← Blog // TAG

Red Team

5 articles

Red Team Nmap without fear: build the right scan Nmap has dozens of options, but a good scan comes down to six decisions: which hosts, which ports, how to probe them, h… Read → Red Team How a WAF gets bypassed (and why a blocklist is rarely enough) A blocklist WAF is a speed bump, not a wall: it chases strings, not semantics. The four classic bypasses (XSS without <… Read → Red Team JWT: the 3 flaws I see in every pentest A JWT is readable without a key (it is not encrypted). The three flaws that turn it into full compromise: alg:none, wea… Read → Red Team Subdomain takeover: how a forgotten CNAME ends up being yours You decommission a service but the CNAME keeps pointing at it; an attacker claims it and takes over your subdomain for … Read → Red Team Reverse shells: how to stabilize the TTY (from dumb shell to real terminal) You just caught a reverse shell and it is "dumb": no tab-completion, no history, Ctrl-C kills it. How to get a full TTY… Read →