Penetration Tester: 2026-09-28

1. How I Could've Accessed 17 Trillion Microsoft Records

   Faav, 2026-09-25. Read, 11 min.

   A researcher who writes as Faav reports that Titan, an internal Microsoft analytics service, never checked the signature on login tokens, which let the researcher claim an administrator's identity and submit unauthorized SQL queries without real credentials. The researcher describes the impact as hypothetical, says Microsoft locked down the API endpoint on September 9 after the September 5 report to MSRC, and notes that Microsoft had editorial control over the post.

   Why it matters for this role: Include a signature check in your JWT test cases, since Microsoft's Titan validated tenant, audience, app ID, and user claims yet never verified the signature.

Penetration Tester