2025
TokenFlare: Serverless AiTM Phishing (BSides London)
Releasing TokenFlare - a serverless AiTM phishing framework for Entra ID / M365. Sub-minute deployments using CloudFlare Workers.
TokenCraft (Beac0n)
Token manipulation and abuse techniques for Entra ID post-exploitation.
Payload-less Initial Access (BSides Cheltenham)
Initial access techniques that don’t require dropping payloads on disk.
Reverse Engineering a Rumour (BSides Athens, BSides Hong Kong)
Story behind weaponisingthe Intune Conditional Access Bypass
2024
OHHH365 (BSides Cheltenham, BSides Wales)
M365 / Entra ID attack techniques and tradecraft around password spraying.
What’s in a Name (BSides Basingstoke)
War story on writing our own DNS tunneling protocol on the fly, and other AWS misadventures, all in a web app pentest