https://christbowel.com/Security Researcher — CVE author & bug hunter.https://christbowel.com/blog/torchserve-lpe/https://christbowel.com/blog/torchserve-lpe/Thu, 29 Oct 2026 00:00:00 GMTCVE-2026-123974: an attacker-controlled temporary directory can let a local user replace a model handler and execute code as the TorchServe service account.https://christbowel.com/blog/xss2shell/https://christbowel.com/blog/xss2shell/Sat, 08 Aug 2026 00:00:00 GMTA pre-auth reflected XSS in WordPress Core, patched in 7.0.3. Two sanitizers disagree about what a tag is, and a username walks through the gap. This is the breakdown: gdb on the PHP tokenizer, the real affected range (which every public writeup got wrong), the JS gadget the patch did not touch, and a detector.https://christbowel.com/blog/perspective-5-0-0-five-cves/https://christbowel.com/blog/perspective-5-0-0-five-cves/Thu, 30 Jul 2026 00:00:00 GMTFive vulnerabilities in the Perspective analytics engine, including an unsandboxed eval() in the query path and a stored XSS in the plugin that loads by default. Chained, they take an attacker from writing one row of data to command execution on the server host.https://christbowel.com/blog/wp2shell/https://christbowel.com/blog/wp2shell/Sat, 18 Jul 2026 00:00:00 GMTHow two one-line oversights chain into code execution on 500 million siteshttps://christbowel.com/blog/cve-2026-56111/https://christbowel.com/blog/cve-2026-56111/Wed, 24 Jun 2026 00:00:00 GMTHow three copies of one G-code command revealed an out-of-bounds write reachable from a single serial line, confirmed on a real STM32 target.https://christbowel.com/blog/dependency-track/https://christbowel.com/blog/dependency-track/Thu, 28 May 2026 00:00:00 GMTOWASP Dependency-Track ships a Portfolio ACL feature that promises multi-tenant isolation. Turns out it only blocks reads. A low-privileged user can suppress any vulnerability, rewrite triage decisions, poison audit trails, and inject rogue projects into another team's hierarchy. Here is how.https://christbowel.com/blog/ad-shadow-creds/https://christbowel.com/blog/ad-shadow-creds/Sat, 16 May 2026 00:00:00 GMTShadow Credentials abuse msDS-KeyCredentialLink to authenticate as any user via PKINIT without touching their password. No reset, no ticket forging, no detection by most SOCs.https://christbowel.com/blog/adcs/https://christbowel.com/blog/adcs/Sat, 16 May 2026 00:00:00 GMTESC1 gets all the attention. The real kills happen through ESC9, ESC14, ESC15 and ESC16. These are the ADCS escalation paths that bypass modern hardening, abuse certificate mapping logic, and work even after KB5014754. Full chains, tooling, detection.https://christbowel.com/blog/c2-infrastructure/https://christbowel.com/blog/c2-infrastructure/Sat, 16 May 2026 00:00:00 GMTYour Cobalt Strike beacon gets flagged in 30 seconds because your infrastructure is trash. This covers redirector chains, domain fronting alternatives, malleable C2 profiles, and the operational security that separates a red team from a pentest.https://christbowel.com/blog/copy-fail/https://christbowel.com/blog/copy-fail/Sat, 16 May 2026 00:00:00 GMTThree kernel privilege escalation vulnerabilities in two weeks. All abuse page-cache corruption to overwrite read-only files in memory. No race condition required. Reliable root on every major distro. This is the technical breakdown and how to patch before you get hit.https://christbowel.com/blog/edr-evasion/https://christbowel.com/blog/edr-evasion/Sat, 16 May 2026 00:00:00 GMTEvery EDR hooks ntdll. Every EDR monitors ETW. Every EDR scans AMSI. This covers the techniques to bypass all three: direct/indirect syscalls, manual unhooking, ETW patching, AMSI manipulation, and the execution patterns that keep your implant alive.https://christbowel.com/blog/ip-to-system/https://christbowel.com/blog/ip-to-system/Sat, 16 May 2026 00:00:00 GMTYou have an IP. You need SYSTEM. This is the decision tree: what to check, what each misconfiguration gives you, where to go next. From network enumeration to domain compromise, every fork is covered.https://christbowel.com/blog/lateral-persistance/https://christbowel.com/blog/lateral-persistance/Sat, 16 May 2026 00:00:00 GMTPsExec gets caught. WMI gets logged. RDP gets recorded. This covers the lateral movement techniques that APT groups actually use in long-duration operations: DCOM abuse, WinRM certificate auth, token manipulation, and persistence mechanisms that survive reimaging.https://christbowel.com/blog/sapphire/https://christbowel.com/blog/sapphire/Sat, 16 May 2026 00:00:00 GMTGolden Tickets get caught. Silver Tickets have limitations. Diamond and Sapphire Tickets modify legitimate TGTs issued by the KDC, making them nearly invisible. Combined with DACL abuse chains, this is the current state of the art in AD persistence and escalation.https://christbowel.com/blog/cloud-pentest/https://christbowel.com/blog/cloud-pentest/Sun, 10 May 2026 00:00:00 GMTCloud security isn't 'someone else's problem.' Misconfigured IAM, exposed metadata, overprivileged service accounts. This is the decision tree for compromising AWS, Azure, and GCP environments: from initial access to data exfiltration.https://christbowel.com/blog/wifi-hacking/https://christbowel.com/blog/wifi-hacking/Wed, 06 May 2026 00:00:00 GMTThe complete methodology for auditing wireless networks. From WEP to WPA3, from WPS bruteforce to PMKID capture, from deauth to evil twin. Every protocol, every attack vector, every terminal output. The guide I wish existed when I started.https://christbowel.com/blog/adb-over-the-internet/https://christbowel.com/blog/adb-over-the-internet/Tue, 05 May 2026 00:00:00 GMTAndroid Debug Bridge is a powerful developer tool. When left exposed on the internet, it becomes a root shell with zero authentication. This is the complete methodology: from recon to post-exploitation, and everything people forget to check.https://christbowel.com/blog/garak-red-team-llm/https://christbowel.com/blog/garak-red-team-llm/Tue, 05 May 2026 00:00:00 GMTgarak is the tool for scanning LLM vulnerabilities. Although the technique seems simple, it's not straightforward to use without drowning in noise. This article is a writeup of my deep dive into the project's internals.https://christbowel.com/blog/cve-202429643/https://christbowel.com/blog/cve-202429643/Wed, 11 Feb 2026 00:00:00 GMTHow a simple Host header manipulation poisoned Croogo's RSS feed and opened the door to phishing and domain spoofing.https://christbowel.com/blog/cve-2026-25050/https://christbowel.com/blog/cve-2026-25050/Fri, 06 Feb 2026 00:00:00 GMTA deep dive into a timing attack vulnerability I discovered in Vendure's NativeAuthenticationStrategy.https://christbowel.com/blog/kerberoasting/https://christbowel.com/blog/kerberoasting/Sat, 06 Sep 2025 00:00:00 GMTUnderstanding the mechanics of Kerberos tickets and how attackers crack service account passwords offline.https://christbowel.com/blog/blue-teamer/https://christbowel.com/blog/blue-teamer/Sat, 23 Aug 2025 00:00:00 GMTUne collection massive de 60+ outils et ressources pour la défense, le monitoring et la réponse aux incidents (Blue Teaming).https://christbowel.com/blog/red-teamer/https://christbowel.com/blog/red-teamer/Fri, 22 Aug 2025 00:00:00 GMTAnalyse des techniques d'intrusion et de post-exploitation en environnement sécurisé.