Building ShroudCloud: a lab for breaking auth flows the right way. OAuth, SAML, OIDC. Writing the process at cctbp.com. Waitlist open.https://bsky.app/profile/cctbp.bsky.socialhttps://bsky.app/profile/cctbp.bsky.social/post/3mmzjs2taxs2r​Just dropped a blueprint for building an isolated, scriptable interception lab using Docker, mitmproxy, and Firefox. ​No state contamination, no ambient noise. Rebuild from scratch in under 5 minutes. ​Read the full setup guide: 🔗 https://blog.cctbp.com/posts/26-05-29-local-lab-blueprint/ #mitmproxy #docker #infosec #appsec29 May 2026 21:57 +0000at://did:plc:kq3enyxonixk5gaacoeyoisl/app.bsky.feed.post/3mmzjs2taxs2rhttps://bsky.app/profile/cctbp.bsky.social/post/3mmovvcds422hOAuth 2.0 Authorization Code Flow; quick 11 second animated, protocol-level breakdown video. Redirect → short-lived code → back-channel token exchange. This is the clean version. The deep-dive is on the blog. 🎥 youtu.be/M6a1LOrpIM0 📖 Full post: cctbp.com #OAuth #AppSec #IdentitySecurity https://youtu.be/M6a1LOrpIM025 May 2026 16:35 +0000at://did:plc:kq3enyxonixk5gaacoeyoisl/app.bsky.feed.post/3mmovvcds422hhttps://bsky.app/profile/cctbp.bsky.social/post/3mmkv7f63q22aNew post: OAuth authorization code interception — the flow, the seam, and what your logs actually show. Also releasing FlawedToken: a vulnerable OAuth client with toggleable misconfigs. One Docker command, no setup. 📝 blog.cctbp.com 🔧 github.com/tstacy/flawedtoken #appsec #oauth #infosec #blueteam https://blog.cctbp.com24 May 2026 02:12 +0000at://did:plc:kq3enyxonixk5gaacoeyoisl/app.bsky.feed.post/3mmkv7f63q22a