Offensive research across the cyber kill chain: OSINT recon & enumeration, Windows host persistence, lateral movement over SMB/RPC, and an insecure-deserialization deep dive (CVE-2020-0688). For educational use and authorized testing only.
A defensive analysis of ToolShell, the SharePoint Server on-premises RCE chain tracked as CVE-2025-53770: root cause, execution flow, attacker artifacts, indicators of compromise, hunting ideas, and remediation guidance.
2025-07-29A full attack chain against a lab target: leaking a .git directory, finding an unsanitized system() call, then abusing the GCP instance metadata service to mint an OAuth token for a cloud-platform-scoped service account and exfiltrate a protected object from Cloud Storage.
2024-03-18A researcher-style deep dive into insecure deserialization through ASP.NET ViewState and CVE-2020-0688: serialization concepts, ViewState integrity, Exchange static validation keys, exploit prerequisites, ysoserial.net payload construction, forensic artifacts, detection logic, and remediation.
2022-09-24A complete researcher-style reconnaissance case study against EC-Council's training host: passive intelligence collection, HUMINT extraction, WHOIS, certificate transparency, Google dorking, Shodan analysis, Wayback recovery, Nmap validation, metadata harvesting, risk synthesis, and defensive recommendations.
2022-09-22A researcher-style study of Windows host persistence through Services, Scheduled Tasks, and Run keys: execution model, privilege requirements, configuration internals, forensic artifacts, detection logic, OPSEC tradeoffs, and defensive hardening.
2022-07-31A researcher-style study of Windows lateral movement: SMB/RPC fundamentals, LM and NTLM authentication, pass-the-hash, Impacket execution methods, Windows-native alternatives, protocol flow, forensic artifacts, detection opportunities, and defensive controls.
2022-06-13