Endpoint first — and the history behind it
Every post is practitioner-tested: reproduced against a purpose-built lab, with the conditions, the logs, and the fix written down.
Endpoint
The current arc: the runtime, the worker process, and the detection gap around them. The arc ships one post at a time — nothing is listed here as published before it is.
| # | Working title | The angle | Status |
|---|---|---|---|
| 1 | The runtime is the host | A web-facing exploit is an endpoint problem: the interpreter, the worker process that executes it, and the EDR that never classed it as a host event. | in progress |
| 2 | The detection that should have fired | What endpoint detection should have caught and cannot reliably: the quiet HTTP 200, the “in Unknown on line 0” tell, the ASLR and error-display gap. | planned |
| 3 | From token to foothold | The bridge post: how a credential or identity flaw becomes an endpoint foothold — auth is the door, the endpoint is the room. | planned |
| 4 | What coverage should mean | The architect's view: detection coverage is measured but rarely attested. ATT&CK is the coordinate system; the signed statement on top of it is missing. | planned |
Access Control — history
The Identity-pillar archive: OAuth attack chains, reproducible against FlawedToken. Kept because it is the proof behind the endpoint work, not despite it.
The Gap Nobody Talks About: From "OAuth Is Attackable" to "Here's the Proof"
The series intro: why practitioner proof matters, and the reframe from auth flows to the full Zero Trust model.
2026-05-22OAuth Authorization Code Interception: The Flow, the Seam, and What Your Logs Actually Show
Authorization code interception end-to-end: what the attack looks like, where the seam is, and what it produces in logs. Reproducible against FlawedToken.
2026-07-11Redirect URI Manipulation: Stealing the Authorization Code at the Door
The redirect_uri is the load-bearing control in the OAuth authorization code flow, and it fails quietly. A red-team walkthrough.
2026-05-29The Local Lab Blueprint: Building an Isolated, Scriptable Interception Lab
A reproducible, containerized interception lab for auth-flow research — mitmproxy, Docker, and browser session containerization.