Cloud Asset Discovery in AWS, GCP, and Azure Environments
Identity and trust chains, not IP addresses, reveal cloud attack paths.
Deja Okonkwo
Breach Authority — Page 3
Writing Audit-Ready Penetration Test Findings
Auditors trace findings through a chain of proof, exploit, and fix confirmation.
Marcus Yuen-Castillo
Cloud Privilege Escalation Paths in AWS IAM
Web app tests miss the IAM privilege escalation chains that actually compromise AWS.
Soren Halvardsen
Lateral Movement From Compromised SaaS Service Accounts
Stolen API tokens let attackers hop between SaaS apps undetected.
Marcus Yuen-Castillo
Demonstrating Business Impact Through Data Exfiltration Proof
Shows what attackers could actually steal from your systems, not just theoretical vulnerabilities.
Marcus Yuen-Castillo
DOM-Based XSS Exploitation and Payload Delivery
Server-side defenses miss DOM-based XSS because the attack never leaves the browser.
Deja Okonkwo
XXE Injection Against Modern XML Parsers
Default XML parsers enable dangerous entity resolution without developers realizing the risk.
Soren Halvardsen
Prototype Pollution to Remote Code Execution in Node.js
A flaw in how JavaScript handles object inheritance can let attackers execute arbitrary code.
Soren Halvardsen
Multi-Tenant Data Isolation Bypass in SaaS Applications
A single architectural flaw in multi-tenant systems can expose every customer's data at once.
Soren Halvardsen
Hardcoded Secret Extraction and Exploit Chaining
Stolen credentials open the door, but the exploit chain determines how far an attacker travels.
Marcus Yuen-Castillo
SQL Injection in ORM-Backed SaaS Endpoints
Modern ORMs don't eliminate SQL injection—developers do when they bypass protections.
Soren Halvardsen
Insecure Deserialization Exploits in Java Spring Applications
Gadget chains in Spring deserialization turn untrusted bytes into remote code execution.
Priya Nambiar