Field notes.

Server-Side Request Forgery rarely ends at the bug bounty triage queue. Here is how a 'low-impact' blind SSRF becomes full cloud compromise when you understand the metadata layer.

Most AD compromises are not zero-days — they are predictable paths through misconfigured trust. A mental model for thinking about Active Directory the way an attacker actually does.