Pentest
35 posts in this category.
The Login Page Was Public. The Identity Boundary Was Somewhere Else.
A public login page is only the visible start of an identity system. External pentesting must map the issuer, callback, token policy, account binding, tenant and role conversion, and local session before testing authorization.
The Service Was Observed. The Application Was Still Unknown.
Passive internet data can reveal a live service without proving its current owner, hostname, virtual host, application, or business purpose. A defensible external pentest turns that observation into a bounded application model before testing for vulnerabilities.
The Vendor Was Out of Scope. The Trust Boundary Was Not.
A third-party platform may be excluded from testing while the customer-controlled trust decisions around it remain assessable: identity claims, callbacks, webhooks, custom domains, delivery paths, and data flows.
The Domain Resolved. Ownership Was Still a Hypothesis.
A defensible external pentest does not turn company names, CT records, shared IPs, or acquisition news into targets. It separates association, current control, and written scope—then records the evidence for each decision.
The Event Was Visible. The Detection Still Needed Context.
Endpoint Security can deliver macOS authorization requests and event notifications, but an event is not yet a verdict. A defensible design preserves timing, sequence gaps, process identity, policy version, privacy, outcome, and the resulting system effect.
The Helper Was Registered. Its Lifetime Outlived the App.
A macOS login item, launch agent, or launch daemon can remain active after the visible app exits. A defensible review separates packaging, registration, approval, launch domain, runtime authority, updates, failure recovery, and removal.
The Permission Was Granted. The Data Use Still Needed a Policy.
TCC can authorize a macOS process to reach a protected resource, but consent is not a standing business authorization. A defensible review follows the prompt, responsible code identity, returned capability, downstream use, retention, logging, and revocation.
The Extension Was Sandboxed. The Shared Container Still Crossed the Boundary.
An iOS app and its extensions run in separate containers, but App Groups and Keychain access groups deliberately reconnect them. A defensible review follows each entitlement, producer, shared object, lifecycle transition, and privileged consumer instead of treating code signing as authorization.
One ATM Was Contained. The Fleet Trust Path Was Not.
The final ATM assessment chapter: test remote support, software deployment, segmentation, monitoring, transaction integrity, containment, and reconciliation as fleet-wide control planes.
The App Was Sandboxed. The XPC Boundary Still Needed Authorization.
A macOS app can be sandboxed while a separate helper, launch agent, or launch daemon holds different authority. A defensible review maps every executable, entitlement, XPC peer, operation, and effect instead of treating the app bundle as one security boundary.
The Device API Was Standard. Authorization Was Assumed.
Part four of the ATM assessment series: test XFS-style middleware, caller identity, service providers, peripheral state, PIN boundaries, and transaction context with emulators and denied requests—not live device effects.
The Desktop Was Hidden. The Execution Boundary Was Not.
Part three of the ATM assessment series: validate kiosk containment, application control, service identities, maintenance states, secrets, updates, and off-host telemetry without turning UI escape testing into a payload exercise.
The BIOS Had a Password. The Boot Chain Still Needed Trust.
Part two of the ATM assessment series: an evidence-driven method for validating firmware recovery, Secure Boot, measured boot, disk-unlock policy, update integrity, and off-host detection without publishing a hardware-bypass playbook.
The ATM Was Locked Down. The Transaction Path Was Not.
An evidence-driven methodology for authorized ATM security assessments: test the trust boundaries between the kiosk, operating system, device middleware, EPP, service network, monitoring plane, and transaction switch without turning the engagement into a cash-out exercise.
The Red Team Reached Domain Admin. The Exercise Still Failed.
Domain Admin is a capability, not a business objective. This field methodology turns an authorized red team operation into a testable chain of objective, runtime authority, technical action, defender signal, response decision, evidence, and verified recovery.
The External Perimeter Is a Graph. The Port List Is Only One View.
Modern external pentesting starts by proving how domains, companies, certificates, identity systems, cloud services, and third parties relate. Active scanning then verifies the small part of that graph that is both relevant and authorized.
The Container Was Non-Root. The Node Was Still One Mount Away.
A container security methodology that measures mounts, runtime authority, kernel controls, and workload identity instead of treating a non-root UID or a passing policy check as proof of isolation.
AI Vulnerability Discovery: One Frontier Model or Three Specialists?
A reproducible benchmark design for the decision security teams actually face: spend the same research budget on repeated runs of one strong model, or on a diverse model team—and count only vulnerabilities that survive root-cause review, reproduction, and a fixed-version negative control.
The Model Proposed the Action. The Broker Decided Whether It Could Exist.
A practical architecture for AI-assisted pentest execution: resolve scope outside the model, classify side effects, issue short-lived capabilities, deny high-impact authority, and preserve a decision record that can be independently verified.
The Hardening Score Went Up. The Attack Path Stayed Open.
A practical Linux hardening methodology that uses Lynis as a sensor, established baselines as context, and controlled retesting to prove which changes reduce attack paths without breaking the service.
The Model Found the Vulnerability. The Tool Call Became the Incident.
A balanced operating model for AI-assisted pentesting: where models improve coverage and evidence work, where excessive agency turns a valid test into a destructive action, and how to keep cloud, shell, and Domain Admin authority outside the model.
The Handshake Was Captured. The Network Was Not.
A Wi-Fi assessment methodology that separates radio visibility, network identity, authentication, client trust, and post-association access before calling a wireless test successful.
The Model Is Not the Target. The Pipeline Is.
A field methodology for using MITRE ATLAS without turning an AI assessment into matrix theatre: map the production system, follow authority into tools and data, test reachable attack paths, and label the evidence only after impact is proven.
Active Directory Hardening Is a Sequence, Not a Score
A scanner score cannot tell you whether a helpdesk account can still reach Domain Admin. This is the order I use to turn AD hardening signals into broken attack paths, tested controls, and recoverable identity infrastructure.
AD CS ESC4: The Template Nobody Owned
How an ordinary AD CS permission becomes Domain Admin — and why ESC4 is the cause every ESC1 write-up skips.
Android App Links: The Link Was Verified. The Action Was Not.
A field methodology for Android App Links that separates domain ownership, route validation, application state, and server-side authorization before calling a deep link secure.
The Last Two Steps Are Not in Scope. What Makes Them Survivable Is.
Part five of testing the ransomware playbook: an assessment stops before exfiltration and encryption, and it should. But the two properties that decide how bad either gets — egress and backup reachability — are fully testable, and almost never in scope.
The Blast Radius Is One Number. Almost Nobody Has Measured It.
Part four of testing the ransomware playbook: lateral movement runs on your own administrative tooling, so detection is a signal-to-noise problem — and the number that actually decides the outcome is how many hosts accept the same credential.
Affiliates Do Not Find Novel Paths. They Find Yours.
Part three of testing the ransomware playbook: privilege escalation inside the domain uses a small, stable set of paths — the same ones already written up on this site — and the affiliate picks by reliability, not by cleverness.
Enumeration Cannot Be Prevented. Ask Whether It Was Seen.
Part two of testing the ransomware playbook: the affiliate's first hour is the same directory collection you run, it cannot be blocked, and the engagement usually destroys the only question worth asking about it on day one.
They Do Not Break In. They Log In.
Part one of testing the ransomware playbook: the initial access an affiliate needs is almost always a valid credential against a reachable endpoint — and that finding is usually already in a report somewhere, marked medium.
SMB Signing Is On. That Closed One Edge, Not the Graph.
Signing is a per-protocol control, and NTLM over HTTP cannot be signed at all. The useful question is never whether signing is enabled — it is which relay edges are still open.
BloodHound Path Triage: The Shortest Path Is Usually the One That Expires First
BloodHound draws every edge the same width, but a DACL lasts for years and a session lasts for minutes. Shortest-path queries are biased toward exactly the edges least likely to still be there when you walk them.
Delegation Triage: You Were Taught the Rare One
Unconstrained delegation gets the diagrams. Resource-based constrained delegation is what you actually find — because it is not a checkbox anyone audits, it is a side effect of who can write to a computer object.
Kerberoasting Triage: Most Service Tickets Are a Waste of Your Time
Requesting every SPN in the domain is easy. Knowing which twelve tickets are worth cracking — and which ones will burn a week of GPU time for nothing — is the actual skill.