On: Abusing Entra OAuth for fun and access to internal Microsoft applications

[1vuio0pswjnm7]

Automattic HTTP Headers:

   x-hacker: Want root?  Visit join.a8c.com and mention this header
   x-nananana: Batcache-Hit

Popular CDNs require SNI but do not offer a solution for plaintext domain names on the wire.

(ECH exists but is not enabled everywhere SNI is required.)

Meanwhile Wordpress hosts multiple HTTPS sites on same IP and does not require SNI.

(No plaintext domain names on the wire.)