A FIELD GUIDE FOR CURIOUS MINDS
Understand the technique.
Mechanisms, practical methods, and the details that matter.
One connected reference for your next challenge.
Explore by category
FOLLOW THE ATTACK SURFACEWeb exploitation
Trust boundaries, parsers, and application attack surfaces.
Binary exploitation
Memory corruption, heap primitives, and browser engines.
Cryptography
Find the assumptions behind ciphers, protocols, and proofs.
Reverse engineering
Recover behavior from binaries, bytecode, and execution.
Forensics & steganography
Reconstruct evidence from files, memory, and hidden data.
Linux privilege escalation
Permissions, processes, namespaces, and local boundaries.
Windows & Active Directory
Identity, authentication, and Windows security internals.
Cloud & containers
Workloads, control planes, credentials, and isolation.
Networking & protocols
Packets, services, protocol state, and network analysis.
Tooling & methodology
Repeatable workflows for investigating unfamiliar systems.
GO BEYOND THE CHECKLIST
Advanced techniques
Transitive control of Entra application identities
Model credential authority and consent as typed graph edges rather than treating visible roles as effective privilege.
Recover reused DH exponents across groups
Combine independent small-subgroup residues while tracking generator order and the remaining exponent interval.
Integer polynomial shares leak the constant term
Distinguish integer arithmetic from finite-field secret sharing and measure residue leakage under query bounds.
Recover RSA factors from a leaked CRT exponent
Parse structured key fragments and use the small multiplier behind a reduced RSA exponent.
Recently revised
KEEP YOUR MENTAL MODEL CURRENTTransitive control of Entra application identities
Model credential authority and consent as typed graph edges rather than treating visible roles as effective privilege.
CI credentials and OIDC trust conditions
CI systems often exchange an OIDC token for cloud credentials.
Container images, layers, and deleted build-time secrets
Container images are layered filesystem snapshots plus configuration.
Cloud IAM policy evaluation and effective permissions
Cloud authorization combines identity policies, resource policies, organizational controls, permission boundaries, session policies, and service-specific conditions.
Cloud instance metadata and workload identity
Instance metadata can expose configuration and temporary credentials to software running on a workload.
Kubernetes RBAC and resource-specific authority
Kubernetes RBAC grants verbs over resources within a namespace or cluster.