newschool cyber security bloghttps://kagebunsher.com/enhttps://kagebunsher.com/esc8-adcs-ntlm-relay/https://kagebunsher.com/esc8-adcs-ntlm-relay/the CA web enrollment endpoint answers NTLM over http, no signing, no channel binding. coerce a domain controller into authenticating to you, relay it there, and the CA hands you a certificate for the DC. here's why it's in almost every AD CS install, and how to find and fix it.Sun, 30 Aug 2026 09:00:00 GMThttps://kagebunsher.com/finding-sharepoint-deserialization-bugs/https://kagebunsher.com/finding-sharepoint-deserialization-bugs/the sink was never a secret. BinaryFormatter has been sitting in that code path for years. the bug is the second road that leads to it, and that road is what you actually hunt for.Wed, 29 Jul 2026 12:00:00 GMThttps://kagebunsher.com/kerberoasting-attack-detection-opsec/https://kagebunsher.com/kerberoasting-attack-detection-opsec/kerberoasting is old news. making it harder to detect isn't. here's what red can do to reduce the noise, and what blue can do beyond basic event ID filtering.Fri, 20 Feb 2026 21:00:00 GMThttps://kagebunsher.com/powershell-proxy-bypass-audit/https://kagebunsher.com/powershell-proxy-bypass-audit/why enterprise proxy enforcement is fundamentally broken when firewalls trust client-side configuration, and how a single powershell line proves it.Sat, 07 Feb 2026 12:00:00 GMThttps://kagebunsher.com/hivelardan-hash-kazma/https://kagebunsher.com/hivelardan-hash-kazma/the tools do it for you, but what runs underneath?Wed, 05 Feb 2025 00:00:00 GMT