Pentesting & Recon

Pentest Android apps through APK decompiling, Frida hooks and component checks

Plan red team exercises that emulate known APT groups using MITRE ATT&CK

Attack ArgoCD through Redis cache poisoning, SSO bypass and rogue applications

Run AWS penetration tests from unauthenticated enumeration through privilege escalation

Handle AWS post-exploitation: data theft, cross-account movement and persistence

Test Azure AD and Entra ID for spraying, token theft and access policy bypass

Move from Azure and Entra ID into on-prem Active Directory through hybrid identity

Run Azure penetration tests from unauthenticated enumeration to Entra ID attacks

Collect Active Directory data with BloodHound.py to map domain attack paths

Find which YARA or Sigma rules flag a C2 implant and adjust its source

Poison web caches and smuggle HTTP requests through CDNs and reverse proxies

Identify and bypass image, click and slider captchas on login and reset forms

Generate targeted password wordlists from a person's details with ccupp

Assess Docker and Kubernetes containers for escape paths with the CDK toolkit

Run Cobalt Strike team operations with listeners, beacons and Malleable C2 profiles

Test Concourse CI instances for exposed pipelines, secrets and job tampering

Identify session cookie types and forge unsigned or Flask-signed cookies

Test chain-of-thought injection attacks against multi-step reasoning agents

Spray and reuse collected credentials across hosts while avoiding account lockouts

Chain web and AI vulnerabilities into two-way attack paths during a pentest

Exploit padding oracles, CBC bit-flips and weak random tokens in web apps

Solve CTF challenges on adversarial examples, model extraction and LLM jailbreaks

Break RSA, AES, ECC and other cryptographic weaknesses in CTF challenges

Search files, databases and environment variables to locate CTF flags

Verify a suspected CTF flag string before submitting to avoid encoding errors

Analyze disk images, memory dumps and pcaps in CTF forensics challenges

Solve miscellaneous CTF challenges like sandbox escapes, encodings and Z3 puzzles

Trace identities, photos and archived pages for open-source intelligence CTF clues

Build ROP chains and heap exploits for binary challenges with pwntools

Classify an unknown CTF challenge and route it to the right solving method

Find deliberately planted sinks and trace inputs to them in CTF source code

Plan attacks on CTF web challenges by classifying the type and choosing a path

Quickly find entry points in CTF web targets through leaks, backups and hidden paths

Pivot between databases with dblink, linked servers and SSRF into internal networks

Attack exposed Redis, MSSQL, PostgreSQL, MySQL and MongoDB services

Brute force hidden directories, backup files and admin paths with dirsearch

Enumerate DNS servers on port 53 for zone transfers, subdomains and tunnels

Resolve DNS records in bulk and filter wildcard results with dnsx

Test Docker daemons, registries and containers for escapes and exposed secrets

Keep penetration tests efficient by avoiding blind brute force and stalled scans

Exploit unauthenticated Elasticsearch clusters for index data and script RCE

Search GitHub for new evasion and loader techniques and log them to a database

Integrate API obfuscation, string encryption and syscall tricks into an existing loader

Attack Microsoft Exchange with ProxyLogon, ProxyShell and OWA password spraying

Fuzz paths, parameters, vhosts and POST data with ffuf in multiple positions

Identify services and protocols on open ports with fingerprintx JSON output

Scan internal networks for hosts, ports, weak passwords and POCs with fscan

Test FTP servers for anonymous login, traversal, weak credentials and bounce attacks

Collect historical URLs and hidden endpoints from Wayback, Common Crawl and OTX