This case study traces how PKI trust, cross-forest ACL inheritance, gMSA credential scope, JEA artifact hygiene, and service account privilege design each failed independently before failing together.

enumkit is an interactive bash script that runs a structured nmap, web, and SMB enumeration workflow against a target and prints a parsed findings summary on screen when complete. Designed to work standalone or alongside an engagekit workspace.

Direct Send is a Microsoft 365 feature designed to let printers send email. It also lets anyone on the internet impersonate your users, bypass your MX security gateway, and land in the inbox all without credentials, a CVE, or a compromised account. And it's enabled by default.

CVE-2026-22719 fits a pattern that's been building for years. Your management plane is the attack surface now.

Russian intelligence isn't breaking Signal's encryption. They're breaking the humans who trust it by exploiting one assumption: that encrypted means secure

A walkthrough of WingData from HackTheBox Season 10 — an Easy Linux machine covering unauthenticated RCE, credential harvesting, and privilege escalation via a modern tarfile filter bypass.

Penetration test report for HTB Facts. Full-chain root compromise via Camaleon CMS mass assignment (CVE-2024-46987), exposed MinIO credentials, SSH key cracking, and sudo facter misconfiguration.

engagekit is a cross-platform Python script that builds a structured pentest engagement workspace in seconds — pre-populated markdown templates, organised scan folders, a loot tracker, and a timestamped evidence capture helper, all named and dated for the engagement automatically.

Full-chain compromise of HTB Curling via exposed Base64 credentials, Joomla template RCE, credential backup decoding, and privileged curl automation abuse to achieve root.

Penetration test report for HTB Curling. Critical findings include Joomla template RCE and privileged automation abuse enabling full root compromise from an unauthenticated position.