Featured writeup
All writeups
//26 ENTRIES · REVIEWEDReproducing the AgentOS Auth Guard Gap
A local reproduction of CVE-2026-61426, showing why a start up guard built on three literal host strings leaves network exposed binds with no authentication in the chain at all.
READ WRITEUP →Identity and Access Management: Performed Is Not Applied
A companion on the three IAM principles, why a mechanism running is not the same as a principle holding, and what a replay attack exploits.
READ WRITEUP →JWT Security: Three Parts, One Control
A companion on token structure, why the algorithm must not come from the token, and why a correct signature never made the payload private.
READ WRITEUP →Bypass Disable Functions: When a Denylist Names the Wrong Thing
A companion on why a list of function names cannot describe a capability boundary, and why two stacked lists are not defence in depth.
READ WRITEUP →Snort: What a Signature Can and Cannot Express
A companion on rule anatomy, detection versus prevention, and why a signature that never fires is a statement about the rule and not about the traffic.
READ WRITEUP →IDOR: When the Caller Names the Object
A learning companion across the four forms of object reference and the three places they live, and why obfuscation is never an access decision.
READ WRITEUP →Anonymous: When Authentication Was Never Configured
A learning-first companion that separates a control configured off from one never configured, then follows the exposure through to privilege.
READ WRITEUP →File Inclusion: When a Path Becomes an Instruction
A learning-first companion that treats any filename parameter as an instruction, then separates the read case from the execute case.
READ WRITEUP →Authentication Bypass: Four Paths Into the Same Decision
A learning-first companion that treats authentication as a decision, then shows four ways to move that decision away from server-controlled state.
READ WRITEUP →RAG Security Fundamentals: The Retrieval Trust Boundary
A learning-first companion that shows why retrieval is the largest indirect attack surface in a RAG system, and what the embedding step cannot carry forward.
READ WRITEUP →Input Manipulation: Instructions Must Be Separated From Text
A learning-first companion that maps the five instruction layers reaching one model invocation, then tests prompt leakage, jailbreaks and direct and indirect injection as one trust-boundary problem.
READ WRITEUP →LLM Output Handling: Model Output as an Untrusted Boundary
A learning-first companion that flips the web security lesson: with LLM applications the model response is the new untrusted input, mapped across DOM, template, execution and log sinks.
READ WRITEUP →Polkit: D-Bus Authorisation Boundary
A learning-first companion that maps CVE-2021-3560 from package evidence and D-Bus identity handling to patch verification and local-account detection.
READ WRITEUP →Alfred: Jenkins Authority to System
A learning-first companion that maps a Jenkins control plane, job configuration authority, Windows process context and the controls that contain CI execution.
READ WRITEUP →Windows User Activity Analysis: Evidence to Timeline
A learning-first companion for preserving Windows activity artefacts, interpreting their limits and corroborating a defensible incident timeline.
READ WRITEUP →Couch: Data to Host Control
A learning-first companion that separates database authorisation, credential exposure, low-privilege context and a local container runtime boundary.
READ WRITEUP →Lame: Service Identity to Root
An evidence-led retired-machine companion on service inventory, CVE preconditions, Samba configuration and the service-to-shell trust boundary.
READ WRITEUP →The Agent That Went Rogue: Timeline to Impact
A learning-first companion for correlating synthetic agent traces, worker and proxy logs, Kubernetes audit records and cloud identity evidence without leaking room answers.
READ WRITEUP →Basic Pentesting: Evidence to Access
A learning-first companion that connects service inventory, development context, SMB identity evidence and SSH-key protection without publishing room answers.
READ WRITEUP →Skynet: Evidence to Root
A learning-first companion that follows anonymous SMB evidence through a password-reset boundary, unsafe PHP inclusion and a root tar backup review.
READ WRITEUP →Vulnversity: Upload Trust to Root
A learning-first companion that separates client hints, server validation, storage and execution, then audits a Linux setuid boundary without leaking room answers.
READ WRITEUP →Overpass: Session Trust to Root
A learning-first lab companion covering client-side session trust, source-code review, SSH evidence and a root cron job that trusts a writable name-resolution boundary.
READ WRITEUP →Kenobi: Service Trust to Root
A concept-first lab companion covering SMB evidence, ProFTPD mod_copy, NFS export boundaries, SSH-key handling and SUID PATH trust.
READ WRITEUP →Cap: IDOR to Linux Capabilities
A concept-first retired-machine companion covering record ownership, packet-capture hygiene, service authentication and an overpowered Linux interpreter.
READ WRITEUP →Ra: OSINT to Domain Admin
Original Active Directory field notes covering portal metadata, SMB evidence, forced NTLM authentication in the authorised lab, Account Operators, and a scheduled-task trust failure.
READ WRITEUP →Pickle Rick: Source Code to Root
Detailed commands, original attack-path diagrams, spoiler-controlled answers, findings, remediation, and the methodology that transfers beyond the room.
READ WRITEUP →