Identity Security
12 matching posts.
The Login Page Was Public. The Identity Boundary Was Somewhere Else.
A public login page is only the visible start of an identity system. External pentesting must map the issuer, callback, token policy, account binding, tenant and role conversion, and local session before testing authorization.
The Vendor Was Out of Scope. The Trust Boundary Was Not.
A third-party platform may be excluded from testing while the customer-controlled trust decisions around it remain assessable: identity claims, callbacks, webhooks, custom domains, delivery paths, and data flows.
The Permission Was Granted. The Data Use Still Needed a Policy.
TCC can authorize a macOS process to reach a protected resource, but consent is not a standing business authorization. A defensible review follows the prompt, responsible code identity, returned capability, downstream use, retention, logging, and revocation.
The External Perimeter Is a Graph. The Port List Is Only One View.
Modern external pentesting starts by proving how domains, companies, certificates, identity systems, cloud services, and third parties relate. Active scanning then verifies the small part of that graph that is both relevant and authorized.
Active Directory Hardening Is a Sequence, Not a Score
A scanner score cannot tell you whether a helpdesk account can still reach Domain Admin. This is the order I use to turn AD hardening signals into broken attack paths, tested controls, and recoverable identity infrastructure.
The Pipeline Has No Secret. It Still Has a Cloud Identity.
Replacing static deployment keys with OIDC removes a credential from the repository. It does not decide which workflow deserves the resulting cloud role — that decision lives in the trust policy, and one wildcard can turn an organisation into a deployment API.
AD CS ESC4: The Template Nobody Owned
How an ordinary AD CS permission becomes Domain Admin — and why ESC4 is the cause every ESC1 write-up skips.
The Signature Is Valid. The Token Still Belongs Somewhere Else.
JWT verification fails when applications treat one cryptographic success as a complete access decision. Algorithm, key, issuer, audience, and token type are separate bindings — skip one and a perfectly valid token crosses the wrong boundary.
SMB Signing Is On. That Closed One Edge, Not the Graph.
Signing is a per-protocol control, and NTLM over HTTP cannot be signed at all. The useful question is never whether signing is enabled — it is which relay edges are still open.
Cloud IAM Privilege Escalation: Every Permission Is Individually Fine. The Chain Is Not.
CSPM and least-privilege tools grade each IAM policy on its own, and on its own nearly every policy passes. Cloud privilege escalation is a path across roles, accounts, and trust — and a scanner that cannot see the path cannot flag the risk.
Delegation Triage: You Were Taught the Rare One
Unconstrained delegation gets the diagrams. Resource-based constrained delegation is what you actually find — because it is not a checkbox anyone audits, it is a side effect of who can write to a computer object.
Kerberoasting Triage: Most Service Tickets Are a Waste of Your Time
Requesting every SPN in the domain is easy. Knowing which twelve tickets are worth cracking — and which ones will burn a week of GPU time for nothing — is the actual skill.