Field notes
Writing
Focused lessons pulled from the work — the kind of thing I wish I'd found when I hit the wall myself.
- The metadata endpoint depends on the compute type An SSRF into an Azure Function returned an empty metadata response — not because the attack failed, but because Functions has no VM IMDS. A short lesson on matching the metadata endpoint to the compute you actually landed on.
- Your Okta tenant is sprayable by default — and MFA won't fix it The Identity Engine sign-in surface validates passwords from the open internet by design. Here's what actually gates external spraying — and why turning on MFA isn't it.