Hope Walker

ghst.lyToken Analysis and Tracking System (TATS)Tracking OAuth tokens is hard, but Token Analysis and Tracking System (TATS) can help. TATS will collect, store, decode, analyze and provide visual tracking for OAuth token exchanges. It was built to ...

9 Sept

Tracking OAuth token exchanges is complicated. TATS can help. @1cemoon.bsky.social introduces the Token Analysis and Tracking System & shares some unexpected findings uncovered along the way. Check it out! https://ghst.ly/4xMBaYd

youtu.beMapping RBAC in BloodHound | SO-CON 26YouTube video by SpecterOps

5 June

My SO-CON talk about mapping RBAC in BloodHound is posted now. Fair warning for those who don't know me, I do have a personality and started by yelling at the crowd. 👑 Check out how we are mapping RBAC in BloodHound moving forward. youtu.be/1KDcK9PjnhU?...

Hope Walker reposted

ghst.lyCVE-2026-4387: StrongDM State File ReusePublic disclosure for CVE-2026-4387. State file could be transferred and used on other hosts without restriction

1 June

During an assessment, our team discovered that StrongDM auth state files containing JWTs & key material could be reused across hosts to obtain authenticated sessions & access infrastructure resources (CVE-2026-4387). Read more from @1cemoon.bsky.social: https://ghst.ly/4egbgVd

specterops.ioCVE-2026-4387: StrongDM State File ReusePublic disclosure for CVE-2026-4387. State file could be transferred and used on other hosts without restriction

1 June

I'm excited to be able to finally publish the public disclosure for CVE-2026-4387. Check out my blog on discovering the reuse of the state.kv file to get authenticated sessions with StrongDM (now fixed). specterops.io/blog/2026/06...

Hope Walker reposted

14 Apr

How do you really model RBAC in attack paths? 🤔 @1cemoon.bsky.social breaks down the limitations of role-based mapping in BloodHound, and shows how to move to permission-level edges for clearer, more accurate graphs. #SOCON2026

Hope Walker reposted

27 Mar

Don’t miss @1cemoon.bsky.social at #BSidesSD 🔥 Deep dive into NAA, brokered client IDs, and how token flows behave (and break) in Microsoft environments. Learn more: https://www.bsidessd.org/

ghst.lyNAA or BroCI...? Let Me Explain - SpecterOpsThis writeup is a summary of knowledge and resources for nested application authentication (NAA) and brokered client IDs (BroCI)

15 Oct 2025

Check out my new blog diving deeper into BroCI.

SpecterOps@specterops.io

Microsoft introduced nested application auth (NAA) in 2024. Researchers spotted FOCI similarities & dubbed it brokered client IDs (BroCI). @1cemoon.bsky.social documents NAA flows and BroCI—filling a gap for research on Microsoft identity protocols. ghst.ly/3Jdhp7Z

ghst.lyGoing for Broke(ring) – Offensive Walkthrough for Nested App Authentication - SpecterOpsIn depth walkthrough for using nested app authentication (NAA), or BroCI, for offensive engagements to access information and resources.

13 Aug 2025

Check out my new blog on nested app authentication.

SpecterOps@specterops.io

Why should Microsoft's Nested App Authentication (NAA) should be on your security team's radar? @1cemoon.bsky.social breaks down NAA and shows how attackers can pivot between Azure resources using brokered authentication. ghst.ly/45h2Zw3

Hope Walker reposted