Pentest
iOS Application Security in Practice: Auditing 30 OWASP MASVS Vulnerabilities with Frida and LLDB
Hands-on iOS penetration testing and secure coding: auditing Keychain misuse, bypassing client-side biometric checks with Frida, defeating SSL pinning, and mapping 30 real-world vulnerabilities to OWASP MASVS v2.
Container Escape: Docker Socket, Privileged Mode, and the Boundary That Moves
A container is a namespace, a cgroup, and a set of capabilities — not a boundary. When one of those is handed to you, the host is a mount away. The Docker socket and --privileged are demonstrated live, and the cgroup v1 trick that modern systems already killed is called out.
Stack Buffer Overflow: From Segfault to RIP Control (Ret2win)
The non-AD half of the journey: a 64-byte stack buffer, an unbounded read, and the exact steps that turn a segfault into control of the instruction pointer. Compiled live in a Linux container, with the one gotcha — the return address is not where the naive math says it is.
DNSAdmins and Backup Operators: Privileged Group Abuse to SYSTEM on the DC
The last two GOAD techniques are not exploits but groups: DNSAdmins loads a DLL into the DNS service, Backup Operators reads what the OS would rather hide. One is demonstrated end to end, one is documented honestly with the remote-registry wrinkle, and the relay gap that neither covers is called out.
Skeleton Key: A Master Password for Every Account in the Domain
After Domain Admin, the game changes from getting in to staying in. The Skeleton Key patches the Domain Controller's KDC in memory so the single password 'mimikatz' unlocks every account — demonstrated live against KINGSLANDING, alongside the memory SSP and why DSRM does not apply in this lab.
Offline Domain Dump: Shadow Copies and NTDS.dit
DCSync is the online way to pull hashes — but it needs replication rights. The offline way asks for nothing from the DC: take a shadow copy of C:, copy the NTDS.dit database and SYSTEM hive out, and dump every credential on your own machine with no Domain Controller cooperation.
Forging Kerberos Tickets: Golden and Silver Tickets in GOAD
DCSync handed us the krbtgt hashes and service-account hashes. This is what they are actually for: forging a Golden Ticket for the whole forest, and a Silver Ticket for one SPN — logging in as Administrator without a password, and why the two differ.
Cross-Forest Pivoting via SQL Server Linked Servers: Bypassing Kerberos Trust Boundaries
Deconstructing SQL Server linked-server lateral movement in GOAD: from a cracked service account (jon.snow) to xp_cmdshell execution as north\sql_svc, pivoting through sa-mapped linked servers into essos\sql_svc without Kerberos trust authentication.
Pass-the-Hash and Overpass-the-Hash: Moving with Hashes, Not Passwords
DCSync left us holding NTLM hashes but no passwords. Pass-the-hash feeds the raw hash straight into NTLM; overpass-the-hash turns that same hash into a Kerberos TGT. Both log in as Administrator without ever cracking anything — and they answer two different problems.
Force-Set SPN: Targeted Kerberoasting with GenericWrite
Kerberoasting normally waits for a service account to already have an SPN. With GenericWrite over a user you can add the SPN yourself and Kerberoast them on demand — turning any weak-password user you can write to into a crackable target.
GOAD Part 4: Owning essos.local Across the Forest Trust
The forest trust into essos.local enforces SID filtering, so a forged ExtraSids ticket will not carry Domain Admin across the boundary. What does cross is foreign group nesting, a three-hop ACL chain, LAPS, and an AD CS CA full of ESC templates.
GOAD Part 3: Walking the ACL Chain to the Forest Root
Eight misconfigured ACLs stand between a single recovered password and Domain Admin on the sevenkingdoms.local forest root. Each edge is a different right and forces a different technique. This is every hop, every tool, and the two places it tried to fail.
Password Spraying: One Password, Every Account
The lockout-aware credential attack: one common password tried across every account in the domain, respecting the lockout threshold so nothing trips. GOAD's north domain shows the whole dance — from reading the password policy to the one account that reused Winter2022.
GOAD Part 2: Owning the NORTH Domain Controller
Moving from a low-privileged user account to Domain Admin on DC02 in north.sevenkingdoms.local: Kerberoasting a service account, abusing constrained delegation with S4U2Self and S4U2Proxy, and injecting a SYSTEM scheduled task through a writable GPO.
GOAD Part 1: From Zero Credentials to the Attack Graph
Walking through the GOAD Active Directory lab from a single Kali host: zero-knowledge host discovery, SMB signing checks, forest and trust mapping, unauthenticated user enumeration, AS-REP Roasting, SMB/SYSVOL secret hunting, and BloodHound graph analysis.
Building the GOAD Lab: A Two-Forest Active Directory on a Laptop
The foundation post for the whole series: how a two-forest, three-domain Active Directory lab is provisioned from bare metal on a ThinkPad, what Vagrant and Ansible actually do, the VMware quirks that had to be patched, and how the lab is started, snapshotted, and reached from Kali.