A tour of the AWS privilege escalation techniques modelled by PMapper and awspx, where each of them falls short, and how I rebuilt Snotra's shadow administrator detection to cover everything they do - and a good deal they do not.
Finding more vulnerabilities in Bitcoin Miners
How Entra ID App Registrations / Enterprise Applications are commonly misconfigured and can be used by attackers to elevate privileges, access sensitive information and move laterally across Azure tenancies.
Using CSRF Attack to update the Payout Address on BitAxe Bitcoin Miners
Labs to learn penetration testing and offensive security
Penetration test reports, aggregating findings and thinking more deeply.
AWS and overly permissive GitHub OIDC cross-account role trust policies
How to own an internal domain and pivot into the cloud