Writing Audit-Ready Penetration Test Findings
Auditors trace findings through a chain of proof, exploit, and fix confirmation.
Marcus Yuen-Castillo
Contributing Researcher
Marcus Yuen-Castillo
Marcus worked as a network penetration tester and malware analyst for a mid-sized managed security provider for nearly a decade before shifting his focus to writing long-form technical research. His pieces tend to examine post-compromise tradecraft and the overlap between automated exploitation tools and hands-on-keyboard techniques.
5 stories
Lateral Movement From Compromised SaaS Service Accounts
Stolen API tokens let attackers hop between SaaS apps undetected.
Marcus Yuen-Castillo
Demonstrating Business Impact Through Data Exfiltration Proof
Shows what attackers could actually steal from your systems, not just theoretical vulnerabilities.
Marcus Yuen-Castillo
Hardcoded Secret Extraction and Exploit Chaining
Stolen credentials open the door, but the exploit chain determines how far an attacker travels.
Marcus Yuen-Castillo
Chaining SSRF to AWS IMDSv1 Credential Theft
Attackers chain SSRF into AWS metadata endpoints to steal credentials in just three HTTP requests.
Marcus Yuen-Castillo