Windows Token Privileges: A Field Checklist
Lab whoami /priv dump, OpenProcess notes on a process we own, integrity vs enabled privileges — no token-steal PoC.
Privilege
PostgreSQL Privilege Boundaries and Extension Trust
Lab \du dump, a safe SECURITY DEFINER function, failed GRANT, search_path notes — no superuser exploit.