Tagged: linux
156 posts · browse all tags
-
Host-Based Detection Part 9: Alternatives, and Handing Off to the Blue Team
OSSEC, Sysmon, auditd, osquery, Falco, and commercial EDR, compared honestly against Wazuh. Then a straight list of what the next series still has to do, now that a real domain controller and two real managers exist to test it against.
-
Host-Based Detection Part 8: Active Response, or When Wazuh Hits Back
Every other module in this series watches and tells you. Active response acts on its own. What the mechanism actually looks like, and a real lockout story from elsewhere on this site that explains why the timeout matters.
-
Host-Based Detection Part 7: How a Log Line Becomes an Alert
A raw log line becomes an alert in exactly two steps: decode, then match. How Wazuh's default ruleset already covers SSH, PAM, and sudo with zero custom rules, and where a shipped check turned out to be wrong.
-
Host-Based Detection Part 6: File Integrity Monitoring and Rootcheck
FIM, rootcheck, and SCA all answer some version of is this system still what I think it is, and none of them should be trusted blind. What each one actually checks, with real findings from a real run.
-
Host-Based Detection Part 5: Enrolling a Real, Mixed Fleet
A manager with no agents is an expensive way to look at an empty dashboard. What actually happens enrolling a real Raspberry Pi, and separately a genuinely mixed Linux-and-Windows lab fleet, into Wazuh.
-
Host-Based Detection Part 4: Standing Up a Manager, Two Different Ways
Two real Wazuh managers already exist on this site's infrastructure, built for opposite reasons. What the contrast between a shared homelab instance and a disposable lab one actually teaches about sizing and placement.
-
Host-Based Detection Part 3: Agent, Manager, Indexer, Dashboard, and What 5.0 Changes
Agent, manager, indexer, dashboard: how Wazuh's pieces fit together in the 4.14.x line both of this site's real deployments run, and what a still-in-beta 5.0 changes underneath all of it.
-
Host-Based Detection Part 2: From OSSEC to Wazuh, and What Actually Changed
OSSEC didn't stagnate the way it's often described, and Wazuh's 2015 fork happened for specific, checkable reasons. The real history behind the tool already running on two of this site's own boxes.
-
Host-Based Detection Part 1: What a HIDS Sees That a NIDS Never Will
This site has years of network-side detection content and almost none of the host-based half. Starting a nine-part series to fix that, built around two Wazuh deployments that already exist rather than a fresh lab.
-
Metasploit Deep Dive Part 1: History, Editions, and the Shape of the Framework
Where Metasploit came from, what Framework vs Pro actually means today, and why a series about the most-covered tool in offensive security still has something to add.
-
Metasploit Deep Dive Part 10: Network-Level Detection Engineering
What a network monitor can actually see in the meterpreter handshake and default transports, deliberately narrowed to the wire, since host-based detection is a separate series once its lab work lands.
-
Metasploit Deep Dive Part 11: RPC and msgrpc Automation
msfrpcd, MessagePack vs JSON-RPC, virtual consoles, and how the framework exposes itself to outside code, real source, the same layer AI Part 7 and Part 12's MCP server both build on top of.
-
Metasploit Deep Dive Part 12: msfmcpd, Rapid7's Own MCP Server
Five weeks after this site wired an LLM into Metasploit through a third-party MCP project, Rapid7 shipped a first-party one, with a safety model worth comparing directly against both that community project and this site's own MCP server.
-
Metasploit Deep Dive Part 13: Database, Workspaces, Loot, and Credential Tracking
The persistence layer underneath everything Parts 11 and 12 exposed: workspaces, hosts, services, vulnerabilities, credentials, and loot, and why an engagement's findings outlive any single msfconsole session.
-
Metasploit Deep Dive Part 2: Framework Internals, Modules, Mixins, and the Datastore
What Msf::Module actually is, why it's built from nineteen separate mixins instead of one class, and how the datastore turns 'set RHOSTS' into something every module type understands the same way.
-
Metasploit Deep Dive Part 3: Payload Architecture and What msfvenom Actually Builds
Singles vs. stagers vs. stages, what msfvenom is actually assembling, and the real encoder list behind a tool that's still doing the same job it did in 2003.
-
Metasploit Deep Dive Part 4: Meterpreter's TLV Wire Protocol, From Real Protocol Source
What actually goes over the wire once a meterpreter session is established: the packet header, the TLV encoding scheme, and how AES got layered on top of a protocol that started out XOR-obfuscated.
-
Metasploit Deep Dive Part 5: Transports Compared
reverse_tcp, reverse_https, bind_tcp, and the less obvious handlers the real framework ships, including two built specifically for pivoting through AWS rather than a raw socket.
-
Metasploit Deep Dive Part 9: Evasion in 2026, Honestly Assessed
What encoders, the dedicated evasion module category, and Metasploit 6.5's new features do and don't buy against modern AV and EDR, without recycling the 2015 version of this advice.
-
Metasploit Deep Dive Part 6: CVE-2014-3120, a Real Module, and Three Things Windows Defender Got Right
Running script_mvel_rce against the Elasticsearch 1.1.1 target this series has had waiting since Part 1, why the module never produced a session despite genuine SYSTEM-level RCE, and what checking Wazuh afterward turned up.
-
Metasploit Deep Dive Part 7: A Different Door, the Same Wall
Part 6 hit Windows Defender three times from an Elasticsearch MVEL exploit. Part 7 tries a completely different door — an unauthenticated SYSTEM-level Jenkins Groovy console — and finds exactly the same wall waiting on the other side.
-
Metasploit Deep Dive Part 14: Closing the Loop
Thirteen parts of internals, thirteen posts of "here's how the framework works." This one's different: no new commands, just going back through what actually happened in the lab and matching it up against the theory.
-
Metasploit Deep Dive Part 8: Pivoting Into the Blind Spot
Parts 6 and 7 exhausted stock Metasploit against a Defender-protected Windows host with no session to show for it. Part 8 moves to Linux, gets a clean foothold, and pivots into a segment the SIEM can't see at all.
-
Three CVEs, One Deadline, and a Bug That Waited Thirteen Years: This Week's Linux Kernel Headlines
CISA added three actively exploited Linux kernel CVEs to its KEV catalog this week with a two-day federal patch deadline. A fourth, a thirteen-year-old Open vSwitch bug with a public root exploit, hasn't made that list yet. Here's what each one actually does.
-
The Shell Game Part 1: Introduction
The first post in a series testing whether thirty-odd years of Bash habit is still the right call or just what came pre-installed. Bash, Zsh, and Fish, run for real on a dedicated lab VM, verdict included.
-
The Shell Game Part 2: Bash, the Universal Baseline
Part 2 of The Shell Game series. History, tab completion, globbing, and a real automation script on a fresh Debian 13 VM, establishing the plain, uncoloured baseline that Zsh and Fish get judged against.
-
The Shell Game Part 3: Zsh, Same Compatibility, Better Daily Driver
Part 3 of The Shell Game. Zsh runs Part 2's script and a real, years-old .bash_aliases file unmodified, recurses glob patterns Bash can't without an option, and hard-errors on things Bash quietly ignores.
-
The Shell Game Part 4: Fish, the Outsider
Part 4 of The Shell Game. Fish breaks outright on a real .bash_aliases file and hangs rather than erroring on a pasted Bash for-loop, but ships working completions, autosuggestions, and syntax highlighting with nothing configured.
-
The Shell Game Part 5: Making It Portable
Part 5 of The Shell Game. Adopting Kali's real .zshrc and version-controlling a years-old .bash_aliases file for the first time surfaces a silently-dropped config line, a CLI-name collision, two GitHub auth hurdles, and a prompt that ate a pasted command.
-
No CVE Required: The Ted Backdoor Hiding Inside Your Own HAProxy Build
Rapid7 found a Linux implant compiled into HAProxy's own binary. No CVE, no patch, a recompiled build reports the same version string as a clean one. The mechanism, and why file integrity monitoring, not network visibility, is what would catch it.
-
Bash Redirection Tricks for Turning a Scan Into a Target List: Piping the Pentest
Real nmap output piped through awk, tee, process substitution, and xargs to turn a subnet scan into a fanned-out target list. The subject is the redirection mechanics, not the brute-force tool sitting at the end of the pipe.
-
Same Job, Different Shell Part 1: Reachability and Continuous Monitoring
ping and Test-Connection do the same job, but which PowerShell version you're on changes both the syntax and, in one tested case, what the tool actually reports. Part 1 of a series pairing Windows and Linux networking commands, with a real PS 5.1 vs 7.6 discrepancy found along the way.
-
Same Job, Different Shell Part 10: Packet Capture
tcpdump against pktmon: when rule tables and connection state stop answering the question, packet capture does. A real captured TCP handshake and a real captured DNS query/response pair, on both platforms.
-
Same Job, Different Shell Part 11: The Complete Cheat Sheet
Every command pair from this series, reachability through packet capture, in one table, plus which PowerShell cmdlets actually change behavior between versions and which don't. The closing part of the Windows/Linux networking command comparison series.
-
Same Job, Different Shell Part 2: Path Tracing
traceroute and tracert answer "which hops did this take", but the protocol each one probes with matters more than people realize. A real sandbox test where the same destination gave two different route pictures depending on whether the probe was UDP or TCP.
-
Same Job, Different Shell Part 3: Interface and IP Configuration
ip addr, ifconfig, ipconfig, Get-NetIPAddress, Get-NetAdapter: five commands that all answer "what's my address", none of which return quite the same shape of answer. Part 3 of the Windows/Linux command comparison series.
-
Same Job, Different Shell Part 4: Routing Tables
ip route, route -n, route print, Get-NetRoute: reading a routing table is the same question on both platforms, why is this packet going that way, but Windows answers it with a metric that Linux's route table doesn't expose the same way at all.
-
Same Job, Different Shell Part 5: DNS Lookups and Resolution
dig, nslookup, and resolvectl against Resolve-DnsName and ipconfig /displaydns, with real query output captured live against both authoritative-adjacent and recursive resolvers, plus the caching layer most people forget to check first.
-
Same Job, Different Shell Part 6: Active Connections and Sockets
ss, netstat, and Get-NetTCPConnection all answer "what's connected to what right now", but only one platform ties a connection straight back to a process name without a second lookup. Part 6 of the Windows/Linux command comparison series.
-
Same Job, Different Shell Part 7: ARP and Neighbor Tables
ip neigh, arp -a, and Get-NetNeighbor read the same table: which MAC address answers for which IP on your local subnet. Windows names the entry states more precisely than Linux does, and Part 7 maps them directly against each other.
-
Same Job, Different Shell Part 8: Port and Service Testing
nc, curl, and bash's /dev/tcp trick against Test-NetConnection -Port: the real command-line way to answer "is the service actually listening on that port", plus real captured output showing the difference between open, closed, and filtered.
-
Same Job, Different Shell Part 9: Firewall Status, Read-Only
iptables -L, nft list ruleset, and ufw status against Get-NetFirewallRule and netsh advfirewall show: reading what a firewall currently allows without touching a single rule. Part 9 of the Windows/Linux command comparison series, and the natural next step after a port test comes back filtered.
-
Text Processing for Network Engineers Part 11: Tracing a Bad ACL Across the Fleet, Start to Finish
A maintenance-window ACL push goes out to 150 branch firewalls. A subset break. This part ties every tool from the series together, regex, grep, sed, awk, vim, diff, find and xargs, to find the affected devices, understand why only some of them broke, and fix all of them correctly in one pass.
-
Text Processing for Network Engineers Part 10: Encoding, Line Endings, and the Gotchas That Break Your Scripts
Every tool in this series assumes plain Unix text. A config pasted from Windows, pulled over a serial console, or exported by an older device's SNMP agent frequently isn't, and the failure it causes looks exactly like a bug in your pattern instead of what it actually is.
-
From Dropbox to Daily Driver Part 1: Scoping the Rebuild and the Threat Model
The same Raspberry Pi 4 that played an attacker's call-home dropbox in Part 5 of the empty-port series gets reflashed as a legitimate, hardened remote-access device — starting with the threat model and the OS and storage decisions that shape everything after it.
-
From Dropbox to Daily Driver Part 2: Flashing the Card and the First Boot
Burning the 128GB microSD card, working through Raspberry Pi Imager's customisation screen — hostname, auth, and Raspberry Pi Connect left off — and a real first SSH login to the freshly flashed Pi, with the version-mismatch story between Raspberry Pi's downloads page and GitHub along the way.
-
From Dropbox to Daily Driver Part 3: Locking Down the Base OS
Real SSH keys installed on the Pi (with a genuine known_hosts detour left from the reflash), password auth switched off despite a cloud-init drop-in fighting back, a default-deny ufw firewall, unattended upgrades with a Debian-vs-Ubuntu config gotcha, and why fail2ban doesn't make the cut.
-
From Dropbox to Daily Driver Part 4: Adding TOTP Two-Factor Authentication
Real TOTP 2FA layered on top of key-only SSH: libpam-google-authenticator, PAM and sshd_config chaining, making the second factor mandatory, and a login that hung for reasons that turned out to have nothing to do with PAM at all.
-
From Dropbox to Daily Driver Part 5: Cloudflare Tunnel, Zero Trust Access, and a WebSocket That Wouldn't Handshake
Putting this Pi behind a Cloudflare Tunnel and a Zero Trust Access policy so it's reachable from anywhere without a single inbound port open, plus a real ingress bug that took a debug session and a cross-checked log to actually find.
-
From Dropbox to Daily Driver Part 6: Standing Up a Wazuh Manager, and Why the VM Wouldn't Boot
Every layer this series has built so far assumes I'm the only one who'd ever notice if something went wrong. Standing up a Wazuh manager on pve to actually change that, plus a VM that dropped straight into a rescue shell and a small Proxmox API gotcha on the way there.
-
From Dropbox to Daily Driver Part 7: Wiring the Pi In as a Wazuh Agent
Part 6's Wazuh manager gets its first agent: the Pi, confirmed alerting on SSH/PAM/sudo out of the box, then a real SCA configuration audit against CIS benchmarks, real fixes, real false negatives sorted from real gaps.
-
From Dropbox to Daily Driver Part 8: An Ansible Control Node, a Second Pi, and What changed=0 Actually Proves
Turning seven parts of manual hardening into something a machine can run: a dedicated Ansible control node, a second Pi built specifically to prove reproducibility, a real gotcha in check mode explained honestly, and a second playbook run that changed nothing at all.
-
From Dropbox to Daily Driver Part 9: The Closing Checklist, and What Actually Changed Since Part 5
A closing checklist of every security layer this build actually has and verified, which pieces are Raspberry Pi-specific versus reusable anywhere, and the full-circle comparison back to this same Pi's stint as an attacker's dropbox.
-
Text Processing for Network Engineers Part 9: find, xargs, and Safe Bulk Operations Across a Config Tree
Turning "run this check against every config backup from the last 24 hours" from a manual loop into a single composable pipeline, and the null-byte-delimited habit that stops a filename with a space in it from quietly breaking your script.
-
Text Processing for Network Engineers Part 8: diff, patch, and Comparing Configs Before You Push
Unified diff format, comparing whole config-backup trees with diff -r, and generating a patch once and applying it fleet-wide. Plus why a generic line-by-line diff eventually needed a config-aware tool built specifically for FortiGate syntax.
-
Text Processing for Network Engineers Part 7: nano and Picking the Right Editor for the Job
nano won't win a features argument against vim, and that's fine. On-screen keybindings, no modal editing to fight under pressure, and the $EDITOR variable that decides which one opens when crontab or visudo calls for an editor.
-
Text Processing for Network Engineers Part 6: vim on a Box With No GUI
Macros, visual block mode, and the :g command: the vim features that matter when you're editing a config on a jump box at 3am with nothing but a serial console and no GUI in reach.
-
Text Processing for Network Engineers Part 5: cut, sort, uniq, tr, and the Rest of the Supporting Cast
grep, sed, and awk get all the attention, but the tools that glue them into a working pipeline are cut, sort, uniq, tr, column, and paste. Building a top-talkers report and a unique-source-IP list from a flow log using nothing but these.
-
Five Minutes and an Empty Port Part 1: A Field Guide to Network Implant Hardware, and Why This Still Works
Opening a series on the pocket-sized hardware that turns thirty seconds of physical access into a foothold: a history of the category, a threat model for why it still works in 2026, and a taxonomy of the three tool families this series covers before it turns to defense.
-
Five Minutes and an Empty Port Part 2: Shark Jack, Packet Squirrel, and LAN Turtle
The three purpose-built Hak5 wired implants compared on what they actually do between plug-in and pull-out: Shark Jack's quick-strike recon and exfil, Packet Squirrel's inline man-in-the-middle, and LAN Turtle's long-term covert remote access.
-
Five Minutes and an Empty Port Part 3: Bash Bunny, Key Croc, and O.MG Cable, or Why 802.1X Never Sees This Coming
The USB HID family, Rubber Ducky, Bash Bunny, Key Croc, and O.MG Cable, attacks the endpoint by exploiting a design decision from the 1990s: a USB keyboard is implicitly trusted, and no network control this series covers can see it happen.
-
Five Minutes and an Empty Port Part 4: WiFi Pineapple, Flipper Zero, and the ESP32 Marauder
The wireless family needs no cable and no physical port at all, just proximity to the air. WiFi Pineapple's PineAP suite, the Flipper Zero's ESP32 Marauder add-on, and bare ESP32 deauther boards compared honestly, including what MAC randomization has actually killed since 2014.
-
Five Minutes and an Empty Port Part 5: Building a Real Call-Home Dropbox on a Raspberry Pi 4
A real LAN Turtle-style dropbox built and tested live on a Raspberry Pi 4: a cloud-init race condition that took three rebuilds to diagnose, and a Cloudflare Tunnel call-home path proven end to end with a real reboot-recovery test.
-
Five Minutes and an Empty Port Part 6: A Full Walkthrough, From Empty Port to Persistent Access
A single illustrative engagement chaining every tool family from Parts 2 through 5 into one narrative, from a five-minute reception-desk recon to a persistent call-home channel, closing on real cost and dwell-time numbers before the series turns to defense.
-
Checking Your Own Public Footprint Part 4: Code, Secrets, and What's Sitting in Your Own Repos
Scanning your own public repositories for leaked secrets with gitleaks and TruffleHog, checking what's publicly indexed about your own IP space with Shodan's InternetDB, and what's hiding in a file's metadata.
-
Text Processing for Network Engineers Part 4: awk and Turning Command Output Into Reports
Fields, records, BEGIN/END blocks, and associative arrays: turning raw show-command and syslog output into bandwidth totals, error-rate tables, and per-source counts without a single line of Python.
-
Text Processing for Network Engineers Part 3: sed and Editing Configs Without Opening a Single File
Substitution, address ranges, in-place edits with a safety net, and the one command that turns "change this IP across 200 saved configs" from an afternoon of find-and-replace into a single line.
-
Text Processing for Network Engineers Part 2: grep and Searching Configs and Logs at Scale
grep past -i and -v: context windows for pulling whole interface blocks, -o for extraction, -P for lookaheads, and recursive search across a folder of device config backups to find which boxes still reference a decommissioned server.
-
Text Processing for Network Engineers Part 1: Regex, the Pattern Language Everything Else Depends On
Before grep, sed, awk, or vim make any sense, you need the pattern language underneath them. This part covers regex through network examples: IPv4/IPv6, MAC addresses, VLAN tags, interface names, and the BRE/ERE/PCRE dialect trap that bites people moving between tools.
-
NatJack: What a NAT-Table Hijack Means When You're the One Designing the NAT Boundary
NatJack broke a twenty-year-old assumption about who you can trust behind a shared NAT. Most of the coverage this week is either pure vulnerability research or "check your home router." This is the multi-tenant hub version of that question.
-
BitBang CLI Part 1: A Terminal, File Browser, and Proxy Over WebRTC, No Port Forwarding
bitbang-cli is a single static Go binary that gets you a shell, file browser, and LAN proxy on a remote machine with no inbound port, no account, and no VPN client. Built from source and run for real, including a live P2P connection and a PIN-protected listener.
-
BitBang CLI Part 2: What a WebRTC Reverse Shell Looks Like From the Wire
bitbang-cli needs no listener, no attacker-run infrastructure, and no SSH client on the target to get an outbound shell and LAN proxy. What that means next to Chisel and ligolo-ng, and what actually shows up in logs and on the wire when it runs.
-
Hydra vs Medusa vs Ncrack vs Patator vs Metasploit: Comparing the Online Brute-Force Tools
Five tools solve the same problem, guessing a live service's credentials, with radically different designs. A verified comparison of Hydra, Medusa, Ncrack, Patator, and Metasploit's brute-force auxiliary modules: syntax, protocol coverage, concurrency model, and what each looks like to a defender.
-
SSH Deep Dive Part 1: Keys, Clients, and Getting Connected on Windows, macOS, and Linux
Why key-based auth beats a password, generating and installing a key, and the real differences between the OpenSSH client on Windows, macOS, and Linux. Part 1 of 3, followed by the config file/agent/multiplexing and -L/-R/-D/-J.
-
SSH Deep Dive Part 2: The Config File, Agent Forwarding, and Multiplexing
Turning `ssh -i ~/.ssh/id_ed25519 [email protected]` into `ssh myhost`: the ~/.ssh/config file, per-host settings, ssh-agent so a passphrase isn't typed on every connection, and connection multiplexing to skip the handshake entirely.
-
SSH Deep Dive Part 3: Tunnels and Jump Hosts, -L, -R, -D, and -J
Everyday sysadmin uses for SSH's forwarding flags: reaching an internal service through a bastion with -L, exposing something outbound with -R, a SOCKS proxy with -D, and chaining through jump hosts with -J and ProxyJump.
-
Proxmox qm CLI VM Build, Part 1: Creating a Debian 13 VM and Surviving the Build Loop of Death
Building a Debian 13 VM on Proxmox entirely from the qm command line: checking host resources, fetching the ISO with pvesh instead of the GUI, and a real boot-order bug that trapped the VM in its own installer.
-
Proxmox qm CLI VM Build, Part 2: The Same VM via Cloud-Init, and What It Actually Costs You
Building the same Debian 13 VM again, this time from a cloud image instead of the netinst ISO: qm disk import, cloud-init identity and networking, and a real comparison of what you gain and what you give up against Part 1's interactive install.
-
Proxmox qm CLI VM Build, Part 3: Jumping Between pve and the VM
Testing qm terminal, noVNC, and SSH against both VMs from this series, and finding a real quirk: when a VM's display is redirected to its serial console, noVNC and qm terminal turn out to be two viewers on the same channel, not two independent sessions.
-
Proxmox qm CLI VM Build, Part 4: A Real Use Case, DNS with Unbound
Putting the ISO-built VM to actual use as a DNS resolver with unbound, a real sudo gotcha from Part 1's install choices, and an hour spent debugging a phantom firewall that turned out to be a much simpler mistake.
-
Proxmox qm CLI VM Build, Part 5: Templates, Clones, and What a Clone Actually Copies
Closing the series by turning VM 103 into a reusable template with qm template and qm clone, and finding that a clone copies everything on disk, including identity files most people wouldn't think to check.
-
BloodHound Deep Dive Part 1: History, Community Edition, and Where It Sits in an Engagement
Where BloodHound came from, how Community Edition is actually built (Postgres, Neo4j, a single Go binary), and where attack-path analysis fits between recon and exploitation in a real engagement.
-
BloodHound Deep Dive Part 2: SharpHound and What It Actually Collects
SharpHound's real collection methods, the Stealth flag's documented behavior, and what a DCOnly run against CONTOSO.LOCAL would and wouldn't surface, taken from SpecterOps' own flag reference rather than guessed.
-
BloodHound Deep Dive Part 3: Ingestion, Postgres, Neo4j, and the Go API
How a SharpHound JSON upload becomes graph data, what Postgres versus Neo4j is actually responsible for, and standing up a real Neo4j instance in a sandbox with no Docker and no root to verify the graph layer directly.
-
BloodHound Deep Dive Part 4: Cypher and the Built-In Attack Path Queries
Running BloodHound's canned attack-path query patterns as real Cypher against the seeded CONTOSO.LOCAL graph, including a shortestPath query that comes back empty and what that empty result actually means.
-
BloodHound Deep Dive Part 5: Kerberoasting and AS-REP Roasting Through the Graph
BloodHound's real hasspn and dontreqpreauth properties point at the exact same two accounts Impacket Deep Dive found by hand, and a clean shortestPath query with no results shows why being roastable isn't the same as being worth roasting.
-
BloodHound Deep Dive Part 6: From GenericAll to a Working Credential
Turning the GenericAll to ForceChangePassword chain from Part 4 into an actual credential with bloodyAD, the real cross-platform ACL abuse tool that pairs with Impacket's own SOCKS-proxy-friendly design.
-
BloodHound Deep Dive Part 7: Detecting SharpHound and LDAP-Based ACL Abuse
What SharpHound's own documented collection behavior leaves in the event log, why 4662 volume is the tell, and the defensive case for running BloodHound against your own domain before an attacker's copy does.
-
BloodHound Deep Dive Part 8: A Full Walkthrough, From Foothold to a Graph-Confirmed Credential
Tying all seven parts together against CONTOSO.LOCAL: collection, ingestion, querying, and ACL abuse in order, and what it means that the graph runs out of edges before Domain Admins.
-
Sn1per Deep Dive Part 8: The Windows Target and What Nuke Mode Never Touched
Building a genuine Windows target for the Sn1per lab and running the tool against it for real, including the one finding it never even scanned for.
-
Sn1per Deep Dive Part 9: What a Pen Tester Without Sn1per Would Have Found
The same Windows target, worked by hand with nmap, curl, and two modern credential tools, set against what Sn1per's own automated run actually delivered. Closing post for the Sn1per Deep Dive series.
-
Sn1per Deep Dive Part 7: Verified With Root
Six posts read Sn1per from source without ever running it live. This one reruns the tool for real, with root, against a rebuilt lab, and checks every prediction against what actually happened.
-
Sn1per Deep Dive Part 1: From Recon Script to Attack Surface Platform
Sn1per orchestrates 90+ tools into one scan. This opens a new series on how it actually works, verified from the real Community Edition source rather than the marketing page.
-
Sn1per Deep Dive Part 2: What Discover and Recon Mode Actually Run
Sn1per's discover and recon modes chain together nmap, Amass, Subfinder, Sublist3r, crt.sh, and Shodan into one deduplicated target list. Read directly from the Community Edition source, with a real correction from root-verified testing.
-
Sn1per Deep Dive Part 3: Web Mode, Sc0pe, and the Vulnerability Scoring Engine
Sn1per's sc0pe engine is a directory of tiny declarative bash templates, each matching one header or one string, rolled up into a single per-host risk score. Read from the real source, with two real bugs confirmed by later root-verified testing.
-
Sn1per Deep Dive Part 4: Workspaces, Reporting, and the Professional 2026 Architecture
What Sn1per Professional 2026 adds over the free Community Edition, documented from the vendor's own release notes since the Pro engine isn't in the public source tree.
-
Sn1per Deep Dive Part 5: What an Automated Sweep Looks Like From the Blue Team's Side
Sn1per's default scan modes fire real, unconditional exploit attempts against old CVEs the instant a banner matches. That's expensive for an attacker to hide and cheap for a defender to detect, and root-verified testing found a genuine defensive win too.
-
Sn1per Deep Dive Part 6: A Full Sweep Against Northbridge Freight
Applying Sn1per's real recon-to-exploit logic, mode by mode, against a small local lab, then handing off to Impacket and Pivoting and Tunneling for the part the automation can't do.
-
Container Networking Deep Dive Part 1: From Namespaces to a Container Network by Hand
Before Docker automates any of it, build a container network by hand: two network namespaces, a veth pair each, a Linux bridge, and one iptables NAT rule. Everything Docker does later is this, generated for you.
-
Container Networking Deep Dive Part 10: A Full Walkthrough, Chasing a Cross-Node Connectivity Bug
A checkout service scales out, starts failing calls to a payment gateway on a different node, and the failure turns out to be two separate problems stacked on top of each other. A start-to-finish walkthrough using every technique from this series.
-
Container Networking Deep Dive Part 2: Docker's Default Bridge Model, Unpacked
Install Docker and run the same two-container topology from Part 1 with docker run instead of ip netns. Then read the actual iptables rules and docker0 bridge Docker generated, line for line, against the ones written by hand.
-
Container Networking Deep Dive Part 3: Docker Network Drivers Compared
bridge, host, macvlan, ipvlan, and none are not five ways to do the same thing. Each one trades away a specific piece of isolation, performance, or addressing flexibility. A driver-by-driver comparison with the actual tradeoff each makes.
-
Container Networking Deep Dive Part 4: Multi-Host Overlay Networking and the VXLAN Underneath It
A Docker Swarm overlay network makes containers on different hosts look like they share a bridge. VXLAN encapsulation is how, and it costs 50 bytes of every packet's MTU budget, the same overhead this series already covered from the tunneling side.
-
Container Networking Deep Dive Part 5: What CNI Actually Is
Kubernetes doesn't use Docker's networking model. It defines a plugin interface instead, CNI, with a lifecycle of exactly two verbs. Why one-IP-per-pod forced that split, and what a CNI plugin actually does when a pod starts.
-
Container Networking Deep Dive Part 6: CNI Plugins Compared, Flannel, Calico, and Cilium
Three CNI plugins solve the same ADD-verb reachability problem three different ways: VXLAN encapsulation, BGP-distributed routes, and an eBPF datapath. The architecture and datapath differences, not a feature-checklist bake-off.
-
Container Networking Deep Dive Part 7: eBPF-Native Networking and the End of kube-proxy
kube-proxy's default iptables mode chain-walks a rule per backend, per packet. Cilium's kube-proxy replacement skips that entirely, at the socket layer, before a packet is even built. What kube-proxy actually does, and what changes when eBPF replaces it.
-
Container Networking Deep Dive Part 8: Network Policy Enforcement Compared, iptables vs eBPF
The same Kubernetes NetworkPolicy resource gets enforced completely differently depending on the CNI plugin underneath it. Calico's default path turns it into iptables rule chains; Cilium turns it into eBPF map lookups keyed on pod identity. Same intent, different mechanism, different failure modes.
-
Container Networking Deep Dive Part 9: Troubleshooting Container Networking
A vendor-neutral methodology for the five failure modes that account for most container networking outages: conntrack exhaustion, VXLAN MTU fragmentation, DNS-in-pod failures, cross-node connectivity breaks, and tcpdump inside a network namespace.
-
OSPF on Linux Part 1: A Brief History of Routing on Linux
The first post in a companion series to OSPF Deep Dive: how Linux went from a kernel that could route packets but not speak a routing protocol, through GNU Zebra and Quagga, to FRRouting. History first, because the config in Part 3 makes more sense once you know why it looks the way it does.
-
OSPF on Linux Part 2: Why FRRouting Is the Defacto Choice
The zebra/protocol-daemon/vtysh architecture from the inside, FRR against its one real remaining competitor, BIRD, and why FRR's Cisco-shaped CLI is a genuine advantage for this specific series rather than a cosmetic one.
-
OSPF on Linux Part 3: Installing and Configuring OSPF with FRR
Getting FRR onto a Linux box for real: the package, the users it creates without asking, the daemon on/off switch in /etc/frr/daemons, and the first router ospf block in vtysh. Verified against a real install, not written from memory.
-
OSPF on Linux Part 4: Wiring LAB-LNX into the OSPF Deep Dive Lab
Adding a fourth router to CORE-CSR, BRANCH-FGT, and EDGE-MX: a Linux box running the FRR config from Part 3, walked from Down to Full against the neighbor state machine from OSPF Deep Dive Part 1, with an LSDB parity check across all four platforms.
-
OSPF on Linux Part 5: Troubleshooting OSPF on Linux
The closing post: OSPF Deep Dive Part 11's three-vendor show-command table extended to four with FRR's vtysh, then the failure modes that only exist on Linux, ip_forward, a firewall dropping protocol 89, multicast group membership, the wrong network namespace, veth MTU, and tcpdump on the wire.
-
Building a Home Lab Honeypot: Watching What Actually Knocks on Your Door
A ~50-line Python TCP honeypot, tested live in a sandbox with real logged connection attempts, deployable on Herald behind an nftables DNAT rule — what a low-interaction canary actually catches and why that's worth more than it sounds.
-
DNS Tunneling and Covert C2: iodine, dnscat2, and Catching It on the Wire
DNS is the one protocol almost every egress policy leaves wide open. iodine's real --help output and dnscat2's documented client/server model show why — plus the query-entropy and NXDOMAIN signals that actually catch it, tied back into the CONTOSO.LOCAL pivoting lab.
-
Living Off the Land: certutil, mshta, rundll32, and Bitsadmin as Attacker Primitives
The LOLBAS project's own documented syntax for certutil, mshta, rundll32, and bitsadmin — signed Microsoft binaries repurposed as download-and-execute primitives against WKS01 in the CONTOSO.LOCAL lab, plus the Sysmon event IDs that actually flag it.
-
Password Cracking and Wordlist Engineering Part 1: The Hash Landscape and Why Offline Cracking Is a Different Game
Every post in the Impacket series ended with a hash. This one starts there: what NTLM, Kerberoast, and AS-REP hashes actually are, why offline cracking is a fundamentally different problem from an online login attempt, and the hash landscape the rest of this series works through.
-
Password Cracking and Wordlist Engineering Part 2: Hashcat Fundamentals and the GPU Economics of Cracking
Verified against a real hashcat v6.2.6 install and a published RTX 4090 benchmark run: the actual attack-mode syntax, the real mode numbers for NTLM, Kerberoast, and AS-REP, and what it genuinely costs — in dollars, not hand-waving — to exhaust a keyspace against each one.
-
Password Cracking and Wordlist Engineering Part 3: John the Ripper, Core vs Jumbo, and When to Reach for It
apt install john does not give you a tool that can crack a Kerberoast hash — verified firsthand, not assumed. The distinction between core John the Ripper and the Jumbo community fork, and the cases where JtR earns a place next to hashcat rather than duplicating it.
-
Password Cracking and Wordlist Engineering Part 4: Building Wordlists That Actually Work
rockyou.txt is fourteen million real, breached passwords from 2009 — and it's the wrong tool the moment a target has any pattern to its passwords at all. Verified cewl and crunch syntax for building wordlists that actually match how a specific organization names things.
-
Password Cracking and Wordlist Engineering Part 5: The Rule Engine, best64, and Writing Your Own Mutations
B4ckup$SQL2024 isn't in any wordlist — it's a wordlist entry plus a predictable transform. Walking hashcat's real, bundled best64.rule line by line, what its 102 rules actually do, and writing a custom rule for the one leetspeak substitution best64 doesn't cover.
-
Password Cracking and Wordlist Engineering Part 6: Mask and Hybrid Attacks, and the Keyspace Math Behind Them
No wordlist, no rules — masks build candidates character-position by character-position, and a 40,824-line "compliant password" mask set bundled with hashcat covers realistic complexity-policy shapes 65,000 times more efficiently than blind brute force. The keyspace math for why.
-
Password Cracking and Wordlist Engineering Part 7: Cracking CONTOSO.LOCAL End to End
Two hashes the Impacket series pulled off CONTOSO.LOCAL and stated the plaintext for without explaining how. This post runs the actual pipeline — baseline wordlist, OSINT-built vocabulary, custom rules, and a combinator-plus-hybrid chain — that gets from ciphertext to both passwords.
-
Password Cracking and Wordlist Engineering Part 8: The Defensive Mirror — Passphrases, KDFs, and Why Rotation Policies Miss the Point
Seven parts of offense, closing with the defense that actually follows from it: why bcrypt/scrypt/Argon2 cost tuning matters more than complexity rules, what NIST SP 800-63B Revision 4 actually changed about rotation, and what specifically would have stopped both CONTOSO.LOCAL cracks.
-
Pivoting and Tunneling Part 1: Why Pivoting Is Just Routing With Extra Steps
Extending the Impacket lab with a segmented finance VLAN you can't reach directly, then working through SSH -L/-R/-D and SOCKS/proxychains as the baseline pivoting toolkit — and exactly where that baseline runs out of road.
-
Pivoting and Tunneling Part 2: Chisel and the HTTP Tunnel That Looks Like Nothing
Chisel's server/client model verified against the real v1.11.8 --help output — reverse SOCKS over plain HTTP, fingerprint-pinned key exchange, and why a tool that requires no SSH on the target still gets past egress policy that SSH itself can't.
-
Pivoting and Tunneling Part 3: ligolo-ng and Tunneling Without Proxychains
ligolo-ng's TUN-interface architecture verified against the real v0.9 binary — how a gVisor userland network stack turns a reverse connection into something your OS routing table treats as a real interface, no SOCKS or LD_PRELOAD required.
-
Pivoting and Tunneling Part 4: What Tunneling Does to Your Packets — MTU, Fragmentation, and PMTUD Inside a Tunnel
Every tunnel in this series stacks a new MTU on top of the path's real one. Why that makes Path MTU Discovery quietly fail inside pivots, why big transfers over a pivot "just hang," and how to diagnose it with the same tooling behind pmtud-sweeper.
-
Pivoting and Tunneling Part 5: Double Pivots, Multi-Hop Chains, and Catching Them From the Wire
Chaining a tunnel inside a tunnel to reach FIN-DB01 through two hops, why each additional hop compounds the MTU problem from Part 4, and the flow-level signals that actually catch multi-hop pivoting on a monitored fabric.
-
Pivoting and Tunneling Part 6: Defense in Depth — Segmentation, Egress Filtering, and Catching a Pivot on a Fortinet Fabric
The full chain from Impacket foothold to FIN-DB01 told end to end, followed by a concrete hardening checklist — internal segmentation firewalling, default-deny egress, TLS inspection, and the flow-based indicators from this series mapped onto real Fortinet configuration.
-
Netcat: The Swiss Army Knife of TCP/IP, A Deep Dive
Netcat's origins and the OpenBSD/GNU fork split, core socket mechanics, file transfer and port scanning, bind vs reverse shells (with the mkfifo workaround for -e-less builds), and HTTP banner grabbers, mock servers, and relays — with firewall-testing use cases throughout.
-
The Hidden Kali Linux Shield: How Firejail Sandboxes Dangerous Exploits Without the VM Overhead
Firejail wraps any process in Linux namespaces, seccomp-bpf, and capability drops in milliseconds — no VM spin-up. How it actually isolates a process, real GitHub-PoC and exploit-testing workflows, and the root-user gotcha that quietly guts it on Kali.
-
Cilium: Kubernetes Networking and Security Built on eBPF
Cilium replaces iptables-based kube-proxy and overlay CNIs with eBPF programs on the kernel datapath. Connects back to namespaces, veth pairs, nftables, and eBPF/XDP, then covers identity-based network policy and Hubble observability.
-
Nmap and the Scripting Engine: A Network Engineer's Field Guide to NSE
Nmap's scan engine and NSE scripting framework are as useful for firewall change validation and inventory work as for security assessments. Covers scan types, timing, NSE categories, writing a custom script, and practical recipes for network engineers.
-
strncpy Is Finally Gone: What Linux 7.2-rc1 Means for Kernel Security
Linus opened the 7.2 merge window and tagged 7.2-rc1 — and with it, strncpy() is finally gone from the kernel tree. Six years, 362 commits, 70 contributors. Here's what the function actually did wrong, why it took so long to kill, and why removal beats deprecation.
-
Linux Network Namespaces: Isolated Network Stacks Without a Hypervisor
Network namespaces give a process its own interfaces, routing table, iptables rules, and sockets — completely isolated from the host. They underpin Docker, Kubernetes, and VPNs. This post covers how they work and how to use them hands-on.
-
nftables: The Modern Netfilter Framework Every Network Engineer Should Know
nftables replaced iptables as the default Linux firewall framework years ago, but most existing guides and scripts still assume iptables syntax. This post covers the nftables model properly — tables, chains, sets, maps — and how to think about it coming from an iptables or FortiGate policy background.
-
eBPF and bpftrace: Network Observability Without Touching the Packet Path
eBPF lets you attach tiny programs to kernel hooks — TCP state changes, socket events, XDP ingress — with zero packet-path overhead and no kernel modules. bpftrace makes it scriptable. This post covers both for network engineers.
-
Bash Patterns Every Network Engineer Should Know
Most network engineers write bash defensively, copying patterns from old scripts without understanding why they work. This post covers the patterns that actually matter — strict mode, parallel SSH fan-out, retry logic, and structured output — with an emphasis on what breaks when you skip them.
-
Deeper Than tcpdump: NIC Diagnostics with ethtool and Protocol Analysis with tshark
ethtool exposes the NIC hardware state that sits below anything tcpdump can see — link negotiation, ring buffers, offload settings, error counters. tshark adds full protocol decode on top of tcpdump's capture model. Together they cover the diagnostic gap between 'the cable is fine' and 'I can read every field in this packet.'
-
Linux VRFs: Route Isolation Without the Namespace Overhead
Linux VRFs give you FortiGate-VDOM-style routing table separation on a single network stack, without the full isolation (and overhead) of network namespaces. This post covers the l3mdev model, VRF creation, route leaking, and when VRFs are the right tool versus namespaces.
-
jq for Network Engineers: Parsing APIs, Routing Tables, and Structured Logs
jq is the missing piece between modern JSON-emitting tools — ip -j, ss -j, REST APIs — and the shell. This post covers the filter language properly: selection, mapping, construction, and the patterns that come up constantly when automating network infrastructure.
-
Replacing netstat with ss: A Network Engineer's Diagnostic Guide
ss is the modern replacement for netstat — faster, richer, and capable of exposing per-socket TCP internals that netstat never could. This post covers the filter syntax, TCP state analysis, and the diagnostics that matter when troubleshooting live connections.
-
Beyond ifconfig: The ip Command Reference Every Network Engineer Needs
The ip command from iproute2 replaced ifconfig and route over a decade ago, but most guides still treat it as a drop-in substitute. This post covers the full model — interfaces, addresses, routes, policy routing, ARP, and live monitoring — with practical examples aimed at network engineers.
-
Traffic Control Under the Hood: A Linux tc Deep Dive for Network Engineers
tc is the Linux traffic control subsystem behind netem, HTB shaping, and DSCP-aware queuing. This post explains the model properly — qdiscs, classes, filters — then builds a practical lab rig for testing SDWAN Performance SLA thresholds and QoS behaviour.
-
Building an Enterprise-Grade NTP Service with chrony and Integrating it with FortiGate: Chronos Keeps Time
Why we chose chrony over ntpd and timesyncd, what CIS and Fortinet hardening guides say about NTP, a full build walkthrough, the deny-all ordering mistake every network engineer will make, and how to generate NTP keys that FortiOS will actually accept.
-
Advanced tcpdump Recipes for the Enterprise Engineer: The Packet Never Lies
Bitwise BPF masking, enterprise recipes for asymmetric routing and retransmission hunting, a safe SSH-to-Wireshark live-streaming setup that won't loop your own session, and a cross-vendor capture map spanning Debian, Cisco IOS, FortiOS, Junos, and VeloCloud.
-
spectre-meltdown-checker: Auditing CPU Vulnerability Mitigations on Linux
A deep dive into spectre-meltdown-checker — how it actually works under the hood, what it tells you that /sys/devices/system/cpu/vulnerabilities does not, the alternative tools (lscpu, vendor microcode checkers, in-tree kernel reporting), and when to reach for each one on a production Linux box.
-
Generating a Constant Stream of Web Traffic with Python
A small, polite Python script that round-robins through ten popular public sites at a configurable rate — useful for homelab traffic, exercising a proxy, or learning the requests library. Walks through the full code, the safety rails, and how to run it under tmux.
-
Resilient DNS at Home: Building an HA Pi-hole Pair on Raspberry Pi
A complete walkthrough for installing Pi-hole on a Raspberry Pi running current Raspbian, then turning a single box into a highly available pair using keepalived and Orbital Sync — with the config examples and show commands you'll actually use.
-
Building a FortiManager Lab on Proxmox — Part 3: Proxmox Networking, Linux Bridges, VLAN-Aware Bridges and SDN for the Lab
Part 3 of the FortiManager-on-Proxmox series. Designs the four-segment lab network, compares Linux bridges, VLAN-aware bridges and Proxmox SDN, walks through the /etc/network/interfaces shape, and explains why the lab bridges should never have an IP on the host.
-
iptables to nftables: Migrating Production Firewalls Without Downtime
A working engineer's guide to moving from iptables to nftables on production Linux firewalls — the mental model shift, where iptables-translate misleads you, atomic ruleset swaps, and a clean rollback strategy that means a bad migration costs you seconds, not your weekend.
-
Linux Networking from the Ground Up: Network Namespaces, veth Pairs, and Building a Multi-Router Lab on One Host
Build a real multi-router BGP and OSPF lab on a single Linux box using network namespaces, veth pairs, and FRRouting — no VMs, no containers, no GNS3. A practical walk-through of the primitives that GNS3, Docker, and Kubernetes are quietly using under the hood.
-
Network Emulation with NETEM: Simulating Latency, Loss, Jitter, and Bandwidth Constraints for Realistic Lab Testing
A practical guide to using Linux's NETEM qdisc to bend networks to your will — adding latency, loss, jitter, duplication, reordering, and bandwidth caps so you can test how applications and protocols actually behave when the network is anything other than perfect.
-
SSH Hardening Beyond the Basics: Certificate Authorities, Bastion Patterns, and Session Auditing
A production-grade SSH setup that goes beyond disabling password auth — running your own SSH CA with short-lived user and host certificates, ProxyJump bastions, ForceCommand restrictions, and recording sessions with tlog and auditd.
-
tcpdump Deep Dive: BPF Filters, Capture Rotation, and Cross-Mapping to FortiGate's diagnose sniffer packet
A practical, command-heavy guide to getting real value out of tcpdump — precise BPF filters, production-grade ring-buffer captures, and a side-by-side mapping to FortiGate's diagnose sniffer packet so you can switch between the two without losing your place.