Tagmac Han

A complete attacker's guide to Windows credential access: LSASS internals and SSP architecture, DPAPI master key hierarchy, SAM and NTDS extraction, Credential Manager abuse, browser credential decryption (Chrome AES-GCM + DPAPI, Firefox NSS), and GPP credentials — with OPSEC ratings and detection guidance.

A deep technical dive into Kerberos 5 internals: TGT/TGS structure, PAC buffer breakdown, encryption type selection, AS exchange, S4U extensions, and how Golden/Diamond/Silver Tickets exploit these structures at the byte level — with Wireshark analysis and detection guidance.

How to use BloodHound Community Edition defensively: tier model implementation, attack path discovery and prioritization, custom Cypher queries for blue teams, remediation workflows, and continuous AD exposure management — based on SpecterOps Attack Path Management.

A deep-dive into every ADCS misconfiguration from ESC1 to ESC10: template flag analysis, certificate anatomy, NTLM relay chains, ManageCA abuse, and the ESC8+PetitPotam combo — with certipy walkthroughs and defenses based on SpecterOps 'Certified Pre-Owned'.

A complete attacker's methodology for Active Directory assessments: enumeration, Kerberoasting, AS-REP Roasting, ACL/attribute abuse, Shadow Credentials, ADCS ESC1-ESC8, delegation attacks, DCSync, ZeroLogon, noPac, PetitPotam, GPO abuse, trust attacks, and persistence — with commands, tools, and detection guidance.

Two sides of cache abuse — Web Cache Deception tricks a CDN into storing a victim's private page, while Web Cache Poisoning injects a malicious response served to every visitor. How cache-key vs origin parsing discrepancies create both, with real-world chains and defenses.

How a single Server-Side Request Forgery vulnerability can escalate to full AWS/GCP/Azure account compromise by targeting cloud instance metadata services — and why the 452% SSRF surge in 2024 matters.

How attackers exploit disagreements between front-end and back-end servers on where HTTP requests begin and end — and chain CL.TE desync attacks into account takeover, firewall bypass, and cache poisoning.

How attackers detect and exploit Server-Side Template Injection when the application returns no output — using timing delays, DNS callbacks, and engine fingerprinting to achieve full remote code execution.

How injecting properties into JavaScript's Object.prototype poisons the entire Node.js process — and how gadget chains turn that pollution into remote code execution, demonstrated via CVE-2024-38999 in RequireJS.