2025

TokenFlare: Serverless AiTM Phishing (BSides London)

Releasing TokenFlare - a serverless AiTM phishing framework for Entra ID / M365. Sub-minute deployments using CloudFlare Workers.

Slides

TokenCraft (Beac0n)

Token manipulation and abuse techniques for Entra ID post-exploitation.

Slides

Payload-less Initial Access (BSides Cheltenham)

Initial access techniques that don’t require dropping payloads on disk.

Slides

Reverse Engineering a Rumour (BSides Athens, BSides Hong Kong)

Story behind weaponisingthe Intune Conditional Access Bypass

Slides Slides

2024

OHHH365 (BSides Cheltenham, BSides Wales)

M365 / Entra ID attack techniques and tradecraft around password spraying.

Slides

What’s in a Name (BSides Basingstoke)

War story on writing our own DNS tunneling protocol on the fly, and other AWS misadventures, all in a web app pentest

Slides