Identity and access
OAuth, JWT, workload identity, Active Directory, and the difference between a valid credential and an authorized action.
Every matching record.
Methods and named-vulnerability research remain visually and editorially separate.
Field notes 23
Resilient Out-of-Band C2 Pipelines: Framing, AEAD Encryption, and Covert Channels in Go
Designing fault-tolerant, out-of-band command-and-control pipelines for authorized security testing: forward error correction via XOR parity, P-256 ECDHE session encryption, and 9 covert transport protocols in ghostlink.
8 min read ↗Red Team · Nov 9, 2026Kernel-Level Packet Sniffing with eBPF/XDP: Real-Time Credential Extraction and Exposure Auditing
How eBPF and XDP bypass userspace packet-capture bottlenecks to intercept authentication handshakes, NetNTLMv2 hashes, and cleartext credentials at line rate: architecture, protocol dissectors, and exposure auditing with driftnet2.
8 min read ↗AI Security · Nov 9, 2026Breaking AI Agent Boundaries: From Prompt Injection to Remote Code Execution via Model Context Protocol (MCP)
How untrusted context in modern AI pipelines forces autonomous agents to execute arbitrary operating system commands through Model Context Protocol (MCP) server tools: indirect injection, ambient authority, and deterministic execution brokers.
14 min read ↗Pentest · Nov 6, 2026DNSAdmins and Backup Operators: Privileged Group Abuse to SYSTEM on the DC
The last two GOAD techniques are not exploits but groups: DNSAdmins loads a DLL into the DNS service, Backup Operators reads what the OS would rather hide. One is demonstrated end to end, one is documented honestly with the remote-registry wrinkle, and the relay gap that neither covers is called out.
6 min read ↗Pentest · Nov 6, 2026Skeleton Key: A Master Password for Every Account in the Domain
After Domain Admin, the game changes from getting in to staying in. The Skeleton Key patches the Domain Controller's KDC in memory so the single password 'mimikatz' unlocks every account — demonstrated live against KINGSLANDING, alongside the memory SSP and why DSRM does not apply in this lab.
7 min read ↗Pentest · Nov 6, 2026Offline Domain Dump: Shadow Copies and NTDS.dit
DCSync is the online way to pull hashes — but it needs replication rights. The offline way asks for nothing from the DC: take a shadow copy of C:, copy the NTDS.dit database and SYSTEM hive out, and dump every credential on your own machine with no Domain Controller cooperation.
4 min read ↗Pentest · Nov 6, 2026Forging Kerberos Tickets: Golden and Silver Tickets in GOAD
DCSync handed us the krbtgt hashes and service-account hashes. This is what they are actually for: forging a Golden Ticket for the whole forest, and a Silver Ticket for one SPN — logging in as Administrator without a password, and why the two differ.
5 min read ↗Pentest · Nov 5, 2026Cross-Forest Pivoting via SQL Server Linked Servers: Bypassing Kerberos Trust Boundaries
Deconstructing SQL Server linked-server lateral movement in GOAD: from a cracked service account (jon.snow) to xp_cmdshell execution as north\sql_svc, pivoting through sa-mapped linked servers into essos\sql_svc without Kerberos trust authentication.
8 min read ↗Pentest · Nov 5, 2026AD CS Part 4: The Rest of the Catalog and How to Lock It Down
Closing the AD CS series: ESC2's any-purpose EKU, ESC3's enrollment-agent escalation, the identity-mapping weaknesses of ESC9, and the relay-based ESC8/ESC11 — then the four-question hardening checklist that ties the whole taxonomy back together.
5 min read ↗Pentest · Nov 5, 2026AD CS Part 3: ESC4 and ESC6 — Creating the Vulnerability Yourself
Part 2 exploited ESC1, a template that was already vulnerable. This part creates the vulnerability: ESC4 edits a template you have GenericAll over into an ESC1, and ESC6 abuses the CA-wide User Specified SAN flag to stuff a Subject Alternative Name into any Client Authentication template.
5 min read ↗Pentest · Nov 5, 2026AD CS Part 2: ESC1 Exploitation: RPC Targeting, PKINIT Authentication, and Forest Compromise
Weaponizing the ESC1 certificate template on ESSOS-CA: MS-WCCE RPC endpoint resolution, PKINIT Kerberos TGT issuance via weak UPN mapping, and full forest takeover using DRSUAPI DCSync.
8 min read ↗Pentest · Nov 5, 2026AD CS Part 1: Architecture, Template Semantics, and the ESC Taxonomy
Deconstructing the Active Directory Certificate Services attack surface: template attributes, PKINIT credential exchange, EKU semantics, identity mapping, and the ESC taxonomy mapped by root cause.
13 min read ↗Pentest · Nov 4, 2026Pass-the-Hash and Overpass-the-Hash: Moving with Hashes, Not Passwords
DCSync left us holding NTLM hashes but no passwords. Pass-the-hash feeds the raw hash straight into NTLM; overpass-the-hash turns that same hash into a Kerberos TGT. Both log in as Administrator without ever cracking anything — and they answer two different problems.
5 min read ↗Pentest · Nov 4, 2026Force-Set SPN: Targeted Kerberoasting with GenericWrite
Kerberoasting normally waits for a service account to already have an SPN. With GenericWrite over a user you can add the SPN yourself and Kerberoast them on demand — turning any weak-password user you can write to into a crackable target.
4 min read ↗Pentest · Nov 4, 2026GOAD Part 4: Owning essos.local Across the Forest Trust
The forest trust into essos.local enforces SID filtering, so a forged ExtraSids ticket will not carry Domain Admin across the boundary. What does cross is foreign group nesting, a three-hop ACL chain, LAPS, and an AD CS CA full of ESC templates.
18 min read ↗Pentest · Nov 4, 2026GOAD Part 3: Walking the ACL Chain to the Forest Root
Eight misconfigured ACLs stand between a single recovered password and Domain Admin on the sevenkingdoms.local forest root. Each edge is a different right and forces a different technique. This is every hop, every tool, and the two places it tried to fail.
18 min read ↗Pentest · Nov 3, 2026Password Spraying: One Password, Every Account
The lockout-aware credential attack: one common password tried across every account in the domain, respecting the lockout threshold so nothing trips. GOAD's north domain shows the whole dance — from reading the password policy to the one account that reused Winter2022.
4 min read ↗Pentest · Nov 3, 2026GOAD Part 2: Owning the NORTH Domain Controller
Moving from a low-privileged user account to Domain Admin on DC02 in north.sevenkingdoms.local: Kerberoasting a service account, abusing constrained delegation with S4U2Self and S4U2Proxy, and injecting a SYSTEM scheduled task through a writable GPO.
14 min read ↗Architecture · Nov 3, 2026Active Directory as a Directed Graph: How Security Descriptors and Object ACLs Actually Work
Active Directory stores every user, group, computer, and GPO as an LDAP object with a binary nTSecurityDescriptor. Walking the eight-hop escalation chain in GOAD's sevenkingdoms.local domain shows how ACE masks, Extended Rights GUIDs, and ownership changes turn helpdesk permissions into Domain Controller compromise.
13 min read ↗Architecture · Nov 3, 2026Inside Kerberos Delegation: Why Multi-Tier Windows Apps Need It (and Why It Breaks)
Walking through the Kerberos double-hop problem and the three generations of delegation in Windows: how Unconstrained, Constrained (S4U2Self / S4U2Proxy), and Resource-Based Constrained Delegation (RBCD) look in LDAP across the GOAD lab.
12 min read ↗Pentest · Nov 2, 2026GOAD Part 1: From Zero Credentials to the Attack Graph
Walking through the GOAD Active Directory lab from a single Kali host: zero-knowledge host discovery, SMB signing checks, forest and trust mapping, unauthenticated user enumeration, AS-REP Roasting, SMB/SYSVOL secret hunting, and BloodHound graph analysis.
17 min read ↗Architecture · Nov 2, 2026Multi-Forest Active Directory Architecture: How Forests, Trusts, DNS, and Tiered Services Actually Work
Looking at the five-server GOAD environment from the systems side before running an exploit: why organizations split forests and child domains, how directory partitions replicate, how DNS forwarders and Trusted Domain Objects route cross-forest authentication, and where normal Windows features turn into attack paths.
16 min read ↗Architecture · Nov 2, 2026Building the GOAD Lab: A Two-Forest Active Directory on a Laptop
The foundation post for the whole series: how a two-forest, three-domain Active Directory lab is provisioned from bare metal on a ThinkPad, what Vagrant and Ansible actually do, the VMware quirks that had to be patched, and how the lab is started, snapshotted, and reached from Kali.
8 min read ↗