Home

Posts

• Jun 23, 2026

  Reflection and Relay, Tested: NTLM, Kerberos, and the Limits of Patching

  CVE-2025-33073 brought authentication reflection back from the dead. It revived a bug class that had been considered solved since 2008, and for a few weeks in mid-2025 it was everywhere: a single malformed DNS record was enough to walk a domain-joined Windows box into handing over a SYSTEM shell, remotely, starting from a standard domain account. That part has been written about well already, and it has been patched for months.

  This post is not the news. It’s what I found when I sat down and tested the thing properly, long after the patch shipped, because the interesting question was never “does the exploit work.” It was “which defenses actually stop it, and which ones only look like they do.” So I built a small lab and ran the same attack against three versions of the same host: unpatched, fully patched, and properly hardened. Then I did it again over Kerberos instead of NTLM, and again as a cross-protocol relay to AD CS. The results are not symmetrical, and the gaps between them are the whole point. A few of my early assumptions did not survive contact with the lab, which I’ll flag as we go.

  What you get out of this: a clear picture of what reflection and relay are, how the 2025 bug works under the hood, and then the part I actually care about, side-by-side evidence of what patching buys you, what configuration buys you, and the places where one fixes nothing and the other is all that saves you.

  Read more →
• Jun 11, 2026

  Building a Linux Workstation for Azure and Entra ID Pentesting

  Most people meet Azure security through the portal. You click around, read some role assignments, maybe run a few az commands, and it can feel like the whole job lives in a browser tab. It doesn’t. The minute you move past clicking and start dealing with tokens, Graph calls, refresh flows, and scripted enumeration, you want a real workstation behind you.

  I came to cloud security from the on-prem side, where my comfort zone was Active Directory and network attacks. Standing up a proper Linux box for Azure and Entra work turned out to be one of the better moves I made in that transition, and not really for the reasons people usually list. So let me explain the reasons that actually held up, and then walk through what goes on the machine.

  One thing first: this is not Linux versus Microsoft tooling. Half of what I run on this box is Microsoft’s own PowerShell modules. Linux is the base I drive everything from, not a replacement for any of it.

  Read more →

subscribe via RSS