Results for “nonce-leakage”

Content Security Policy configuration, nonces, and reporting.

Set up NuGet trusted publishing (OIDC) on a GitHub Actions repo, replacing long-lived API keys with short-lived tokens.

Escalate from standard domain user to Domain Admin by exploiting the noPac vulnerability chain (CVE-2021-42278 sAMAccountName spoofing and CVE-2021-42287 KDC PAC confusion) in Active Directory environments.

Content Security Policy configuration, nonces, and reporting.

Exploit privileged pods, host mounts, runC CVEs, and exposed Docker sockets to break out of a container and reach the underlying host during authorized container-security assessments.

CI security scanning: secrets, deps, SAST, triage, expiring exceptions

Test LLM applications for system prompt leakage using manual payloads, garak, and Promptfoo to extract embedded secrets and routing logic.

Detect and exploit JavaScript prototype pollution vulnerabilities on both client-side and server-side applications to achieve XSS, RCE, and authentication bypass through property injection.

Exploit path normalization discrepancies between CDN caching layers and origin servers to cache and retrieve authenticated content.

Detect and exploit NoSQL injection vulnerabilities in MongoDB, CouchDB, and other NoSQL databases to demonstrate authentication bypass, data extraction, and unauthorized access risks.

Local-first secret scanning for repos and git history. Use before every push, when scanning for exposed keys, checking for committed credentials, or auditing a repo for accidental secret leaks. Designed for Nick's workflow and safer than forcing suspicious marketplace secret scanners.

Enumerate SMB, WinRM, LDAP, and MSSQL services, validate credentials, spray passwords, and execute commands on remote hosts using NetExec during authorized penetration tests.

Cross-repository dependency audit. Scans package manifests for outdated packages, security advisories, version conflicts, and license issues. Produces a prioritized update plan. Supports Node.js, Python, Rust, and Go projects.

Inspects and debugs OAuth 2.0 authorization flows including PKCE, client credentials, and device code grants, validating tokens, decoding claims, and tracing redirect chains.

Creates temporary encrypted one-time handoffs between autonomous agents, supporting mission briefs, scoped secrets, artifacts, and receipts via CLI or API.

Conduct authenticated and unauthenticated vulnerability scans using Tenable Nessus to identify known vulnerabilities, misconfigurations, and missing patches, with prioritized remediation guidance.

Audits codebases for leaked secrets and hardcoded credentials, generates .env templates, configures secrets management with AWS Secrets Manager, Vault, Doppler, or GCP Secret Manager, sets up credential rotation, and integrates secrets into CI/CD pipelines via OIDC federation.

Queries real-time vulnerability intelligence from NIST NVD, CISA KEV, EPSS, and MITRE ATT&CK via a remote MCP server, offering seven tools for CVE lookup, search, and trending analysis.

Analyze Zeek conn.log and NetFlow data to detect ransomware network indicators including C2 beaconing, TOR exit node connections, data exfiltration, and suspicious DNS patterns.

Exploit the Zerologon vulnerability (CVE-2020-1472) in the Netlogon Remote Protocol to achieve domain controller compromise by resetting the machine account password to empty.

Deep OAuth 2.0 / OpenID Connect security assessment. Covers the full attack surface: redirect_uri validation bypass (path traversal, open redirect chains, subdomain confusion, URL parsing tricks, parameter pollution, response mode switching), missing/broken state parameter CSRF, PKCE downgrade and absent-challenge attacks, implicit grant token leakage (Referer, browser history, XSS fragment theft), authorization code injection, scope escalation, client confusion attacks, mutable-claims account takeover (iss+sub confusion, email-keyed identity merging), pre-account takeover via unverified registration, OpenID Connect dynamic client registration SSRF (logo_uri, jwks_uri, sector_identifier_uri, request_uri), nonce replay, ID token validation failures, Device Code phishing flow, mobile custom URI scheme hijacking, refresh token persistence, token introspection enumeration, consent screen clickjacking, host header injection, and cross-IdP mix-up attacks. Uses KOAuth, jwt_tool, nuclei oauth templates, and manual ht