Method on srdusr

Recon Is a Loop, Not a Pass

Fri, 21 Aug 2026 00:00:00 +0000

Enumeration is the phase that decides the engagement. More boxes fall to thorough enumeration than to clever exploitation, and the rule on a stuck target is almost always “enumerate harder”, not “find a better exploit”.

The mistake that costs the most time is treating recon as a pass: scan, read the output, move to exploitation. It is a loop. Each finding sends you back to enumerate something new, and the surface grows as you work.

Thorough Enumeration Beats Clever Exploitation

Tue, 02 Dec 2025 00:00:00 +0000

More machines fall to finding the thing that was already there than to a clever exploit. When a box is stuck, the fix is almost always to enumerate harder, not to reach for a more advanced technique. The winning path was usually visible at hour one and dismissed.

Why it holds

An exploit needs a target, and finding the target is enumeration. A service on a high port, a virtual host that only answers to its name, a comment in the page source, a readable share: each is a foothold that no exploit skill substitutes for. Enumeration also compounds. Every credential and hostname found sends you back to enumerate something new, so the surface grows as you work.

Vulnerabilities Cluster at Trust Boundaries

Fri, 14 Nov 2025 00:00:00 +0000

A trust boundary is any point where data crosses from a less-trusted context into a more-trusted one: user input into a query, a request into a privileged process, one tenant’s data into another’s view. Almost every vulnerability class is a failure to re-establish trust at such a crossing.

Why it holds

Injection is untrusted input crossing into an interpreter without being made safe for it: SQL injection into a database, command injection into a shell, template injection into a template engine, cross-site scripting into another user’s browser. Authorisation bugs are a principal crossing into data it should not reach. Even privilege escalation, whether through a SUID binary or a potato attack, is a low-trust process crossing into a high-trust one. Naming the boundary tells you what defence is missing: encode for the destination context, or check the right to cross.