001 The archive
Field Notes.
Technique breakdowns and disclosure notes drawn from active research - written up while the details still matter, and published only when it's responsible to do so.
[Outlook] How an attacker could modify your sent items!
In the world of business disputes, the "Sent Items" folder is often treated as the source of truth. We implicitly trust that what sits in that folder is an…
XSS to RCE - Xbox Device Portal
The Xbox Device Portal is an invaluable tool for developers, offering remote access to an Xbox console in developer mode via a web browser. It allows for…
Bypass Microsoft Teams Tenancy Permission - Edit Sent Messages
Back in December 2019 I reported a Microsoft Teams Tenancy Permission bypass that allowed a user to modify their sent messages despite the global…
002 Engagements
Enjoying the notes? See the work live.
Every writeup here came out of real engagements and bounty programmes. Book an assessment and you get findings of your own - thoroughly tested, clearly written, honestly priced.