Hunter Wade

Apex, one of Sprocket's AI agents, found a session injection flaw in minutes. Human testers chained it into two zero-days.

How ASRepCatcher uses ARP poisoning to obtain crackable AS-REP hashes from any authenticating user, even when Kerberos preauthentication is enabled.

Step-by-step walkthrough of cracking NTLMv1-SSP hashes with rainbow tables, including how to coerce auth, disable ESS, recover NT hashes, and remediate.