Ep. 13 – NOAuth Account Misbinding & Assumed-Breach To Domain Admin (Season Finale) Hacked & Secured: Pentest Exploits & Mitigations podcast

Content provided by Amin Malekpour. All podcast content including episodes, graphics, and podcast descriptions are uploaded and provided directly by Amin Malekpour or their podcast platform partner. If you believe someone is using your copyrighted work without your permission, you can follow the process outlined here https://podcastplayer.com/legal.

Hacked & Secured: Pentest Exploits & Mitigations »
Ep. 13 – nOAuth Account Misbinding & Assumed-Breach to Domain Admin (Season Finale)

1M ago 15:09

MP3•Episode home

One misbound identity. One exposed internal path. Two routes to total compromise.

In this season finale of Hacked & Secured: Pentest Exploits & Mitigations, we break down two real-world findings that show how small trust assumptions can unravel entire systems:

nOAuth (SSO account misbinding) — Multi-tenant SSO auto-linked accounts by email instead of a stable subject/issuer identifier. With a crafted identity on a controlled domain, an attacker could land a valid session as another user.
From wall socket to Domain Admin — No NAC on the switch enabled quiet network access, followed by username harvesting and a light password spray to a low-priv account. From there: AD enumeration, weak service credentials, and abuse of certificate services to escalate to Domain Admin.

What you’ll learn: how identity claims should be bound in modern SSO, how to harden join and mapping flows, and a practical checklist to shut down common internal escalation paths (NAC, credential hygiene, service principals, AD CS, and monitoring).

Chapters:

00:00 - INTRO

01:27 - FINDING #1 - nOAuth: the email you shouldn’t have trusted

07:22 - FINDING #2 - From one wall socket to Domain Admin

13:43 - OUTRO
Want your pentest discovery featured? Submit your creative findings through the Google Form in the episode description, and we might showcase your finding in an upcoming episode!
🌍 Follow & Connect → LinkedIn, YouTube, Twitter, Instagram
📩 Submit Your Pentest Findings → https://forms.gle/7pPwjdaWnGYpQcA6A
📧 Feedback? Email Us → [email protected]
🔗 Podcast Website → Website Link

Chapters

1. INTRO (00:00:00)

2. FINDING #1 - nOAuth: the email you shouldn’t have trusted (00:01:27)

3. FINDING #2 - From one wall socket to Domain Admin (00:07:22)

4. OUTRO (00:13:43)

14 episodes

#Tech #Careers #Business #Penetration Testing #Bug Bounty #Ethical Hacking #Web Security #Application Security #Offensive Security #Podcasting Education #Amin Malekpour #DevSecOps #Secure Coding #Security Hardening #Secure Software Development #Security Best Practices #Red Team