Pentesting & Recon

Run the cloud exploitation lane across IAM, S3, Kubernetes and metadata

Enumerate cloud buckets, metadata endpoints and IAM misconfigurations

Draft red team concept of operations with threat profiles and kill chains

Plan engagement contacts, escalation chains and blackout windows

Match container runtime CVEs such as runC Leaky Vessels to a fingerprinted target

Route container and Kubernetes attack paths from pod escape to build pipelines

Test cross-chain bridges for message validation, key compromise and replay flaws

Test DAO governance attacks like vote manipulation and time-lock bypass

Analyze MEV sandwich attack paths on Uniswap, Curve and Balancer swaps

Test CORS misconfigurations for reflected origins and credentialed data theft

Extract and capture credentials via LSASS, SAM, DPAPI and password spraying

Exploit web crypto flaws like padding oracles, bit-flipping and JWT alg confusion

Detect cipher types and auto-decode encoded data with Ciphey and CyberChef

Test CSRF defenses including tokens, SameSite gaps and JSON CSRF

Triage CTF challenges by category and plan multi-step solve chains

Fingerprint targets, find public CVE exploits and confirm RCE in tests

Profile Dark Caracal TTPs for authorized adversary emulation exercises

Plan evidence retention, encryption and chain of custody for test data

Dump krbtgt and user NT hashes by abusing DC replication rights

Test 802.11 deauthentication and PMF posture on wireless networks

Run and inspect authorized security engagements with the Decepticon CLI

Separate authorized engagement activity from real incidents with a deconfliction plan

Test endpoint defense evasion techniques in authorized red team engagements

Test dependency confusion exposure in build pipelines across public registries

Read and patch runtime memory on embedded Linux via /dev/mem and MTD devices

Test DNS rebinding to reach metadata and internal services past SSRF blocks

Escape to the host from containers with a mounted Docker or containerd socket

Test DOM clobbering to overwrite globals, bypass CSP and hijack lookups

Instrument iOS apps with Frida and Objection on jailbroken devices

Test routers, firewalls and VPN appliances for known CVE exploit chains

Route adversary emulation playbooks from actor choice to kill-chain phases

Profile Scattered Spider help-desk vishing and MFA takeover tradecraft

Profile Volt Typhoon living-off-the-land and pre-positioning tradecraft

Test EtherNet/IP and CIP devices for tag access and PLC mode exposure

Find Entra Conditional Access gaps and test legacy auth and break-glass misuse

Test Entra device-code phishing and illicit consent paths in authorized tenants

Enumerate Entra ID and M365 tenants for users, federation and MFA posture

Test Entra ID privilege escalation via app roles, service principals and hybrid sync

Test evil-twin access points with captive-portal capture on open and PSK networks

Build evilginx2 phishlets to test MFA resistance in authorized phishing tests

Exploit OS command injection with operators, blind detection and bypasses

Build deserialization RCE payloads with ysoserial, PHPGGC and pickle

Test IDOR flaws with ID enumeration and privilege escalation checks

Document exploitation findings, exploit chains and CVSS v4.0 scores

Apply evidence-led methods for exploit work and interpreting evidence

Test SSRF for internal service access, cloud metadata and port scanning

Test template injection in Jinja2, Twig, Freemarker, ERB and Razor for RCE

Test XXE for local file reads, blind exfiltration and SVG or Office uploads

Build multi-step exploit chains from validated bugs in authorized tests