Skip to content
ATARUS. OFFENSIVE SECURITY

Atarus Learn

Engagement Reference

The notes we keep open during tests, one situation per page. Each step has the command or request we run and the change that stops it. Use them only on systems you are authorized to test.

10 pages

Web

  • Web app first hour

    The first hour on a web application test: proxy everything, read the headers, find the API the front end calls, and list every input before attacking any.

    Recon Reviewed

  • Authentication and session checks

    Login, logout, password reset, tokens and rate limits: the authentication and session checks we run on every web app, and the server-side fix for each.

    Access Reviewed

  • Authorization and IDOR checks

    Testing who can read and change what: object IDs, HTTP methods, admin routes, mass assignment and tenant boundaries, with the data-layer fix for each.

    Escalation Reviewed

Identity

  • SPF, DKIM and DMARC as a tester reads them

    Reading a domain's SPF, DKIM and DMARC records the way a tester does: what each one lets an attacker send as you, and the record that closes it.

    Recon Reviewed

  • Password spray and MFA fatigue

    How we test password spraying and push-approval fatigue without locking anyone out, and the policies and detections that stop both.

    Access Reviewed

Cloud

  • Cloud account first hour: AWS and Azure

    Handed a set of cloud credentials: who they belong to, what they can do, where the secrets sit, what is public, and whether anyone is logging it.

    Escalation Reviewed

Network

  • External recon of a domain

    How we map a client domain from outside on day one: published DNS, certificate logs, dangling records, open services and the edge devices behind them.

    Recon Reviewed

  • Internal network first hour

    From a foothold and one domain account: password policy, SMB signing, name resolution fallbacks, attack paths in the directory and certificate services.

    Recon Reviewed

Physical

  • Physical access and badge checks

    How we assess badge technology, readers, doors and the people layer on an authorized physical test, and the change that closes each gap.

    Access Reviewed

Reporting

  • Writing a finding that gets fixed

    How we write a security finding an engineer can reproduce and fix without a call: title, severity reasoning, steps, the fix as a change, and the retest.

    Reporting Reviewed