section // posts46 notes8 research4 cvelast sync 2026-09-11
/posts

Write-ups

Field-tested pentest methodology, assessment paths, and practical security notes. Specific CVE analysis lives in Research.

01The Flow Is Standard. The Bypass Is in the Half You Skipped.Web02Android App Links: The Link Was Verified. The Action Was Not.Mobile03The Handshake Was Captured. The Network Was Not.Wireless04BloodHound Path Triage: The Shortest Path Is Usually the One That Expires FirstIdentity
Filter by focusShowing 24 entries
Grouped series9 collections · 31 notes
S01
Complete series

External Perimeter Intelligence

5/5 parts77 min total
  1. 01
    Pentest · 14 minThe External Perimeter Is a Graph. The Port List Is Only One View.1 diagram4 table
    ↗
  2. 02
    Pentest · 14 minThe Domain Resolved. Ownership Was Still a Hypothesis.2 diagram4 table
    ↗
  3. 03
    Pentest · 16 minThe Vendor Was Out of Scope. The Trust Boundary Was Not.2 diagram3 table
    ↗
  4. 04
    Pentest · 16 minThe Service Was Observed. The Application Was Still Unknown.2 diagram3 table
    ↗
  5. 05
    Pentest · 17 minThe Login Page Was Public. The Identity Boundary Was Somewhere Else.2 diagram4 table
    ↗
S02
Complete series

macOS Security Boundaries

4/4 parts53 min total
  1. 01
    Pentest · 20 minThe App Was Sandboxed. The XPC Boundary Still Needed Authorization.2 diagram3 evidence4 code5 table
    ↗
  2. 02
    Pentest · 11 minThe Permission Was Granted. The Data Use Still Needed a Policy.2 diagram1 code3 table
    ↗
  3. 03
    Pentest · 11 minThe Helper Was Registered. Its Lifetime Outlived the App.2 diagram1 code2 table
    ↗
  4. 04
    Pentest · 11 minThe Event Was Visible. The Detection Still Needed Context.2 diagram1 code2 table
    ↗
S03
Series in progress

iOS Security Boundaries

1/4 parts16 min total
  1. 01
    Pentest · 16 minThe Extension Was Sandboxed. The Shared Container Still Crossed the Boundary.2 diagram3 evidence2 code3 table
    ↗
S04
Complete series

ATM Security Assessment

5/5 parts68 min total
  1. 01
    Pentest · 15 minThe ATM Was Locked Down. The Transaction Path Was Not.1 diagram1 table
    ↗
  2. 02
    Pentest · 17 minThe BIOS Had a Password. The Boot Chain Still Needed Trust.1 diagram1 table
    ↗
  3. 03
    Pentest · 12 minThe Desktop Was Hidden. The Execution Boundary Was Not.1 diagram1 table
    ↗
  4. 04
    Pentest · 12 minThe Device API Was Standard. Authorization Was Assumed.1 diagram1 table
    ↗
  5. 05
    Pentest · 12 minOne ATM Was Contained. The Fleet Trust Path Was Not.1 diagram1 table
    ↗
S05
Complete series

Browser-to-Native Trust Boundaries

3/3 parts51 min total
  1. 01
    Vulnerability Research · 18 minThe Extension Was Sandboxed. The Native Host Was Not.2 diagram1 evidence7 code6 table
    ↗
  2. 02
    Vulnerability Research · 21 minThe Page Never Had Permission. The Extension Did.2 diagram1 evidence8 code8 table
    ↗
  3. 03
    Vulnerability Research · 12 minThe Package Was Signed. The Update Was Still a Security Decision.2 diagram1 evidence6 code5 table
    ↗
S06
Series in progress

Anatomy of a Red Team Operation

1/8 parts18 min total
  1. 01
    Pentest · 18 minThe Red Team Reached Domain Admin. The Exercise Still Failed.2 diagram7 code2 table
    ↗
S07
Complete series

When Access Checks Fail

3/3 parts25 min total
  1. 01
    Cloud Security · 8 minThe Pipeline Has No Secret. It Still Has a Cloud Identity.1 diagram2 code1 table
    ↗
  2. 02
    Web Security · 8 minThe Signature Is Valid. The Token Still Belongs Somewhere Else.1 diagram2 code1 table
    ↗
  3. 03
    Web Security · 9 minThe Request Stayed Server-Side. The Credential Did Not.1 diagram2 code1 table
    ↗
S08
Complete series

Testing the Ransomware Playbook

5/5 parts34 min total
  1. 01
    Pentest · 7 minThey Do Not Break In. They Log In.1 diagram2 code1 table
    ↗
  2. 02
    Pentest · 7 minEnumeration Cannot Be Prevented. Ask Whether It Was Seen.1 diagram2 code1 table
    ↗
  3. 03
    Pentest · 7 minAffiliates Do Not Find Novel Paths. They Find Yours.1 diagram1 code1 table
    ↗
  4. 04
    Pentest · 7 minThe Blast Radius Is One Number. Almost Nobody Has Measured It.1 diagram2 code1 table
    ↗
  5. 05
    Pentest · 6 minThe Last Two Steps Are Not in Scope. What Makes Them Survivable Is.1 diagram1 code1 table
    ↗
S09
Complete series

Internal Network Triage

4/4 parts30 min total
  1. 01
    Pentest · 7 minKerberoasting Triage: Most Service Tickets Are a Waste of Your Time1 diagram2 code1 table
    ↗
  2. 02
    Pentest · 7 minSMB Signing Is On. That Closed One Edge, Not the Graph.1 diagram2 code1 table
    ↗
  3. 03
    Pentest · 8 minDelegation Triage: You Were Taught the Rare One1 diagram3 code1 table
    ↗
  4. 04
    Pentest · 8 minBloodHound Path Triage: The Shortest Path Is Usually the One That Expires First1 diagram2 evidence3 code2 table
    ↗
Seven isolated privileged-service modules connected to a forensic peer-identity instrument, with one amber decoy identity separated from the kernel-bound verification chain.Casefile visual
Vulnerability Research01

Three False Alarms in a Privileged Helper Sweep

Seven third-party helpers run as root on this Mac. I checked whether each one authenticates the process talking to it, was wrong three times in a row, and found nothing. The interesting part is why each cheap method failed.

Aug 31, 20269 min read
1 diagram13 code blocks
A glass application container remains connected to a dark host through three red authority paths while a cyan control boundary cuts the paths.Casefile visual
Pentest02

The Container Was Non-Root. The Node Was Still One Mount Away.

A container security methodology that measures mounts, runtime authority, kernel controls, and workload identity instead of treating a non-root UID or a passing policy check as proof of isolation.

Aug 25, 202621 min read
2 diagrams4 code blocks3 tablesEvidence matrix
A dark code-analysis laboratory comparing one monolithic AI core with three specialist cores, all feeding a central evidence gate that emits a small set of verified red findings.Casefile visual
Pentest03

AI Vulnerability Discovery: One Frontier Model or Three Specialists?

A reproducible benchmark design for the decision security teams actually face: spend the same research budget on repeated runs of one strong model, or on a diverse model team—and count only vulnerabilities that survive root-cause review, reproduction, and a fixed-version negative control.

Aug 24, 202622 min read
4 diagrams1 code block5 tablesEvidence matrix
A cinematic glass policy broker stops fragmented red AI proposals and passes one narrow cyan capability toward an isolated worker chamber.Casefile visual
Pentest04

The Model Proposed the Action. The Broker Decided Whether It Could Exist.

A practical architecture for AI-assisted pentest execution: resolve scope outside the model, classify side effects, issue short-lived capabilities, deny high-impact authority, and preserve a decision record that can be independently verified.

Aug 23, 202616 min read
2 diagrams1 code block3 tablesEvidence matrix
Three dark Linux server chambers progress from exposed red paths through a score-driven middle state to a verified cyan hardened state.Casefile visual
Pentest05

The Hardening Score Went Up. The Attack Path Stayed Open.

A practical Linux hardening methodology that uses Lynis as a sensor, established baselines as context, and controlled retesting to prove which changes reduce attack paths without breaking the service.

Aug 22, 202618 min read
2 diagrams4 code blocks5 tablesEvidence matrix
An abstract AI core sends two red action paths toward a fragmenting cloud resource and a cascading enterprise directory, while a cyan policy gate stands between proposal and execution.Casefile visual
Pentest06

The Model Found the Vulnerability. The Tool Call Became the Incident.

A balanced operating model for AI-assisted pentesting: where models improve coverage and evidence work, where excessive agency turns a valid test into a destructive action, and how to keep cloud, shell, and Domain Admin authority outside the model.

Aug 21, 202618 min read
2 diagrams2 code blocks5 tablesEvidence matrix
A wireless signal and captured handshake remain separated from an identity gateway and a segmented internal network.Casefile visual
Pentest07

The Handshake Was Captured. The Network Was Not.

A Wi-Fi assessment methodology that separates radio visibility, network identity, authentication, client trust, and post-association access before calling a wireless test successful.

Aug 13, 202619 min read
Selected research3 diagrams2 evidence plates1 code block4 tablesEvidence matrix
A cinematic AI production pipeline with separate glass chambers for data, build systems, a model, storage, tools, and applications, crossed by cyan data flows and amber attack paths.Casefile visual
Pentest08

The Model Is Not the Target. The Pipeline Is.

A field methodology for using MITRE ATLAS without turning an AI assessment into matrix theatre: map the production system, follow authority into tools and data, test reachable attack paths, and label the evidence only after impact is proven.

Jul 9, 202618 min read
3 diagrams3 tablesEvidence matrix
A layered dark glass identity architecture where unsafe paths from workstations and servers are severed before reaching a protected control-plane core.Casefile visual
Pentest09

Active Directory Hardening Is a Sequence, Not a Score

A scanner score cannot tell you whether a helpdesk account can still reach Domain Admin. This is the order I use to turn AD hardening signals into broken attack paths, tested controls, and recoverable identity infrastructure.

Jun 18, 202631 min read
8 diagrams9 code blocks3 tablesEvidence matrix
Two layered software structures differ by one glowing component whose trail is traced backward into the mechanism.Casefile visual
Vulnerability Research10

The Patch Is a Disclosure. The Bug Is in the Delta.

Patch diffing turns the vendor's fix into a map to the vulnerability. The workflow is not 'find the bug' — it is 'find the change, read it backwards, and hunt the same class everywhere else.'

May 28, 20268 min read
1 diagram1 code block1 tableEvidence matrix
A forgotten certificate template connects through a press to an elevated amber path toward a central authority chamber.Casefile visual
Pentest11

AD CS ESC4: The Template Nobody Owned

How an ordinary AD CS permission becomes Domain Admin — and why ESC4 is the cause every ESC1 write-up skips.

Mar 12, 202621 min read
2 diagrams10 code blocks1 tableEvidence matrix
A verified external link enters a mobile application while an unsafe internal route reaches toward a protected account chamber.Casefile visual
Pentest12

Android App Links: The Link Was Verified. The Action Was Not.

A field methodology for Android App Links that separates domain ownership, route validation, application state, and server-side authorization before calling a deep link secure.

Feb 26, 202618 min read
Selected research3 diagrams2 evidence plates7 code blocks3 tablesEvidence matrix
Small glass permission bridges connect isolated cloud platforms into one continuous path toward a central authority.Casefile visual
Cloud Security13

Cloud IAM Privilege Escalation: Every Permission Is Individually Fine. The Chain Is Not.

CSPM and least-privilege tools grade each IAM policy on its own, and on its own nearly every policy passes. Cloud privilege escalation is a path across roles, accounts, and trust — and a scanner that cannot see the path cannot flag the risk.

Aug 14, 20259 min read
1 diagram2 code blocks1 tableEvidence matrix
A luminous authentication path passes through three glass verification gates and bends through three missing frames.Casefile visual
Web Security14

The Flow Is Standard. The Bypass Is in the Half You Skipped.

OAuth 2.0 and OIDC vulnerabilities are almost never in the specification. They are in the parts implementations leave out — state, PKCE, exact redirect matching, audience validation — and the flow runs perfectly while each omission sits there waiting.

May 29, 20259 min read
Selected research1 diagram2 evidence plates2 code blocks2 tablesEvidence matrix
One luminous route enters two transparent parsing machines and emerges as a curved path into a protected chamber.Casefile visual
Web Security15

The Path Your Proxy Blocks Is Not the Path Your App Runs

When authorisation and routing are done by different software, they parse the URL differently. The bypass is not in either component — it is in the order they run.

Jan 16, 20257 min read
1 diagram4 code blocks1 tableEvidence matrix
Also on Substack

Longer-form analysis, straight to your inbox.

I publish extended research and field notes on Substack alongside this site. Subscribe to get notified when new content drops.

Subscribe on SubstackRSS