← Feed

Posts

• View post

  MFA doesn't stop device code phishing. The victim completes the MFA challenge on behalf of the attacker. What the attacker gets: a 90-day refresh token that silently pivots to mail, Teams, SharePoint, and Azure management APIs. Storm-2372 ran this against governments and defense contractors for months before it went mainstream. Issue 52 covers the RFC 8628 mechanics, the attack flow, TokenTacticsV2 commands, and Conditional Access blocking: https://www.kayssel.com/newsletter/issue-52/ #i...

• View post

  On-prem AD foothold to Entra ID Global Admin: SyncJacking abuses Entra Connect hard match sync to hijack any cloud identity including Global Administrator. This issue covers MSOL credential extraction, PTA agent backdooring with PTASpy, the sync API abuse paths that survive Microsoft's patching, and AzureHound/ROADtools for attack path mapping. https://www.kayssel.com/newsletter/issue-53/ #InfoSec #CyberSecurity #pentesting #bugBounty #OffSec #ActiveDirector #EntraID

• View post

  Enterprise SSO with SAML: one XML signature wrapping attack = access to every app in scope. This week I broke down XSW variants, void canonicalization bypass, NameID comment injection, and attribute-based escalation. Five quick checks that cover most real-world SAML bugs, all automatable with SAMLRaider. https://www.kayssel.com/newsletter/issue-54/ #InfoSec #CyberSecurity #Pentesting #BugBounty #OffSec #SAMl #SSo

• View post

  eBPF rootkits: uprobe on libpam.so = cleartext creds from every sudo/ssh/VPN with zero binary modification. XDP at the NIC driver = full firewall bypass before iptables processes the packet. BPFDoor in production against telecoms since 2021. ShadowGuard hit 70+ orgs in 37 countries in Feb 2026. https://www.kayssel.com/newsletter/issue-55/ #infoSec #cyberSecurity #Pentesting #BugBounty #Offsec #Linux #ebpf

• View post

  Most supply chain attacks need no vulnerability. They abuse how package managers resolve names and run install scripts. This issue covers dependency confusion (hit Apple and Microsoft), typosquatting, install-script RCE, maintainer account takeover (event-stream, ctx, aiocpa), and Shai-Hulud, the self-replicating npm worm that steals cloud creds and, in v2.0, wipes your home directory. https://www.kayssel.com/newsletter/issue-60/ #InfoSec #CyberSecurity #Pentesting #BugBounty #DevSecOps #SupplyC...

• View post

  The buffer overflow was supposed to be dead. It just evolved. This issue walks the full escalation: classic stack smashing, ret2libc to survive NX, ROP chains that turn the stack into a Turing-complete program, leaking the stack canary, and the puts/GOT libc leak that unravels ASLR. Every mitigation adds a stage instead of a wall, and one memory leak is the master key to most of them. https://www.kayssel.com/newsletter/issue-63/ #InfoSec #CyberSecurity #BinaryExploitation #Pentesting #CTF #pwn

• View post

  Mass assignment lives in the gap between the form the user sees and the object the server saves. The framework binds your whole request body to the user model. So you add "role":"admin" to a normal profile update, and the server writes it. This gave Egor Homakov commit access to rails/rails on GitHub in 2012. Every write endpoint is a candidate: enumerate what the object holds, not what the UI shows. https://www.kayssel.com/newsletter/issue-64/ #InfoSec #Cy...

• View post

  SQL injection is not one payload, it's a spectrum of readout channels over the same primitive. Output on the page? UNION. No output? Boolean blind with binary search. Identical responses? Time-based. No channel at all? Exfil over DNS. And a read-only SQLi is never the ceiling: INTO OUTFILE, xp_cmdshell, and COPY FROM PROGRAM turn a query into a shell. MOVEit was one unauthenticated SQLi that became mass RCE. https://www.kayssel.com/newsletter/issue-65/ #InfoSec #CyberSecurity #Pentest...

• View post

  Heap exploitation is metadata corruption, not data corruption. The stack gives you a return address. The heap gives you glibc's allocator, whose freelist pointers live inside the chunks you control. Overwrite a freed chunk's fd pointer and malloc hands you an arbitrary address. Version is everything: tcache (2.26), key check (2.29), safe-linking (2.32), hooks removed (2.34). Same bug, different difficulty on each. https://www.kayssel.com/newsletter/issue-66/ #InfoSec #CyberSec...

• View post

  XS-Leaks steal data the same-origin policy swears it protects. SOP hides response contents, not response behavior. This issue covers error-event oracles, frame counting via window.length, the single global socket pool that turns any browser into a stopwatch, and cache probing (terjanq leaked private Google emails this way). Blind injection, cross-origin, against a site you cannot read. https://www.kayssel.com/newsletter/issue-62/ #InfoSec #CyberSecurity #WebSecurity #BugBounty #AppSec #XSLeaks

• View post

  In an upgradeable proxy, the funds live in the proxy and the logic is swappable. Own the pointer, own everything. This issue covers delegatecall storage collisions (Audius), uninitialized implementations (Wormhole's other bug), UUPS selfdestruct bricking (Parity froze 513k ETH), and the 2025 mempool bots front-running initialize() on fresh proxies. Plus slither-check-upgradeability to catch it. https://www.kayssel.com/newsletter/issue-61/ #InfoSec #CyberSecurity #Web3 #SmartContracts #BugBou...

• View post

  Browser exploitation isn't web bugs. It's memory corruption across three processes. This issue walks the full chain: V8 JIT type confusion for arbitrary read/write, WebAssembly RWX pages to run shellcode, WebGPU/Dawn as the softer GPU-process target, and the renderer→GPU→broker sandbox escape that ends in --no-sandbox. https://www.kayssel.com/newsletter/issue-59/ #InfoSec #CyberSecurity #Pentesting #BugBounty #BinaryExploitation #WebGPU

• View post

  Cross-chain bridges lost ~2B USD in 2022 alone. Every major hack lived in the same place: the attestation layer that decides a deposit really happened. Ronin (stolen validator keys), Wormhole (forged guardian signature via unchecked account), Nomad (0x00 trusted root looted by hundreds), BNB Token Hub (forged IAVL Merkle proof). New issue breaks down all five. https://www.kayssel.com/newsletter/issue-58/ #InfoSec #CyberSecurity #Web3 #SmartContracts #BugBounty #DeFi

• View post

  Reentrancy forked Ethereum in 2016 ($60M DAO hack). It drained $52M from Curve in 2023 because Vyper 0.2.15-0.3.0 silently gave each @nonreentrant function its own independent lock. Cross-function reentrancy bypasses guards via shared state. Read-only reentrancy bypasses them via view function oracles. CEI is the foundation, guards are just backup. https://www.kayssel.com/newsletter/issue-57/ #InfoSec #CyberSecurity #Pentesting #BugBounty #OffSec #Web3 #Solidity

• View post

  Flash loans: borrow $500M with zero collateral, manipulate AMM spot price oracles, hijack governance votes in a single block, run MEV sandwich attacks via Flashbots bundles. The only cost is gas. Euler Finance lost $197M via a donated-reserve trick that manufactured fake insolvency and turned Euler's own liquidation engine against itself. https://www.kayssel.com/newsletter/issue-56/ #InfoSec #CyberSecurity #Pentesting #BugBounty #OffSec #Web3 #DeFi