Indigo Shadow

Exploiting Resource-Based Constrained Delegation (RBCD)

In this article, we will examine what Resource-Based Constrained Delegation (RBCD) is, and how it can be exploited to achieve a full…

Linux Docker Container Escapes Cheatsheet

What are some common Docker container escape techniques? How do they work? After spending some time researching on this topic, I’ve…

BadSuccessor — Exploiting delegated Managed Service Accounts in Windows Server 2025

Understanding what is delegated Managed Service Accounts in Windows Server 2025, and how an unpatched system may be exploited for Privilege…

Tryhackme Walkthough: Voyage

Sometimes in a pentest, you get root access very quickly. But is it the real root or just a container? The voyage might still be going on.

How Kerberos Authentication in Active Directory Works — A Hacker’s POV

A user (Bob) is trying to connect to services in a Windows AD domain, which is guarded by the Key Distribution Centre (Gatekeeper). How…

Docker Container Escape and Privilege Escalation with CAP_SYS_MODULE

What is cap_sys_module capability? How can it be abused for escaping a docker container?

Windows Security Tokens (Part 3) — User Access Control

In my previous articles on Windows Security Tokens (Part 1 and Part 2), we explored what are tokens (Primary vs Impersonation), how Groups…

Understanding React2Shell (CVE-2025–55182)

The Critical RCE in React Server Components

Port Forwarding using SSH and when to use local / remote / dynamic forwarding

Tryhackme Walkthrough — Operation Endgame

#ActiveDirectory #DomainController #Bloodhound #ResourceBasedContrainedDelegation #GenericWriteExploit #TargetedKerberoasting #BloodyAD

Docker Container Escape by Exploiting Shared Namespaces

What are namespaces? How can we exploit shared namespaces to escape from a docker container?