Insights & Cybersecurity Stories

StingAD: From One Low-Priv Account to Domain Admin

Stingrai Security Research and Development Labs walks a single low-privileged Active Directory credential to Domain Admin using StingAD: Kerberoasting, Shadow Credentials, AD CS ESC1, DCSync, and a golden ticket.

GitHub Actions Security Checklist: Harden CI/CD in 2026

GitHub Actions security best practices for 2026. Twenty-five hardening controls across five categories, each anchored on a verified CVE or public incident, from tj-actions and Nx s1ngularity through TanStack, Megalodon and the August 2026 ChainDrop worm.

Your App is Pinned. We Got in Anyway: The Real Story of SSL Pinning Bypass

Learn how attackers bypass SSL pinning with Frida, Objection, and binary patching, plus how to harden your mobile app with native pinning and RASP.

The Kerberos Double Hop Problem Is Not a Problem

A technical deep dive into the Kerberos double hop problem: why WinRM second hops fail, how TGT vs TGS and Windows logon types shape a session's credentials, and the offensive workarounds operators rely on.

The Dark Side of Next.js Server Actions: How Hidden Actions Can Bypass Your Access Controls

This blog explores a critical security flaw in Next.js Server Actions. It explains how attackers use the next-action header to bypass permissions and provides a comprehensive guide on enforcing server-side authorization to protect your data.

The Perils of Premature Vulnerability Reporting: A Case Study in Off-by-One Analysis

OpenVAS False Positive: Our deep dive into a suspected off-by-one buffer overflow reveals the importance of rigorous validation. Learn how definitive canary testing debunked the flaw, and careful tool interpretation for all security researchers.

Build, Clone, Defend: Long-Range RFID Attacks Explained

Learn how we built a portable 125kHz RFID cloner with 1–2m range. Understand real-world risks and discover key strategies to prevent credential cloning.

How Gustavo Recovered a Hacked Account on X (formerly Twitter)

Gustavo Roberto, a penetration tester at Stingrai.io, shares how he recovered a hacked X account. Learn the attacker's methods, key recovery steps, and tips to secure your account.

Is Flipper Zero a Threat for Organizations?

Explore the Flipper Zero’s capabilities, potential risks, and how to protect your organization from misuse. Learn expert mitigation strategies from Stingrai.io to secure your systems against this versatile hacking tool.