Identity and access
OAuth, JWT, workload identity, Active Directory, and the difference between a valid credential and an authorized action.
Start here, then go deeper.
Start with application authorization, then move through token trust and directory attack paths.
- 01WebThe Flow Is Standard. The Bypass Is in the Half You Skipped.8 min ↗
OAuth 2.0 and OIDC vulnerabilities are almost never in the specification. They are in the parts implementations leave out — state, PKCE, exact redirect matching, audience validation — and the flow runs perfectly while each omission sits there waiting.
- 02Token verificationThe Signature Is Valid. The Token Still Belongs Somewhere Else.8 min ↗
JWT verification fails when applications treat one cryptographic success as a complete access decision. Algorithm, key, issuer, audience, and token type are separate bindings — skip one and a perfectly valid token crosses the wrong boundary.
- 03Workload identityThe Pipeline Has No Secret. It Still Has a Cloud Identity.8 min ↗
Replacing static deployment keys with OIDC removes a credential from the repository. It does not decide which workflow deserves the resulting cloud role — that decision lives in the trust policy, and one wildcard can turn an organisation into a deployment API.
- 04IdentityBloodHound Path Triage: The Shortest Path Is Usually the One That Expires First7 min ↗
BloodHound draws every edge the same width, but a DACL lasts for years and a session lasts for minutes. Shortest-path queries are biased toward exactly the edges least likely to still be there when you walk them.
- 05Directory evidenceKerberoasting Triage: Most Service Tickets Are a Waste of Your Time7 min ↗
Requesting every SPN in the domain is easy. Knowing which twelve tickets are worth cracking — and which ones will burn a week of GPU time for nothing — is the actual skill.
Every matching record.
Methods and named-vulnerability research remain visually and editorially separate.
Field notes 27
The Login Page Was Public. The Identity Boundary Was Somewhere Else.
A public login page is only the visible start of an identity system. External pentesting must map the issuer, callback, token policy, account binding, tenant and role conversion, and local session before testing authorization.
17 min read ↗Pentest · Sep 10, 2026The Service Was Observed. The Application Was Still Unknown.
Passive internet data can reveal a live service without proving its current owner, hostname, virtual host, application, or business purpose. A defensible external pentest turns that observation into a bounded application model before testing for vulnerabilities.
16 min read ↗Pentest · Sep 9, 2026The Vendor Was Out of Scope. The Trust Boundary Was Not.
A third-party platform may be excluded from testing while the customer-controlled trust decisions around it remain assessable: identity claims, callbacks, webhooks, custom domains, delivery paths, and data flows.
16 min read ↗Pentest · Sep 5, 2026The Permission Was Granted. The Data Use Still Needed a Policy.
TCC can authorize a macOS process to reach a protected resource, but consent is not a standing business authorization. A defensible review follows the prompt, responsible code identity, returned capability, downstream use, retention, logging, and revocation.
11 min read ↗Pentest · Aug 30, 2026The Red Team Reached Domain Admin. The Exercise Still Failed.
Domain Admin is a capability, not a business objective. This field methodology turns an authorized red team operation into a testable chain of objective, runtime authority, technical action, defender signal, response decision, evidence, and verified recovery.
18 min read ↗Pentest · Aug 29, 2026The External Perimeter Is a Graph. The Port List Is Only One View.
Modern external pentesting starts by proving how domains, companies, certificates, identity systems, cloud services, and third parties relate. Active scanning then verifies the small part of that graph that is both relevant and authorized.
14 min read ↗Pentest · Aug 23, 2026The Model Proposed the Action. The Broker Decided Whether It Could Exist.
A practical architecture for AI-assisted pentest execution: resolve scope outside the model, classify side effects, issue short-lived capabilities, deny high-impact authority, and preserve a decision record that can be independently verified.
16 min read ↗Pentest · Aug 21, 2026The Model Found the Vulnerability. The Tool Call Became the Incident.
A balanced operating model for AI-assisted pentesting: where models improve coverage and evidence work, where excessive agency turns a valid test into a destructive action, and how to keep cloud, shell, and Domain Admin authority outside the model.
18 min read ↗Pentest · Aug 13, 2026The Handshake Was Captured. The Network Was Not.
A Wi-Fi assessment methodology that separates radio visibility, network identity, authentication, client trust, and post-association access before calling a wireless test successful.
18 min read ↗Pentest · Jul 9, 2026The Model Is Not the Target. The Pipeline Is.
A field methodology for using MITRE ATLAS without turning an AI assessment into matrix theatre: map the production system, follow authority into tools and data, test reachable attack paths, and label the evidence only after impact is proven.
18 min read ↗Pentest · Jun 18, 2026Active Directory Hardening Is a Sequence, Not a Score
A scanner score cannot tell you whether a helpdesk account can still reach Domain Admin. This is the order I use to turn AD hardening signals into broken attack paths, tested controls, and recoverable identity infrastructure.
31 min read ↗Cloud Security · Apr 16, 2026The Pipeline Has No Secret. It Still Has a Cloud Identity.
Replacing static deployment keys with OIDC removes a credential from the repository. It does not decide which workflow deserves the resulting cloud role — that decision lives in the trust policy, and one wildcard can turn an organisation into a deployment API.
8 min read ↗Pentest · Mar 12, 2026AD CS ESC4: The Template Nobody Owned
How an ordinary AD CS permission becomes Domain Admin — and why ESC4 is the cause every ESC1 write-up skips.
21 min read ↗Pentest · Feb 26, 2026Android App Links: The Link Was Verified. The Action Was Not.
A field methodology for Android App Links that separates domain ownership, route validation, application state, and server-side authorization before calling a deep link secure.
18 min read ↗Web Security · Jan 29, 2026The Request Stayed Server-Side. The Credential Did Not.
SSRF severity is not the URL an application can fetch. It is the trust the outbound request inherits — network position, redirect behavior, DNS resolution, and access to metadata or control-plane identities. Test the route as a chain, not a blacklist.
9 min read ↗Pentest · Jan 16, 2026The Blast Radius Is One Number. Almost Nobody Has Measured It.
Part four of testing the ransomware playbook: lateral movement runs on your own administrative tooling, so detection is a signal-to-noise problem — and the number that actually decides the outcome is how many hosts accept the same credential.
7 min read ↗Pentest · Dec 12, 2025Affiliates Do Not Find Novel Paths. They Find Yours.
Part three of testing the ransomware playbook: privilege escalation inside the domain uses a small, stable set of paths — the same ones already written up on this site — and the affiliate picks by reliability, not by cleverness.
7 min read ↗Pentest · Nov 21, 2025Enumeration Cannot Be Prevented. Ask Whether It Was Seen.
Part two of testing the ransomware playbook: the affiliate's first hour is the same directory collection you run, it cannot be blocked, and the engagement usually destroys the only question worth asking about it on day one.
7 min read ↗Pentest · Nov 7, 2025They Do Not Break In. They Log In.
Part one of testing the ransomware playbook: the initial access an affiliate needs is almost always a valid credential against a reachable endpoint — and that finding is usually already in a report somewhere, marked medium.
7 min read ↗Web Security · Oct 23, 2025The Signature Is Valid. The Token Still Belongs Somewhere Else.
JWT verification fails when applications treat one cryptographic success as a complete access decision. Algorithm, key, issuer, audience, and token type are separate bindings — skip one and a perfectly valid token crosses the wrong boundary.
8 min read ↗Pentest · Sep 11, 2025SMB Signing Is On. That Closed One Edge, Not the Graph.
Signing is a per-protocol control, and NTLM over HTTP cannot be signed at all. The useful question is never whether signing is enabled — it is which relay edges are still open.
7 min read ↗Cloud Security · Aug 14, 2025Cloud IAM Privilege Escalation: Every Permission Is Individually Fine. The Chain Is Not.
CSPM and least-privilege tools grade each IAM policy on its own, and on its own nearly every policy passes. Cloud privilege escalation is a path across roles, accounts, and trust — and a scanner that cannot see the path cannot flag the risk.
9 min read ↗Pentest · Jun 19, 2025BloodHound Path Triage: The Shortest Path Is Usually the One That Expires First
BloodHound draws every edge the same width, but a DACL lasts for years and a session lasts for minutes. Shortest-path queries are biased toward exactly the edges least likely to still be there when you walk them.
7 min read ↗Web Security · May 29, 2025The Flow Is Standard. The Bypass Is in the Half You Skipped.
OAuth 2.0 and OIDC vulnerabilities are almost never in the specification. They are in the parts implementations leave out — state, PKCE, exact redirect matching, audience validation — and the flow runs perfectly while each omission sits there waiting.
8 min read ↗Pentest · Apr 24, 2025Delegation Triage: You Were Taught the Rare One
Unconstrained delegation gets the diagrams. Resource-based constrained delegation is what you actually find — because it is not a checkbox anyone audits, it is a side effect of who can write to a computer object.
8 min read ↗Pentest · Feb 13, 2025Kerberoasting Triage: Most Service Tickets Are a Waste of Your Time
Requesting every SPN in the domain is easy. Knowing which twelve tickets are worth cracking — and which ones will burn a week of GPU time for nothing — is the actual skill.
7 min read ↗Web Security · Jan 16, 2025The Path Your Proxy Blocks Is Not the Path Your App Runs
When authorisation and routing are done by different software, they parse the URL differently. The bypass is not in either component — it is in the order they run.
7 min read ↗