Guides
Field notes on offensive recon.
What is attack surface monitoring?
Why an organisation's external attack surface drifts over time, and how passive monitoring catches new exposure before an attacker does.
How to read a BloodHound attack path
The common edges in an Active Directory attack path — MemberOf, AdminTo, HasSession, ACL abuse, DCSync — and how to prioritise what to fix.
Finding subdomains with certificate transparency logs
How certificate transparency logs expose an organisation's subdomains, why the technique is completely passive, and how to turn CT data into a live asset list.
JWT vulnerabilities: alg:none and key confusion
How the alg:none trick and RS256-to-HS256 key confusion let an attacker forge JSON Web Tokens, plus the claims and headers worth checking in any token you capture.
Building targeted password wordlists from a roster
Why a targeted, roster-derived wordlist beats a generic dump for password spraying, the mangling rules that map real names to real credentials, and how to spray without locking accounts.