Mahdi Alabdallah
OSCP, eCPPT, eWPT, eCIR, SC-200, SC-300, AZ-500
Mahdi specialises in penetration testing, web application security, network security assessments and vulnerability exploitation. He holds the OSCP (Offensive Security Certified Professional) certification alongside eCPPT, eWPT and eCIR, and Microsoft SC-200, SC-300 and AZ-500.
7 articles
What Is ZTNA? Zero Trust Network Access vs VPN, And What Changes For Your SOC
ZTNA gives users access to single apps, not the network, with nothing listening on the internet. How it works, ZTNA vs VPN, and its limits.
Microsoft SecurityWhat Is Workload Identity Federation? Removing Stored Secrets From Your CI/CD Pipelines And Azure Apps
Workload identity federation lets pipelines and external workloads reach Entra ID resources without a stored secret. How it works and how to secure it.
FundamentalsWhat Is A Watering Hole Attack? How Attackers Poison Trusted Websites, And How To Defend Against It
A watering hole attack poisons a website your people already trust. How it works, real examples, and how to defend against it in Microsoft environments.
Microsoft SecurityWhat Is A Managed Identity? Replacing Client Secrets In Azure And Entra ID
A managed identity lets Azure workloads get tokens without storing a secret. System vs user-assigned, when to use federation, and how to find secrets.
FundamentalsWhat Is An SBOM? Software Bills Of Materials Explained, And How To Use One When The Next Library Flaw Lands
An SBOM lists the components inside a piece of software. What it contains, the main formats, how to get one from suppliers and how to use it in a crisis.
FundamentalsWhat Is Secrets Management? Keeping API Keys, Tokens And Passwords Out Of Attackers' Reach
Secrets management keeps API keys, tokens and passwords out of code and files. Where secrets leak, how vaults and managed identities work, and what to do.
Offensive SecurityWarshipping: How Businesses Are Getting Hacked Through the Post
A cheap wireless implant, posted in a parcel, sitting in your mailroom. What warshipping is, why the mailroom is the gap, and what actually stops it.
Talk to the people
who do the work.
A demo against your own estate rather than a canned one, run by an analyst rather than a salesperson.