Red Team Operator // Incident Responder // Security Researcher
A digital graveyard for half-baked security thoughts. Where I dump my infosec ramblings, war stories, and occasional moments of clarity.
How to abuse an authenticated Global Secure Access tunnel from a standard-user beacon: extracting cached Entra ID tokens and redirecting the endpoint's existing tunnel for internal network access.
What Microsoft Global Secure Access actually is — SASE/SSE, the three traffic profiles, the Windows client architecture, the compliant-network check, and why I spent five months taking it apart.
Reverse-engineering the GSA Windows client: the NDIS/WFP kernel driver, the ALPC IPC seam, and rebuilding the gRPC tunnel protocol and its three-token authentication from scratch.