Stack Overflows to ROP: Beating NX, Canaries, ASLR
Overwriting the return address, ret2libc past NX, ROP gadget chains, leaking stack canaries, and defeating ASLR with a puts/GOT libc leak
Kayssel - Offensive Security Blog
Offensive Security Documentation by Ruben Santos Garcia
Latest posts
XS-Leaks: Turning the Browser Into a Side Channel
Same-origin policy defeated by observation: error-event oracles, frame counting via window.length, connection-pool timing, cache probing, and char-by-char XS-Search
Upgradeable Proxies: When the Upgrade Is the Attack
Delegatecall storage takeover, slot-0 storage collisions, uninitialized implementations, UUPS selfdestruct bricking (Parity/Wormhole), and initializer front-running
Supply Chain Attacks: Owning the Install Step
Dependency confusion, typosquatting on npm and PyPI, install-script code execution, maintainer account takeover, and the Shai-Hulud self-replicating npm worm
Breaking the Browser: WASM and WebGPU Exploitation
JIT type confusion in V8, WebAssembly RWX shellcode primitives, heap grooming with typed arrays, WebGPU/Dawn GPU-process bugs, and the multi-process sandbox escape chain
Cross-Chain Bridges: Minting Money From Nothing
Lock-and-mint trust models, validator key theft (Ronin), signature verification bypass (Wormhole), zero-root init bugs (Nomad), and Merkle proof forgery (BNB Token Hub)
Reentrancy: The Bug That Forked Ethereum
Classic single-function reentrancy, cross-function bypass of nonReentrant guards, read-only reentrancy via view oracles, ERC-777 token hooks, Vyper compiler bug, and Slither detection
Flash Loans: Borrowing Billions to Break DeFi
Flash loan anatomy via Aave V3, AMM spot price oracle manipulation, governance hijacking with borrowed tokens, MEV sandwich attacks via Flashbots, and the Euler Finance $197M exploit
Offensive eBPF: The Kernel as Your Backdoor
eBPF rootkit mechanics, PAM credential harvesting via uprobes, process and connection hiding via getdents64 hooks, XDP magic-packet backdoor, and nation-state deployments
SAML SSO Exploitation: Breaking the Trust Chain
XML signature wrapping variants, void canonicalization bypass, NameID comment injection, SAML attribute injection, and token replay against enterprise SSO
SyncJacking: On-Prem AD to Cloud Admin
Entra Connect hard-match hijacking, MSOL credential extraction, PTA agent backdoor, sync API abuse, and attack path mapping with AzureHound
Device Code Phishing: Stealing Tokens via Real Login
RFC 8628 device flow abuse, QR code social engineering, Storm-2372 token theft, TokenTacticsV2 commands, and Entra ID Conditional Access blocking
SCIM Exploitation: Hacking the Provisioning Layer
SCIM recon via ServiceProviderConfig, externalId collision for admin takeover, email hijacking via PATCH, unauthenticated endpoints, and group membership escalation
MCP Security: Poisoning the Tools Your AI Trusts
Tool poisoning via description fields, rug pull attacks, cross-server shadowing, RCE in MCP client tooling, and DVMCP practice lab
Prompt Injection: Hacking LLMs in 2026
Direct and indirect prompt injection, agent hijacking via tool abuse, system prompt leakage, RAG poisoning, and automated testing with garak
AWS Privilege Escalation: From Low-Priv Key to Admin
IAM policy attachment abuse, PassRole via Lambda for indirect escalation, EC2 instance profile exploitation, and PMapper for automatic path discovery
WebSocket Security: Hijacking, Injection, and Tunneling
Cross-site WebSocket hijacking, message-level XSS and SQLi, WebSocket smuggling for firewall bypass, and the toolset for interactive testing
GitHub Actions: Pipelines as Attack Surface
pull_request_target pwn requests, script injection via expressions, secrets exfiltration, poisoned pipeline execution, self-hosted runner persistence, and Gato-X
XSS: Reflected, Stored, DOM, and Blind
DOM source/sink model, stored XSS in rich-text editors, blind XSS against admin panels, framework pitfalls in React and Angular, and dalfox for scanning
DNS as a Weapon: Poisoning, Tunneling, and Rebinding
Kaminsky cache poisoning mechanics, SAD DNS side-channel attack, C2 over DNS with dnscat2, exfiltration techniques, and DNS rebinding to bypass Same-Origin Policy
OAuth 2.0: Six Ways the Authorization Flow Breaks
Missing state CSRF, redirect_uri hijacking, open redirect code theft, implicit flow token leakage, PKCE bypass, and SSRF via OpenID dynamic client registration
NoSQL Injection: Breaking MongoDB From the Inside
Operator injection, authentication bypass with $ne and $regex, blind boolean extraction, time-based $where detection, CouchDB default access, and automation tools
Redis and Memcached: When Cache Becomes a Foothold
Unauthenticated access, file-write RCE, module loading, SSRF via Gopher, CVE-2022-0543 Lua sandbox escape, and Memcached data extraction
Race Conditions: When Timing Is Everything
TOCTOU mechanics, limit overrun attacks, multi-endpoint races, and the single-packet technique that makes all of this consistently exploitable
WiFi Hacking 101: Wrapping Up the Series (Part 4)
PEAP relay attacks, ESSID stripping for WIDS bypass, and a complete wireless assessment checklist for enterprise engagements
WiFi Hacking 101: Exploiting Enterprise Networks (Part 3)
Breaking into 802.1X enterprise WiFi through credential capture, legacy method exploitation, and Pass-the-Hash attacks
WiFi Hacking 101: WPA/WPA2 Cracking, PMKID, and WPS (Part 2)
From 4-way handshake capture to offline cracking: WPA/WPA2 attacks, PMKID exploitation, WPS vulnerabilities, and what WPA3 actually protects against
Infrastructure Reconnaissance: Your First Steps in Network Pentesting
From nmap and nuclei to full infrastructure enumeration: a practical guide to discovering attack surface in bug bounty and pentesting
WiFi Hacking 101: Breaking Into Wireless Networks (Part 1)
A practical introduction to WiFi security testing covering the fundamentals, essential hardware, monitor mode, packet injection, and initial attack techniques
Deserialization Attacks: When Objects Become Weapons
From Java gadget chains to Python pickle exploits: a practical guide to exploiting insecure deserialization for remote code execution
Kubernetes for Pentesters: Breaking Orchestrated Infrastructure from Zero
From your first pod compromise to full cluster takeover: a practical introduction to Kubernetes security testing
Server-Side Template Injection (SSTI): Breaking Out of Templates
How attackers exploit template engines to achieve remote code execution by injecting malicious payloads into server-side templates
gRPC Security: Breaking the High-Performance RPC Protocol
A practical guide to gRPC security testing covering service enumeration, metadata exploitation, authentication bypass, and protobuf manipulation
LDAP Injection: Breaking Active Directory Authentication & Enumeration
A deep dive into LDAP injection exploitation, blind LDAP attacks, advanced AD enumeration via LDAP queries, and pass-back attacks against LDAP servers
iOS Security Testing: From IPA Analysis to Runtime Manipulation
A practical guide to iOS pentesting covering IPA decompilation, Frida hooking, certificate pinning bypass, and jailbreak detection circumvention
AWS for Pentesters: Your First Steps into Cloud Hacking
A beginner-friendly introduction to AWS security testing, from S3 buckets and metadata services to your first cloud foothold
Rust Security Code Review: When Memory Safety Isn't Enough
How to find vulnerabilities in Rust codebases despite the borrow checker, from unsafe blocks to logic bugs the compiler can't catch
HTTP Request Smuggling: The Art of Confusing Web Servers
How attackers exploit parsing discrepancies between frontend and backend servers to bypass security controls, poison caches, and hijack sessions
Meta-Transactions: Gasless UX and New Attack Vectors
Deep dive into meta-transaction architecture, EIP-2771 trusted forwarders, relayer patterns, and the security implications of gasless transaction execution in Ethereum.
File Upload Vulnerabilities: From Filter Bypass to Full System Compromise
How attackers turn innocent file uploads into webshells, arbitrary code execution, and complete server takeovers
Prototype Pollution: Hacking JavaScript From the Inside
How modifying Object.prototype can lead to RCE, XSS, and complete application compromise
Transaction Signatures vs Message Signatures: Understanding the Difference
Deep dive into RLP encoding, EIP-191 versioning, and the security differences between on-chain transaction signatures and off-chain message signatures in Ethereum.
Docker Escape: Breaking Out of Containers
From misconfigured containers to full host compromise: a practical guide to container breakout techniques
Understanding Ethereum Signatures - The Foundation of Web3 Security
Deep dive into Ethereum's cryptographic signature system, ECDSA, secp256k1, signature anatomy (r, s, v), and practical examples of signing, verifying, and securing Web3 authentication flows.
XXE Injection: When XML Parsers Become Your Worst Enemy
From basic file disclosure to blind out-of-band exfiltration: a practical guide to finding and exploiting XXE vulnerabilities
NTLM Relay: Why Authentication in AD is Still Broken
How to force machines to authenticate to you, relay their credentials, and take over domains
CSP for Pentesters: Understanding the Fundamentals
Understanding the basics and spotting weak configurations
Hardware Security Modules: The Fortress Guarding Blockchain's Crown Jewels
How exchanges and institutions actually protect billions in crypto assets
Predictable Contracts: Understanding CREATE and CREATE2 in Ethereum
How deterministic addresses unlock powerful features and subtle attack vectors auditors should never overlook.
The Day an Email Broke Single Sign-On
Exploiting weak email validation in OAuth2 SSO