Yunolay (Yunolay's Blog の投稿者)

GCP Privilege Escalation: Abusing Service Account Impersonation and IAM Misconfigurations

How attackers abuse actAs, setIamPolicy, and service account impersonation to escalate privileges in Google Cloud, with blue-team defenses.

2025.10.02

Cloud Security

Cloud Metadata Service (IMDS) Attacks via SSRF: Stealing Credentials and Defending IMDSv2

How attackers pivot from SSRF to cloud credential theft through 169.254.169.254, and how IMDSv2 and hop limits stop them.

2025.09.30

Cloud SecurityWeb Exploitation

Cloud Logging and Detection: Attacking and Defending CloudTrail and GuardDuty

How attackers blind CloudTrail and evade GuardDuty, and how blue teams close the detection gaps.

2025.09.28

Cloud SecurityTools & Defense

Attacking AWS STS, AssumeRole, and Cross-Account Trust

How sts:AssumeRole, weak trust policies, and missing ExternalId enable cross-account pivots, plus blue-team detection.

2025.09.26

Cloud Security

Docker Security Fundamentals and Hardening: From Capabilities to Rootless Containers

A practical guide to hardening Docker: Linux capabilities, seccomp, rootless mode, --privileged risks, and image scanning.

2025.09.24

Containers & DevSecOps

Advanced Container Escape Techniques: From CAP_SYS_ADMIN to Host Root

A practical look at advanced container escape primitives — release_agent, /proc abuse, host mounts, and runc CVEs.

2025.09.22

Containers & DevSecOps

Kubernetes RBAC Attacks: Privilege Escalation from a Compromised Service Account

How attackers abuse Kubernetes RBAC roles, bindings, and service account tokens to escalate to cluster-admin, and how to defend.

2025.09.20

Containers & DevSecOps

Attacking the Kubernetes API Server and etcd: A Practical Offensive Guide

Hands-on offensive techniques against the Kubernetes control plane: anonymous auth, etcd secret extraction, kubelet API, and exposed dashboards.

2025.09.18

Containers & DevSecOps

Breaking and Hardening Kubernetes Pods: Pod Security Standards, OPA Gatekeeper, and Kyverno

An offensive and defensive tour of Kubernetes pod admission control: Pod Security Standards, securityContext, OPA Gatekeeper, and Kyverno.

2025.09.16

Containers & DevSecOps

Auditing Kubernetes Clusters with kube-bench and kube-hunter

A practical guide to auditing Kubernetes for CIS benchmark gaps and exploitable misconfigs, then remediating them.

2025.09.14

Containers & DevSecOps

Securing the Software Supply Chain: SBOM, Sigstore, and SLSA in Practice

A hands-on guide to attacking and defending the software supply chain with SBOM, cosign, Sigstore, and SLSA.

2025.09.12

Containers & DevSecOps

Attacking CI/CD Pipelines: Exploiting GitHub Actions and Jenkins

A practical offensive and defensive walkthrough of pwn requests, PPE, secrets exfiltration, and OIDC abuse in GitHub Actions and Jenkins.

2025.09.10

Containers & DevSecOps

Secrets Management and Hunting Leaked Secrets in Git

Hunt leaked credentials in git history with gitleaks and trufflehog, then lock them down with HashiCorp Vault.

2025.09.08

Containers & DevSecOps

Infrastructure as Code Security: Hunting Bugs in Terraform with tfsec and Checkov

A practical guide to attacking and defending Terraform: state file secrets, drift, least privilege, and IaC scanning with tfsec and Checkov.

2025.09.06

Containers & DevSecOps

Android Application Pentesting: Lab Setup and APK Internals

Build a reproducible Android pentest lab, learn APK structure and AndroidManifest, and triage apps with adb and MobSF.

2025.09.04

Mobile API OSINT

Reversing Android Apps: apktool, jadx, and Frida in Practice

A practical workflow for static and dynamic Android reversing with apktool, jadx, and Frida — plus blue-team defenses.

2025.09.02

Mobile API OSINT

iOS Application Security Testing Fundamentals

A practical primer on assessing iOS apps: IPA extraction, keychain, plist analysis, and dynamic instrumentation with Frida and objection.

2025.08.31

Mobile API OSINT

Bypassing SSL Pinning to Intercept Mobile App APIs

A practical guide to intercepting mobile API traffic by defeating certificate pinning with Frida, objection, and Burp Suite.

2025.08.29

Mobile API OSINT

REST API Penetration Testing Methodology: From Recon to BOLA

A practical, repeatable methodology for testing REST APIs: BOLA, mass assignment, broken rate limiting, and blue-team defenses.

2025.08.27

Web Exploitation

GraphQL API Security Testing: Advanced Offensive and Defensive Techniques

Advanced GraphQL pentesting: introspection, batching abuse, depth-limit bypass, IDOR, and blue-team defenses.

2025.08.25

Web Exploitation

Breaking OAuth 2.0 and OpenID Connect: Redirect, State, and Token Attacks

A practical guide to OAuth 2.0 and OIDC attacks - redirect_uri abuse, state/CSRF, PKCE, and token leakage - with blue-team defenses.

2025.08.23

SecurityWeb Exploitation

OSINT for Red Teamers: Mapping People and Infrastructure

A practical red-team OSINT workflow for enumerating people and infrastructure with theHarvester, Shodan, breach data, and DNS recon.

2025.08.21

Mobile API OSINT

Subdomain Enumeration and Attack Surface Mapping with Amass, Subfinder, and httpx

A practical recon workflow chaining amass, subfinder, httpx, and ffuf to map an organization's external attack surface.

2025.08.19

Mobile API OSINT

Phishing and Initial Access Tradecraft for Authorized Red Teams

A practical look at pretexting, Gophish campaigns, Evilginx MFA phishing, and the blue-team controls that stop them.

2025.08.17

Mobile API OSINT

[Solved] Turn off VBS 100% Solved　(Device Guard, Credntial Guard)

Step 1. Turn off Credential GuardDownload the DG Readiness powershell script: dgreadiness_v3.6.zipRun the script with th...

2024.11.04

Other

Performance degradation when using WHP in a virtual environment on Windows 11 Pro 23H2

BackgroundSince virtual environments cannot normally coexist with Windows 11 Pro 23H2 Japanese Edition, it was necessary...

2023.12.24

Other

Vulnlab Data Walkthrough by Yunolay (LFI with path traversal, Docker privileged user)Vulnlab Retro Walkthrough by Yunolay (RID Brute Force, pre-created computer accounts, ADCS Attacks)

OverviewRetro (Solo, Windows)Junior Level Windows Active Directory MachineYou will learn about pre-created computer acco...

2023.11.03

Vulnlab

Vulnlab Feedback Walkthrough by Yunolay (Apache Tomcat Log4Shell)

OverviewFeedback (Solo, Linux)Junior Level Linux MachineYou will learn about exploiting a popular Java CVEUserThis box w...

2023.10.30

Vulnlab

Vulnlab Data Walkthrough by Yunolay (LFI with path traversal, Docker privileged user)Offensive Security Lab Japan Boot2Root offsec-4-diveintoive Writeup by Yunolay (LFI2RCE via PHP Filters, RFI)

IntroduceI'm new to trying Boot2Root and was provided with a vulnerable machine, but it's mixed in with my home network ...

2023.10.29

Offensive Security Lab Japan

Vulnlab Data Walkthrough by Yunolay (LFI with path traversal, Docker privileged user)

OverviewData (Solo, Linux)Junior Level Linux MachineYou will learn about getting a foothold through a CVE, cracking cust...

2023.10.26

Vulnlab

Vulnlab Sync Walkthrough by Yunolay (Rsync, Custom Hash Crack, Writable files executed by a privileged user)

OverviewSync (Solo, Linux)Junior Level Linux Machine.You will learn about exploiting custom applications & misconfigurat...

2023.10.25

SecurityVulnlab

Vulnlab Baby Walkthrough by Yunolay (LDAP Enumeration, SMB Password Spraying, Privilege escalation using SeBackupPrivilege and SeRestorePrivilege)

OverviewActive Directory PentestingBaby (Solo, Windows)Junior Level Windows Active Directory MachineYou will learn about...

2023.10.24

Vulnlab

Yunolay

GCP Privilege Escalation: Abusing Service Account Impersonation and IAM Misconfigurations

Cloud Metadata Service (IMDS) Attacks via SSRF: Stealing Credentials and Defending IMDSv2

Cloud Logging and Detection: Attacking and Defending CloudTrail and GuardDuty

Attacking AWS STS, AssumeRole, and Cross-Account Trust

Docker Security Fundamentals and Hardening: From Capabilities to Rootless Containers

Advanced Container Escape Techniques: From CAP_SYS_ADMIN to Host Root

Kubernetes RBAC Attacks: Privilege Escalation from a Compromised Service Account

Attacking the Kubernetes API Server and etcd: A Practical Offensive Guide

Breaking and Hardening Kubernetes Pods: Pod Security Standards, OPA Gatekeeper, and Kyverno

Auditing Kubernetes Clusters with kube-bench and kube-hunter

Securing the Software Supply Chain: SBOM, Sigstore, and SLSA in Practice

Attacking CI/CD Pipelines: Exploiting GitHub Actions and Jenkins

Secrets Management and Hunting Leaked Secrets in Git

Infrastructure as Code Security: Hunting Bugs in Terraform with tfsec and Checkov

Android Application Pentesting: Lab Setup and APK Internals

Reversing Android Apps: apktool, jadx, and Frida in Practice

iOS Application Security Testing Fundamentals

Bypassing SSL Pinning to Intercept Mobile App APIs

REST API Penetration Testing Methodology: From Recon to BOLA

GraphQL API Security Testing: Advanced Offensive and Defensive Techniques

Breaking OAuth 2.0 and OpenID Connect: Redirect, State, and Token Attacks

OSINT for Red Teamers: Mapping People and Infrastructure

Subdomain Enumeration and Attack Surface Mapping with Amass, Subfinder, and httpx

Phishing and Initial Access Tradecraft for Authorized Red Teams

[Solved] Turn off VBS 100% Solved (Device Guard, Credntial Guard)

Performance degradation when using WHP in a virtual environment on Windows 11 Pro 23H2

Vulnlab Data Walkthrough by Yunolay (LFI with path traversal, Docker privileged user)Vulnlab Retro Walkthrough by Yunolay (RID Brute Force, pre-created computer accounts, ADCS Attacks)

Vulnlab Feedback Walkthrough by Yunolay (Apache Tomcat Log4Shell)

Vulnlab Data Walkthrough by Yunolay (LFI with path traversal, Docker privileged user)Offensive Security Lab Japan Boot2Root offsec-4-diveintoive Writeup by Yunolay (LFI2RCE via PHP Filters, RFI)

Vulnlab Data Walkthrough by Yunolay (LFI with path traversal, Docker privileged user)

Vulnlab Sync Walkthrough by Yunolay (Rsync, Custom Hash Crack, Writable files executed by a privileged user)

Vulnlab Baby Walkthrough by Yunolay (LDAP Enumeration, SMB Password Spraying, Privilege escalation using SeBackupPrivilege and SeRestorePrivilege)

[Solved] Turn off VBS 100% Solved　(Device Guard, Credntial Guard)