$ cat blog/*.md | sort --by-date
Writeups, research, and notes on web pentesting, bug bounty hunting, and offensive security.
Password spraying is only useful if you don't lock out the accounts you're testing. Here's the lockout math every internal pentester should know — thresholds, observation windows, and safe spray cadence — and how I bake it into ADValidate.
Real incident response rarely happens on a host with your tools pre-installed. Here's why I built NightOwl-IR to run on stock PowerShell, what it collects in the first 15 minutes, and how mapping findings to MITRE ATT&CK speeds up triage.
I found hundreds of Braze-hosted one-click unsubscribe URLs publicly indexed on urlscan.io — with encrypted tokens fully intact. Braze closed it as Informative. Here's why that's the wrong call.
A practical breakdown of the OWASP Top 10 from a pentester's perspective — not just theory, but the exact techniques and tools I use to find these vulnerabilities on real engagements.
The exact recon workflow I use before touching a bug bounty target — subdomain enumeration, content discovery, fingerprinting, and building a complete attack surface map.
Beyond the basics — Burp Suite features and workflows that most pentesters overlook but that dramatically speed up finding vulnerabilities in real applications.