28+00:00 https://chern0b.it/persistent-injection-via-rag-index-poisoning/ 2026-05-30T23:04:01+00:00 https://chern0b.it/coerce-dangerous-tool-calls-in-agentic-systems/ 2026-05-30T21:16:37+00:00 https://chern0b.it/zero-click-data-exfiltration-via-markdown-image-rendering/ 2026-05-29T20:07:03+00:00 https://chern0b.it/indirect-prompt-injection-through-retrieved-documents/ 2026-05-29T17:38:40+00:00 https://chern0b.it/second-order-sql-injection-through-stored-profile-fields/ 2026-05-29T16:50:20+00:00 https://chern0b.it/http-2-to-http-1-downgrade-request-smuggling/ 2026-05-28T23:07:41+00:00 https://chern0b.it/client-side-prototype-pollution-to-dom-xss/ 2026-05-28T20:02:52+00:00 https://chern0b.it/websocket-cross-site-hijacking/ 2026-05-28T13:24:45+00:00 https://chern0b.it/oauth-account-takeover-via-redirect_uri-and-response_type-juggling/ 2026-05-26T22:59:38+00:00 https://chern0b.it/chain-php-filter-wrappers-to-read-source-and-reach-rce/ 2026-05-26T22:40:46+00:00 https://chern0b.it/reflected-cors-with-credentials-for-data-theft/ 2026-05-26T19:18:19+00:00 https://chern0b.it/mass-assignment-to-escalate-your-own-role/ 2026-05-25T08:42:33+00:00 https://chern0b.it/nosql-operator-injection-for-auth-bypass/ 2026-05-25T08:05:02+00:00 https://chern0b.it/server-side-prototype-pollution-to-rce-in-node/ 2026-05-25T07:50:46+00:00 https://chern0b.it/confirm-ssti-fast-then-jump-straight-to-rce/ 2026-05-24T12:09:37+00:00 https://chern0b.it/xxe-through-svg-and-office-file-uploads/ 2026-05-23T14:31:00+00:00 https://chern0b.it/blind-xxe-exfiltration-with-external-parameter-entities/ 2026-05-22T11:50:29+00:00 https://chern0b.it/single-packet-race-conditions-over-http-2/ 2026-05-20T14:47:20+00:00 https://chern0b.it/recover-a-hidden-graphql-schema-from-field-suggestions/ 2026-05-19T20:35:43+00:00 https://chern0b.it/abuse-graphql-aliasing-to-smash-rate-limits/ 2026-05-19T16:53:57+00:00 https://chern0b.it/detect-cl-te-request-smuggling-without-breaking-the-app/ 2026-05-15T22:01:44+00:00 https://chern0b.it/password-reset-poisoning-via-unkeyed-host-header/ 2026-05-13T19:15:49+00:00 https://chern0b.it/web-cache-deception-on-authenticated-pages/ 2026-05-13T16:21:02+00:00 https://chern0b.it/defeat-ssrf-allow-lists-with-dns-rebinding/ 2026-05-12T18:12:02+00:00 https://chern0b.it/turn-blind-ssrf-into-rce-with-a-gopher-payload-to-redis/ 2026-05-11T10:46:44+00:00 https://chern0b.it/enumerate-iam-before-you-escalate/ 2026-05-11T08:37:41+00:00 https://chern0b.it/check-gtfobins-before-giving-up-on-a-binary/ 2026-05-10T14:08:59+00:00 https://chern0b.it/kerberoast-only-what-you-can-crack/ 2026-05-09T09:13:00+00:00 https://chern0b.it/spot-ssrf-in-url-preview-features/ 2026-05-07T10:56:15+00:00 https://chern0b.it/look-at-what-the-platform-opens-not-just-what-you-deploy/ 2026-05-07T10:18:38+00:00 https://chern0b.it/match-the-gadget-to-the-target-library-version/ 2026-05-04T23:30:22+00:00 https://chern0b.it/grep-your-way-to-serialization-sinks/ 2026-05-02T20:21:02+00:00 https://chern0b.it/wildfly-two-roads-to-rce/ 2026-05-02T19:59:38+00:00