Methodology
iOS Application Security in Practice: Auditing 30 OWASP MASVS Vulnerabilities with Frida and LLDB
Hands-on iOS penetration testing and secure coding: auditing Keychain misuse, bypassing client-side biometric checks with Frida, defeating SSL pinning, and mapping 30 real-world vulnerabilities to OWASP MASVS v2.
Resilient Out-of-Band C2 Pipelines: Framing, AEAD Encryption, and Covert Channels in Go
Designing fault-tolerant, out-of-band command-and-control pipelines for authorized security testing: forward error correction via XOR parity, P-256 ECDHE session encryption, and 9 covert transport protocols in ghostlink.
Kernel-Level Packet Sniffing with eBPF/XDP: Real-Time Credential Extraction and Exposure Auditing
How eBPF and XDP bypass userspace packet-capture bottlenecks to intercept authentication handshakes, NetNTLMv2 hashes, and cleartext credentials at line rate: architecture, protocol dissectors, and exposure auditing with driftnet2.
macOS Hardening in Practice: Auditing 54 Controls, Detecting Drift, and Remediating Without Dependencies
A deep dive into macOS endpoint security architecture: auditing SIP, Gatekeeper, TCC, LaunchDaemons, BPF packet filters, and plaintext secret leakage using native Zsh primitives, zero third-party dependencies, and OASIS SARIF v2.1.0.
Breaking AI Agent Boundaries: From Prompt Injection to Remote Code Execution via Model Context Protocol (MCP)
How untrusted context in modern AI pipelines forces autonomous agents to execute arbitrary operating system commands through Model Context Protocol (MCP) server tools: indirect injection, ambient authority, and deterministic execution brokers.
AD CS Part 1: Architecture, Template Semantics, and the ESC Taxonomy
Deconstructing the Active Directory Certificate Services attack surface: template attributes, PKINIT credential exchange, EKU semantics, identity mapping, and the ESC taxonomy mapped by root cause.
Active Directory as a Directed Graph: How Security Descriptors and Object ACLs Actually Work
Active Directory stores every user, group, computer, and GPO as an LDAP object with a binary nTSecurityDescriptor. Walking the eight-hop escalation chain in GOAD's sevenkingdoms.local domain shows how ACE masks, Extended Rights GUIDs, and ownership changes turn helpdesk permissions into Domain Controller compromise.
Inside Kerberos Delegation: Why Multi-Tier Windows Apps Need It (and Why It Breaks)
Walking through the Kerberos double-hop problem and the three generations of delegation in Windows: how Unconstrained, Constrained (S4U2Self / S4U2Proxy), and Resource-Based Constrained Delegation (RBCD) look in LDAP across the GOAD lab.
GOAD Part 1: From Zero Credentials to the Attack Graph
Walking through the GOAD Active Directory lab from a single Kali host: zero-knowledge host discovery, SMB signing checks, forest and trust mapping, unauthenticated user enumeration, AS-REP Roasting, SMB/SYSVOL secret hunting, and BloodHound graph analysis.
Multi-Forest Active Directory Architecture: How Forests, Trusts, DNS, and Tiered Services Actually Work
Looking at the five-server GOAD environment from the systems side before running an exploit: why organizations split forests and child domains, how directory partitions replicate, how DNS forwarders and Trusted Domain Objects route cross-forest authentication, and where normal Windows features turn into attack paths.
Building the GOAD Lab: A Two-Forest Active Directory on a Laptop
The foundation post for the whole series: how a two-forest, three-domain Active Directory lab is provisioned from bare metal on a ThinkPad, what Vagrant and Ansible actually do, the VMware quirks that had to be patched, and how the lab is started, snapshotted, and reached from Kali.