Offensive security · field notes
Everything is
broken.
These are the notes.
Web applications, APIs, cloud and Active Directory. CVE breakdowns, proof-of-concept write-ups, and tools built because the thing I needed did not exist. Written down while it is still fresh.
Start readingTracking
Vulnerabilities worth your time
All entries- CVE-2024-309410.0critical
Backdoor in xz-utils liblzma
A multi-year social engineering campaign planted a backdoor in the xz release tarballs, hooking sshd via liblzma.
xz-utils
- CVE-2023-4966 Exploited9.4critical
CitrixBleed: session token leak in NetScaler ADC
An unauthenticated buffer over-read leaks session tokens from memory, allowing MFA to be bypassed by replaying a hijacked session.
Citrix PoC
- CVE-2022-22965 Exploited9.8critical
Spring4Shell: RCE in Spring Framework
Data binding in Spring MVC on JDK 9+ could be abused to reach class-loader properties and write a web shell, giving remote code execution.
VMware PoC
Writing
Working notes
All posts-
What three years in a SOC taught me about breaking in
Detection engineering makes you a better attacker. The alerts you used to triage are the ones you now have to think around.
socred-teamcareer
-
Authorization testing in GraphQL, beyond the introspection dump
Introspection tells you the schema. It tells you nothing about who is allowed to call what — and that is where the bugs are.
graphqlapiauthz
-
Kerberoasting notes: what still works and what got loud
Service ticket requests are cheap. Getting them past a tuned detection stack is the part worth writing down.
active-directorykerberosopsec
Salvage