The hacking in Null Witness is real — the methods, the tool names, the failure modes, and it does real work in the story. These are first-person practitioner notes on how the techniques actually work. Written for people who will check. No prior chapters required; no spoilers below.

1. JWT alg:none authentication bypass The Signature Was Always Theater JWT alg:none, and why a token is only as honest as the server that checks it.
2. Kerberoasting (Active Directory) Service Accounts Never Change Their Passwords Kerberoasting: how an ordinary domain user walks out with crackable credentials for the accounts that actually matter.
3. DNS tunneling / exfiltration Everything Speaks DNS How to move data out of a network that blocks everything, by hiding it in the one protocol nobody dares turn off.
4. Man-in-the-Middle (ARP spoofing + TLS interception) Padlocks are Suggestions Man-in-the-middle on a LAN: ARP spoofing to sit in the traffic, a rogue certificate to read the TLS, and the browser warning the victim trained himself to ignore.
5. Hardcoded credentials in firmware The Master Key Was in the Box the Whole Time Hardcoded keys in firmware: how one private key baked in at the factory unlocks every unit ever made.
6. Repeating-key XOR A Lock Drawn on a Door XOR obfuscation: why something that looks encrypted, and something that is, are not the same thing.