Tag:detection-engineering

All the articles with the tag "detection-engineering".

• CVE-2026-69243 PoC: aiohttp request smuggling through a rejected WebSocket upgrade

  Published date: 4 Aug, 2026

  8 min read

  I reproduced the aiohttp parser bug end to end: a rejected WebSocket upgrade leaves the request body in the parser tail, and through the standard Nginx WebSocket map it becomes CWE-444 smuggling that bypasses a deny-all edge ACL. PoC in Python and Rust, plus lab-validated detection.

  • #request-smuggling
  • #http
  • #aiohttp
  • #rust
• Stealth DCSync, an autopsy: no flag combination got me usable secrets without Get-Changes-All

  Published date: 2 Aug, 2026

  13 min read

  I tested five MS-DRSR flag and EXOP manipulations meant to perform a DCSync without triggering the DS-Replication-Get-Changes-All GUID in Event 4662. Every variant that returned usable credential material also logged the GUID, identically on Server 2016 and Server 2025. One variant contradicts the MS-DRSR specification and I could not resolve it.

  • #active-directory
  • #red-team
  • #detection-engineering
  • #impacket