Tagged: Security
180 posts · browse all tags
-
CVE-2026-0322 on PAN-OS: High Privileges Required, Root Delivered
CVE-2026-0322 is an authenticated code injection in the PAN-OS management interface that gives root. It scores 8.6, it is being exploited, and the score undersells why you should patch now.
-
PEERSTITCH: What a FortiManager Compromise Leaves Behind After You Patch It
Unit 42 describes a memory-only FortiGate implant, PEERSTITCH, deployed after a FortiManager breach and a CVE-2025-61624 privilege escalation. The patch closes the doors. It does not revoke what was already stolen.
-
CVE-2026-76504 and Cisco's October 2026 Fixes: SD-WAN Manager, NX-OS, APIC and License On-Prem
One exploited Catalyst SD-WAN Manager authentication bypass (CVE-2026-76504, CVSS 9.8, on CISA KEV) and a seven-day-later batch of 14 advisories covering NX-OS, APIC and License On-Prem, including a CVSS 10.0 that is not the one being exploited.
-
FortiBleed Update: the FBI and Secret Service Advisory, and the FortiMail Zero-Day CVE-2026-104286
The FBI and Secret Service now put FortiBleed at 86,644 compromised FortiGates and say attackers are locking admins out. Separately, FortiMail CVE-2026-104286 (CVSS 9.8) was exploited before a patch existed. What changed, what is unrelated, and what to check.
-
FortiClient EMS 7.4.5: The Fix for One Critical Bug, the First Version Hit by the Next
FortiClient EMS 7.4.5 fixed CVE-2026-21643 and was the first version affected by CVE-2026-35616. Both are critical and unauthenticated. Affected versions, fixed builds and the 7.4.7 upgrade traps, from Fortinet's own advisories.
-
Host-Based Detection Part 9: Alternatives, and Handing Off to the Blue Team
OSSEC, Sysmon, auditd, osquery, Falco, and commercial EDR, compared honestly against Wazuh. Then a straight list of what the next series still has to do, now that a real domain controller and two real managers exist to test it against.
-
Host-Based Detection Part 8: Active Response, or When Wazuh Hits Back
Every other module in this series watches and tells you. Active response acts on its own. What the mechanism actually looks like, and a real lockout story from elsewhere on this site that explains why the timeout matters.
-
Host-Based Detection Part 7: How a Log Line Becomes an Alert
A raw log line becomes an alert in exactly two steps: decode, then match. How Wazuh's default ruleset already covers SSH, PAM, and sudo with zero custom rules, and where a shipped check turned out to be wrong.
-
Host-Based Detection Part 6: File Integrity Monitoring and Rootcheck
FIM, rootcheck, and SCA all answer some version of is this system still what I think it is, and none of them should be trusted blind. What each one actually checks, with real findings from a real run.
-
Host-Based Detection Part 5: Enrolling a Real, Mixed Fleet
A manager with no agents is an expensive way to look at an empty dashboard. What actually happens enrolling a real Raspberry Pi, and separately a genuinely mixed Linux-and-Windows lab fleet, into Wazuh.
-
Host-Based Detection Part 4: Standing Up a Manager, Two Different Ways
Two real Wazuh managers already exist on this site's infrastructure, built for opposite reasons. What the contrast between a shared homelab instance and a disposable lab one actually teaches about sizing and placement.
-
Host-Based Detection Part 3: Agent, Manager, Indexer, Dashboard, and What 5.0 Changes
Agent, manager, indexer, dashboard: how Wazuh's pieces fit together in the 4.14.x line both of this site's real deployments run, and what a still-in-beta 5.0 changes underneath all of it.
-
Host-Based Detection Part 2: From OSSEC to Wazuh, and What Actually Changed
OSSEC didn't stagnate the way it's often described, and Wazuh's 2015 fork happened for specific, checkable reasons. The real history behind the tool already running on two of this site's own boxes.
-
Certificate Required, Credentials Not: CVE-2026-93952 and the Second VeloCloud Orchestrator 10.0 of the Summer
Arista's SA 0183 discloses CVE-2026-93952, an actively exploited CVSS 10.0 flaw in on-prem VeloCloud Orchestrator that only bites when Edges authenticate with certificates. Fixes exist for 5.2 and 6.4, not yet 6.1 or 7.0, and July's patched builds are still exposed.
-
Host-Based Detection Part 1: What a HIDS Sees That a NIDS Never Will
This site has years of network-side detection content and almost none of the host-based half. Starting a nine-part series to fix that, built around two Wazuh deployments that already exist rather than a fresh lab.
-
Checked Out, Not Checked: Inside Plugin4Shell's Zero-Click Hit on Four AI Coding Agents
A SHA pin is supposed to mean a plugin can never silently change under you. AIR Security found that four major AI coding agents check out the pinned commit but never confirm they landed on it, and a git ref collision is enough to swap in different code while the pin still looks honored.
-
Metasploit Deep Dive Part 1: History, Editions, and the Shape of the Framework
Where Metasploit came from, what Framework vs Pro actually means today, and why a series about the most-covered tool in offensive security still has something to add.
-
Metasploit Deep Dive Part 10: Network-Level Detection Engineering
What a network monitor can actually see in the meterpreter handshake and default transports, deliberately narrowed to the wire, since host-based detection is a separate series once its lab work lands.
-
Metasploit Deep Dive Part 11: RPC and msgrpc Automation
msfrpcd, MessagePack vs JSON-RPC, virtual consoles, and how the framework exposes itself to outside code, real source, the same layer AI Part 7 and Part 12's MCP server both build on top of.
-
Metasploit Deep Dive Part 12: msfmcpd, Rapid7's Own MCP Server
Five weeks after this site wired an LLM into Metasploit through a third-party MCP project, Rapid7 shipped a first-party one, with a safety model worth comparing directly against both that community project and this site's own MCP server.
-
Metasploit Deep Dive Part 13: Database, Workspaces, Loot, and Credential Tracking
The persistence layer underneath everything Parts 11 and 12 exposed: workspaces, hosts, services, vulnerabilities, credentials, and loot, and why an engagement's findings outlive any single msfconsole session.
-
Metasploit Deep Dive Part 2: Framework Internals, Modules, Mixins, and the Datastore
What Msf::Module actually is, why it's built from nineteen separate mixins instead of one class, and how the datastore turns 'set RHOSTS' into something every module type understands the same way.
-
Metasploit Deep Dive Part 3: Payload Architecture and What msfvenom Actually Builds
Singles vs. stagers vs. stages, what msfvenom is actually assembling, and the real encoder list behind a tool that's still doing the same job it did in 2003.
-
Metasploit Deep Dive Part 4: Meterpreter's TLV Wire Protocol, From Real Protocol Source
What actually goes over the wire once a meterpreter session is established: the packet header, the TLV encoding scheme, and how AES got layered on top of a protocol that started out XOR-obfuscated.
-
Metasploit Deep Dive Part 5: Transports Compared
reverse_tcp, reverse_https, bind_tcp, and the less obvious handlers the real framework ships, including two built specifically for pivoting through AWS rather than a raw socket.
-
Metasploit Deep Dive Part 9: Evasion in 2026, Honestly Assessed
What encoders, the dedicated evasion module category, and Metasploit 6.5's new features do and don't buy against modern AV and EDR, without recycling the 2015 version of this advice.
-
Metasploit Deep Dive Part 6: CVE-2014-3120, a Real Module, and Three Things Windows Defender Got Right
Running script_mvel_rce against the Elasticsearch 1.1.1 target this series has had waiting since Part 1, why the module never produced a session despite genuine SYSTEM-level RCE, and what checking Wazuh afterward turned up.
-
Metasploit Deep Dive Part 7: A Different Door, the Same Wall
Part 6 hit Windows Defender three times from an Elasticsearch MVEL exploit. Part 7 tries a completely different door — an unauthenticated SYSTEM-level Jenkins Groovy console — and finds exactly the same wall waiting on the other side.
-
Metasploit Deep Dive Part 14: Closing the Loop
Thirteen parts of internals, thirteen posts of "here's how the framework works." This one's different: no new commands, just going back through what actually happened in the lab and matching it up against the theory.
-
Metasploit Deep Dive Part 8: Pivoting Into the Blind Spot
Parts 6 and 7 exhausted stock Metasploit against a Defender-protected Windows host with no session to show for it. Part 8 moves to Linux, gets a clean foothold, and pivots into a segment the SIEM can't see at all.
-
Three CVEs, One Deadline, and a Bug That Waited Thirteen Years: This Week's Linux Kernel Headlines
CISA added three actively exploited Linux kernel CVEs to its KEV catalog this week with a two-day federal patch deadline. A fourth, a thirteen-year-old Open vSwitch bug with a public root exploit, hasn't made that list yet. Here's what each one actually does.
-
Enrichment Has to Come First: Adding IOC Lookups to the n8n Alert Router
Extending the Wazuh-to-chat n8n pipeline with an AbuseIPDB enrichment step ahead of the threshold decision — plus a real, source-level dig into why n8n's workflow static data silently stopped persisting inside the Code node's newer isolated-vm sandbox.
-
Close Enough to Matter: Inside CVE-2026-58704 on Pixel's Cellular Modem
Google patched an actively exploited elevation-of-privilege bug in the Pixel modem this month, alongside 109 other fixes that got far less attention. What's actually confirmed, what isn't, and who's doing more of the finding now.
-
Alert Fatigue Is a Routing Problem: A Wazuh-to-Chat Pipeline in n8n
A noisy SIEM is its own security problem — the fix isn't more alerts, it's better routing. Building and testing a Wazuh-to-chat pipeline in n8n, and two real bugs the build itself turned up.
-
Arista VeloCloud Edge HA Part 1: How Failover Actually Works, and CVE-2026-86106
On 9 September 2026 Arista disclosed four VeloCloud Edge and Gateway CVEs in one batch. This one, CVE-2026-86106, lives entirely inside the HA peer channel between two Edges, so Part 1 goes deep on how that channel actually works before explaining the bug in it.
-
Arista VeloCloud Edge HA Part 2: CVE-2026-86107, CVE-2026-86108, CVE-2026-86109, and the Fix
The other three VeloCloud Edge and Gateway CVEs from Arista's 9 September 2026 batch: a VCMP tunnel crash, an OS command injection in the management workflow, and a signature-validation gap in the update mechanism. All three share their fixed releases with Part 1's HA bypass.
-
Same Class, Different Door: CVE-2026-0310 and PAN-OS's Second Root-RCE Buffer Overflow of 2026
CVE-2026-0310 gives PAN-OS its second unauthenticated root-RCE buffer overflow of the year. A close comparison with May's CVE-2026-0300, and what the pattern says about perimeter firewalls generally.
-
No CVE Required: The Ted Backdoor Hiding Inside Your Own HAProxy Build
Rapid7 found a Linux implant compiled into HAProxy's own binary. No CVE, no patch, a recompiled build reports the same version string as a clean one. The mechanism, and why file integrity monitoring, not network visibility, is what would catch it.
-
Same Day, Two Advisories: Cisco's Nexus 9000 Root RCE and the IOS XR Hardening Bundle
Cisco's September 2 disclosures: an unauthenticated root RCE on ten Nexus 9000 models via two unrestricted TCP ports, and a seven-CVE IOS XR hardening bundle with no workaround anywhere in the product line. Plus why that second detail matters more than any CVSS score.
-
The Chain Nobody's Advisory Describes: FortiSandbox's Three CVEs, Read Together
A follow-up to this site's CVE-2026-25089 post: a threat intel firm reports that bug chained with two more FortiSandbox CVEs (file-read plus privesc) for unauthenticated root in practice. What's confirmed by Fortinet's own advisories versus what's one firm's account, held carefully apart.
-
Start VNC, Start a Shell: Inside CVE-2026-25089 on FortiSandbox
CVE-2026-25089 is a CVSS 9.8 unauthenticated OS command injection in FortiSandbox's Web UI, actively exploited since mid-June and on CISA's KEV list since July. No password, no CVE chaining, just a crafted request to a device that already sits inline reading everything suspicious you feed it.
-
Bash Redirection Tricks for Turning a Scan Into a Target List: Piping the Pentest
Real nmap output piped through awk, tee, process substitution, and xargs to turn a subnet scan into a fanned-out target list. The subject is the redirection mechanics, not the brute-force tool sitting at the end of the pipe.
-
Where Security Fabric Ends and FortiSASE Begins: One Fabric, One Agent
Security Fabric is the automation and visibility layer tying Fortinet devices together. FortiSASE is a cloud-delivered PoP that speaks the same fabric language. Neither is a bolt-on to the other, and the FortiClient agent is the thing that makes the seam disappear.
-
Same Job, Different Shell Part 8: Port and Service Testing
nc, curl, and bash's /dev/tcp trick against Test-NetConnection -Port: the real command-line way to answer "is the service actually listening on that port", plus real captured output showing the difference between open, closed, and filtered.
-
Same Job, Different Shell Part 9: Firewall Status, Read-Only
iptables -L, nft list ruleset, and ufw status against Get-NetFirewallRule and netsh advfirewall show: reading what a firewall currently allows without touching a single rule. Part 9 of the Windows/Linux command comparison series, and the natural next step after a port test comes back filtered.
-
Threat Intelligence and FortiGuard Tuning: Making IPS Signatures Actually Work for You
FortiGuard ships new IPS signatures constantly and most of them arrive with a default action nobody chose deliberately. The difference between a tuned IPS deployment and a noisy one isn't the signature database, it's what you do with the defaults.
-
24 Billion Credentials, 36 Sources, and 27 Records Actually Tagged "Redline"
Headlines called it the biggest credential leak in history. The researchers who found it can't say how many duplicates it contains or who ran the database. Here's what's verifiably inside the "24 billion password leak," and why one real detail matters more than the headline number.
-
A Backdoor Named forticloud-sync: Inside the Gunra Ransomware Advisory and Two Fortinet CVEs From Early 2025
Six agencies, one ransomware gang, and two Fortinet CVEs that have been patchable since early 2025 and are still getting exploited. The most interesting detail in the advisory isn't the encryption — it's an MFA bypass that leaves the identity provider's own logs looking completely clean.
-
From Dropbox to Daily Driver Part 1: Scoping the Rebuild and the Threat Model
The same Raspberry Pi 4 that played an attacker's call-home dropbox in Part 5 of the empty-port series gets reflashed as a legitimate, hardened remote-access device — starting with the threat model and the OS and storage decisions that shape everything after it.
-
From Dropbox to Daily Driver Part 2: Flashing the Card and the First Boot
Burning the 128GB microSD card, working through Raspberry Pi Imager's customisation screen — hostname, auth, and Raspberry Pi Connect left off — and a real first SSH login to the freshly flashed Pi, with the version-mismatch story between Raspberry Pi's downloads page and GitHub along the way.
-
From Dropbox to Daily Driver Part 3: Locking Down the Base OS
Real SSH keys installed on the Pi (with a genuine known_hosts detour left from the reflash), password auth switched off despite a cloud-init drop-in fighting back, a default-deny ufw firewall, unattended upgrades with a Debian-vs-Ubuntu config gotcha, and why fail2ban doesn't make the cut.
-
From Dropbox to Daily Driver Part 4: Adding TOTP Two-Factor Authentication
Real TOTP 2FA layered on top of key-only SSH: libpam-google-authenticator, PAM and sshd_config chaining, making the second factor mandatory, and a login that hung for reasons that turned out to have nothing to do with PAM at all.
-
From Dropbox to Daily Driver Part 5: Cloudflare Tunnel, Zero Trust Access, and a WebSocket That Wouldn't Handshake
Putting this Pi behind a Cloudflare Tunnel and a Zero Trust Access policy so it's reachable from anywhere without a single inbound port open, plus a real ingress bug that took a debug session and a cross-checked log to actually find.
-
From Dropbox to Daily Driver Part 6: Standing Up a Wazuh Manager, and Why the VM Wouldn't Boot
Every layer this series has built so far assumes I'm the only one who'd ever notice if something went wrong. Standing up a Wazuh manager on pve to actually change that, plus a VM that dropped straight into a rescue shell and a small Proxmox API gotcha on the way there.
-
From Dropbox to Daily Driver Part 7: Wiring the Pi In as a Wazuh Agent
Part 6's Wazuh manager gets its first agent: the Pi, confirmed alerting on SSH/PAM/sudo out of the box, then a real SCA configuration audit against CIS benchmarks, real fixes, real false negatives sorted from real gaps.
-
From Dropbox to Daily Driver Part 8: An Ansible Control Node, a Second Pi, and What changed=0 Actually Proves
Turning seven parts of manual hardening into something a machine can run: a dedicated Ansible control node, a second Pi built specifically to prove reproducibility, a real gotcha in check mode explained honestly, and a second playbook run that changed nothing at all.
-
From Dropbox to Daily Driver Part 9: The Closing Checklist, and What Actually Changed Since Part 5
A closing checklist of every security layer this build actually has and verified, which pieces are Raspberry Pi-specific versus reusable anywhere, and the full-circle comparison back to this same Pi's stint as an attacker's dropbox.
-
Five Minutes and an Empty Port Part 1: A Field Guide to Network Implant Hardware, and Why This Still Works
Opening a series on the pocket-sized hardware that turns thirty seconds of physical access into a foothold: a history of the category, a threat model for why it still works in 2026, and a taxonomy of the three tool families this series covers before it turns to defense.
-
Five Minutes and an Empty Port Part 10: The Closing Checklist and a Vendor Comparison
Closing the series: a practical checklist pulling Parts 7 through 9 together, and a straight comparison of how Cisco, Fortinet, Juniper, and Arista actually implement each control.
-
Five Minutes and an Empty Port Part 2: Shark Jack, Packet Squirrel, and LAN Turtle
The three purpose-built Hak5 wired implants compared on what they actually do between plug-in and pull-out: Shark Jack's quick-strike recon and exfil, Packet Squirrel's inline man-in-the-middle, and LAN Turtle's long-term covert remote access.
-
Five Minutes and an Empty Port Part 3: Bash Bunny, Key Croc, and O.MG Cable, or Why 802.1X Never Sees This Coming
The USB HID family, Rubber Ducky, Bash Bunny, Key Croc, and O.MG Cable, attacks the endpoint by exploiting a design decision from the 1990s: a USB keyboard is implicitly trusted, and no network control this series covers can see it happen.
-
Five Minutes and an Empty Port Part 4: WiFi Pineapple, Flipper Zero, and the ESP32 Marauder
The wireless family needs no cable and no physical port at all, just proximity to the air. WiFi Pineapple's PineAP suite, the Flipper Zero's ESP32 Marauder add-on, and bare ESP32 deauther boards compared honestly, including what MAC randomization has actually killed since 2014.
-
Five Minutes and an Empty Port Part 5: Building a Real Call-Home Dropbox on a Raspberry Pi 4
A real LAN Turtle-style dropbox built and tested live on a Raspberry Pi 4: a cloud-init race condition that took three rebuilds to diagnose, and a Cloudflare Tunnel call-home path proven end to end with a real reboot-recovery test.
-
Five Minutes and an Empty Port Part 6: A Full Walkthrough, From Empty Port to Persistent Access
A single illustrative engagement chaining every tool family from Parts 2 through 5 into one narrative, from a five-minute reception-desk recon to a persistent call-home channel, closing on real cost and dwell-time numbers before the series turns to defense.
-
Five Minutes and an Empty Port Part 7: Port Security and the Layer 2 Hygiene Most Networks Already Own
The defensive turn starts at the layer that would have stopped Part 6's persistent dropbox outright: port security, DHCP snooping, Dynamic ARP Inspection, and the rest of the Layer 2 hygiene most switches can already do without buying anything new.
-
Five Minutes and an Empty Port Part 8: 802.1X, MAB, and the NAC Platforms Behind the Curtain
Port security answers whether a device is the one already learned on a port. 802.1X and the NAC platforms behind it answer the harder question: whether this specific identity, on this specific device, should be on the network at all.
-
Five Minutes and an Empty Port Part 9: MAC Filtering, USB Device Control, and Wireless IDS
Closing the defensive arc: MAC OUI and vendor filtering with an honest look at how easily it's defeated, OS-level USB device control for the HID vector Part 3 was built around, and wireless IDS for the one attack in this series MAC randomization never touched.
-
Checking Your Own Public Footprint Part 1: Why Registrars, Defaults, and Time All Drift
A practical series on auditing what's publicly known about you: domain records, usernames, code, and history. Part 1 covers why the audit is worth doing at all, even if nothing has gone wrong yet.
-
Checking Your Own Public Footprint Part 2: Reading Your Own WHOIS, RDAP, and Certificate History
A walkthrough of the whois command, how .uk individual privacy actually works, how RDAP bootstrapping finds the right server, and pulling your own certificate transparency history from crt.sh.
-
Checking Your Own Public Footprint Part 3: What a Username Reveals, and How to Check It Safely
Using Maigret to check what accounts are tied to a username, run against a purpose-built decoy identity rather than a real handle, and why an automated match count needs a second look before you trust it.
-
Checking Your Own Public Footprint Part 4: Code, Secrets, and What's Sitting in Your Own Repos
Scanning your own public repositories for leaked secrets with gitleaks and TruffleHog, checking what's publicly indexed about your own IP space with Shodan's InternetDB, and what's hiding in a file's metadata.
-
Checking Your Own Public Footprint Part 5: The Wayback Machine, Dorking, and a Safe Way to Check Breaches
Finding stale pre-privacy WHOIS snapshots on the Wayback Machine, basic search-engine dorking against your own name, and checking passwords against real breach data without ever sending the password anywhere.
-
Checking Your Own Public Footprint Part 6: Closing the Gaps You Just Found
The actual registrar privacy toggle, the Nominet individual opt-out request, requesting removal of a stale archived page, and the general hygiene changes worth making once, not per finding.
-
Checking Your Own Public Footprint Part 7: Automating the Whole Audit With SpiderFoot
SpiderFoot automates most of what this series just did by hand in one pass. What it actually wraps, what it still can't do for you, and a short checklist to run the whole audit yourself.
-
The One DNS Patch That's Actually Wormable: Inside CVE-2026-62878 on Windows DNS Server
August 2026 Patch Tuesday shipped four separate Windows DNS Server RCE fixes. Only one is unauthenticated, needs no user interaction, and is a wormable stack-based buffer overflow: CVE-2026-62878, CVSS 9.8, on a service that's usually running directly on your domain controllers.
-
Two Ways to Lose a VPN Gateway: FortiBleed's Credential Harvest and PAN-OS's Forged Auth Cookie
Two 2026 VPN gateway incidents, same attack surface, opposite root causes. FortiBleed has no CVE and no patch: a hashing migration that never finished, cracked at scale. CVE-2026-0257 is a real code defect: a certificate reused for two trust purposes that led straight to Qilin ransomware.
-
One Crafted Request From a Reload: Inside CVE-2026-20349 on Cisco Secure Firewall ASA and FTD
An unauthenticated attacker who can reach the Remote Access SSL VPN service on an ASA or FTD device can crash it with one crafted HTTP request. No login, no workaround, just a reload. What CVE-2026-20349 actually is, and why VPN-facing edges keep being the softest part of the firewall.
-
Seven CWEs, One Advisory: Cisco's August 2026 IOS XE Hardening Release
Cisco's IOS XE team ran the same internal-review model it used on Catalyst SD-WAN in August, grouping fixes by CWE class instead of shipping one CVE per bug. Seven CVE IDs, seven vulnerability classes, no known exploitation, and the same AI-assisted discovery line in the source section.
-
The Wildcard That Wasn't: CVE-2026-26035 and FortiWeb's RADIUS Admin Login Bypass
A non-default setting meant to make RADIUS group matching more flexible turns into a way to log into FortiWeb's GUI and CLI with a username and password that don't need to be correct. CVE-2026-26035, and why "wildcard" is a word worth treating with suspicion in any auth config.
-
Wearing Someone Else's Certificate: CVE-2026-70468 and FortiManager's FGFM Trust Model
A specific CLI option, a valid certificate, and a crafted FGFM request are enough to let one managed FortiGate impersonate any other in the eyes of its FortiManager. CVE-2026-70468, and what it says about certificate trust in a one-to-many management protocol.
-
BGP Deep Dive Part 12: Security, or Why BGP Trusts You Until Proven Otherwise
BGP was built on trust between operators, not cryptographic proof. Real hijack incidents, RPKI/ROV, BGPsec, and MANRS: what actually protects the internet's routing today.
-
NatJack: What a NAT-Table Hijack Means When You're the One Designing the NAT Boundary
NatJack broke a twenty-year-old assumption about who you can trust behind a shared NAT. Most of the coverage this week is either pure vulnerability research or "check your home router." This is the multi-tenant hub version of that question.
-
One CSV Upload From Root: Inside CVE-2026-20245 on Cisco Catalyst SD-WAN Manager
A rogue peering connection, a password changed and quietly changed back, then one crafted CSV file that turned an admin session into root. Mandiant's writeup of CVE-2026-20245 is the missing middle chapter between this site's UAT-8616 post and August's hardening release.
-
The Judgment Gap Just Got Numbers: Two 2026 Surveys on AI Pentesting Tools
The AI Pentest Agents series closed by arguing these tools need a human checking their work, not replacing it. Two independent surveys published within weeks of that series wrapping just put real numbers on exactly that gap.
-
Declare Yourself Trusted: Inside UAT-8616's Three-Year Run Against Cisco Catalyst SD-WAN
Two maximum-severity Cisco Catalyst SD-WAN authentication bypasses, one threat actor, three years of quiet control-plane access. What CVE-2026-20182 and CVE-2026-20127 actually broke, how UAT-8616 used it, and what the fix demands beyond patching.
-
Marking Its Own Homework: Inside Cisco's August 2026 Catalyst SD-WAN Hardening Release
Three months after UAT-8616 forced Cisco's hand on SD-WAN, a different kind of disclosure: an internal security review, five CWE-grouped CVEs up to CVSS 9.9, and an admission that some of the bugs were found by AI models, not people.
-
BitBang CLI Part 2: What a WebRTC Reverse Shell Looks Like From the Wire
bitbang-cli needs no listener, no attacker-run infrastructure, and no SSH client on the target to get an outbound shell and LAN proxy. What that means next to Chisel and ligolo-ng, and what actually shows up in logs and on the wire when it runs.
-
CVE-2026-45504 Part 1: Why On-Prem Exchange Is an Active Directory Attack Surface
On-prem Exchange has always been a heavily-trusted AD citizen, not a bolt-on app server. This series scopes a real, patched CVE against that history, and against a credential this blog already spent two other series getting a working password for.
-
CVE-2026-45504 Part 2: Inside the WOPI SSRF and Arbitrary File Read
A technical walkthrough of what CVE-2026-45504 actually does: a missing scheme check on an EWS ReferenceAttachment's provider URL, cited to Microsoft's advisory and HawkTrace's published research rather than reproduced as working exploit code.
-
CVE-2026-45504 Part 3: Why One Mailbox Credential Is Enough
svc-legacy-scan's cracked password has already powered two other series on this blog. CVE-2026-45504 shows what the same credential is worth against Exchange, with no ACL abuse and no privilege check required.
-
CVE-2026-45504 Part 4: Detection, Hardening, and Patching Priority
Patch first. After that, EWS activity logging and outbound-traffic baselining are the two layers that catch this kind of abuse, closing the loop this series opened with a six-year-old cracked password.
-
SDWSCS Part 8: CASB, DLP & Securing Microsoft 365
Module 7 of SDWSCS: the CASB layer riding on Umbrella SIG — shadow IT discovery, app controls, tenant restrictions for Microsoft 365, data loss prevention, and remote browser isolation. What each control needs from the SDWAN side to work.
-
Hydra vs Medusa vs Ncrack vs Patator vs Metasploit: Comparing the Online Brute-Force Tools
Five tools solve the same problem, guessing a live service's credentials, with radically different designs. A verified comparison of Hydra, Medusa, Ncrack, Patator, and Metasploit's brute-force auxiliary modules: syntax, protocol coverage, concurrency model, and what each looks like to a defender.
-
SSL/TLS Deep Inspection Internals on FortiGate: What UTM Actually Costs You
Certificate inspection reads the SNI and moves on. Deep inspection terminates the TLS session and re-signs the server's certificate with your own CA. What that costs in CPU, what it breaks in pinned apps, and why TLS 1.3 made the choice less optional.
-
SDWSCS Part 7: Umbrella SIG — Deployment & DNS Policies
Module 6 of SDWSCS: Umbrella SIG architecture and deployment — the automatic tunnel workflow from vManage, active/active vs active/backup designs, steering traffic into the SIG, and DNS security policies as the first (and cheapest) enforcement layer.
-
Proxmox Deep Dive Part 5: The Built-In Firewall
Three separate levels, datacenter, node, and VM, each guarding a different kind of traffic, plus security groups and IP sets for keeping rule sets manageable as a homelab grows.
-
SDWSCS Part 6: SASE — Architecture & Use Cases
Module 5 of SDWSCS: what SASE actually is once the marketing is stripped away — the SSE service stack, how Cisco assembles it from Catalyst SDWAN, Umbrella, Duo and ThousandEyes, and the use cases where cloud-delivered enforcement beats on-box or chained designs.
-
BloodHound Deep Dive Part 1: History, Community Edition, and Where It Sits in an Engagement
Where BloodHound came from, how Community Edition is actually built (Postgres, Neo4j, a single Go binary), and where attack-path analysis fits between recon and exploitation in a real engagement.
-
BloodHound Deep Dive Part 2: SharpHound and What It Actually Collects
SharpHound's real collection methods, the Stealth flag's documented behavior, and what a DCOnly run against CONTOSO.LOCAL would and wouldn't surface, taken from SpecterOps' own flag reference rather than guessed.
-
BloodHound Deep Dive Part 3: Ingestion, Postgres, Neo4j, and the Go API
How a SharpHound JSON upload becomes graph data, what Postgres versus Neo4j is actually responsible for, and standing up a real Neo4j instance in a sandbox with no Docker and no root to verify the graph layer directly.
-
BloodHound Deep Dive Part 4: Cypher and the Built-In Attack Path Queries
Running BloodHound's canned attack-path query patterns as real Cypher against the seeded CONTOSO.LOCAL graph, including a shortestPath query that comes back empty and what that empty result actually means.
-
BloodHound Deep Dive Part 5: Kerberoasting and AS-REP Roasting Through the Graph
BloodHound's real hasspn and dontreqpreauth properties point at the exact same two accounts Impacket Deep Dive found by hand, and a clean shortestPath query with no results shows why being roastable isn't the same as being worth roasting.
-
BloodHound Deep Dive Part 6: From GenericAll to a Working Credential
Turning the GenericAll to ForceChangePassword chain from Part 4 into an actual credential with bloodyAD, the real cross-platform ACL abuse tool that pairs with Impacket's own SOCKS-proxy-friendly design.
-
BloodHound Deep Dive Part 7: Detecting SharpHound and LDAP-Based ACL Abuse
What SharpHound's own documented collection behavior leaves in the event log, why 4662 volume is the tell, and the defensive case for running BloodHound against your own domain before an attacker's copy does.
-
BloodHound Deep Dive Part 8: A Full Walkthrough, From Foothold to a Graph-Confirmed Credential
Tying all seven parts together against CONTOSO.LOCAL: collection, ingestion, querying, and ACL abuse in order, and what it means that the graph runs out of edges before Domain Admins.
-
Sn1per Deep Dive Part 8: The Windows Target and What Nuke Mode Never Touched
Building a genuine Windows target for the Sn1per lab and running the tool against it for real, including the one finding it never even scanned for.
-
Sn1per Deep Dive Part 9: What a Pen Tester Without Sn1per Would Have Found
The same Windows target, worked by hand with nmap, curl, and two modern credential tools, set against what Sn1per's own automated run actually delivered. Closing post for the Sn1per Deep Dive series.
-
SDWSCS Part 5: Secure DIA & Service Chaining
Module 4 of SDWSCS: assembling the embedded stack into a secure Direct Internet Access design, then service chaining — OMP service routes, control and data policy steering, and the dedicated-security patterns for traffic that must transit a real firewall.
-
Sn1per Deep Dive Part 7: Verified With Root
Six posts read Sn1per from source without ever running it live. This one reruns the tool for real, with root, against a rebuilt lab, and checks every prediction against what actually happened.
-
SDWSCS Part 4: Content Filtering — URL Filtering & TLS/SSL Decryption
Module 3 of SDWSCS: URL filtering with categories and web reputation, block pages, and the TLS/SSL decryption proxy — CA design choices, the decrypt policy, undecryptable traffic handling, and why decryption is the feature that needs a change-management plan.
-
SDWSCS Part 3: On-Premises Threat Prevention — Firewall, IPS & AMP
Module 2 of SDWSCS: deploying the application-aware enterprise firewall, Snort-based IPS with its three signature sets, and AMP file reputation with Threat Grid sandboxing — plus fail-open vs fail-close and the verification commands for each.
-
Sn1per Deep Dive Part 1: From Recon Script to Attack Surface Platform
Sn1per orchestrates 90+ tools into one scan. This opens a new series on how it actually works, verified from the real Community Edition source rather than the marketing page.
-
Sn1per Deep Dive Part 2: What Discover and Recon Mode Actually Run
Sn1per's discover and recon modes chain together nmap, Amass, Subfinder, Sublist3r, crt.sh, and Shodan into one deduplicated target list. Read directly from the Community Edition source, with a real correction from root-verified testing.
-
Sn1per Deep Dive Part 3: Web Mode, Sc0pe, and the Vulnerability Scoring Engine
Sn1per's sc0pe engine is a directory of tiny declarative bash templates, each matching one header or one string, rolled up into a single per-host risk score. Read from the real source, with two real bugs confirmed by later root-verified testing.
-
Sn1per Deep Dive Part 4: Workspaces, Reporting, and the Professional 2026 Architecture
What Sn1per Professional 2026 adds over the free Community Edition, documented from the vendor's own release notes since the Pro engine isn't in the public source tree.
-
Sn1per Deep Dive Part 5: What an Automated Sweep Looks Like From the Blue Team's Side
Sn1per's default scan modes fire real, unconditional exploit attempts against old CVEs the instant a banner matches. That's expensive for an attacker to hide and cheap for a defender to detect, and root-verified testing found a genuine defensive win too.
-
Sn1per Deep Dive Part 6: A Full Sweep Against Northbridge Freight
Applying Sn1per's real recon-to-exploit logic, mode by mode, against a small local lab, then handing off to Impacket and Pivoting and Tunneling for the part the automation can't do.
-
SDWSCS Part 2: The SDWAN Security Model & Unified Security Policy
Module 1 of the SDWSCS syllabus: why DIA changed the threat model, the four security deployment patterns, what actually runs on a Catalyst edge (zone-based firewall vs the UTD container), and the unified security policy framework that ties it together.
-
SDWSCS Part 1: Course Overview & Study Roadmap
Kicking off a thirteen-part series on Cisco's SDWSCS syllabus — SDWAN security and cloud solutions. Part 1 explains what the course covers, how it extends ENSDWI, maps all thirteen modules and eleven labs to this series, and sets out a realistic study plan.
-
OSPF Deep Dive Part 6: Authentication and Security Hardening
What an unauthenticated OSPF segment actually exposes, why plaintext and MD5 authentication are both weaker than they look, and how to configure HMAC-SHA key chains on Cisco, FortiOS, and Junos.
-
Juniper Session Smart SD-WAN Deep Dive Part 5: Zero Trust by Default — the SSR Security Model
Because SVR classifies every session against a tenant and a service before forwarding a single packet, deny-by-default segmentation is a property of the routing engine itself. What that buys, what it doesn't, and how SRX fills the gap.
-
AI Pentest Agents Part 1: From Assistant to Autonomous Swarm
A new wave of AI pentesting agents landed in the space of two weeks in July 2026. This opens a series on what they actually do, how they differ from each other, and how they differ from the raw LLM-plus-nmap-plus-Metasploit approach this site already tried in AI Part 7.
-
AI Pentest Agents Part 2: Inside PentestCode's Coordinator and Engagement State
A close read of PentestCode's actual README: the strategist-coordinator design, the thirteen agents, the engagement-state graph with Dijkstra/Yen's K-shortest attack paths, the eighteen mandatory tools, and the honest limitations section the project ships with itself.
-
AI Pentest Agents Part 3: PentestGPT and the Academic Case for Reasoning, Generation, Parsing
PentestGPT is the oldest project in this series by a wide margin — a USENIX Security 2024 paper before it was a product. What its three-module design got right early, what changed in its 2026 agentic rewrite, and what its own published benchmark numbers actually say.
-
AI Pentest Agents Part 4: PentAGI and the Cost of Docker Root
PentAGI takes the opposite infrastructure bet from PentestCode: full Docker sandboxing instead of a root-free binary, which buys real isolation at the cost of a docker.sock privilege model worth understanding before you install it.
-
AI Pentest Agents Part 5: NodeZero, XBOW, and What Production-Safe Actually Means
NodeZero and XBOW aren't developer tools you install — they're commercial platforms with real production track records, real customers, and a review-before-submission discipline the open-source entrants in this series don't have to answer to.
-
AI Pentest Agents Part 6: Fingerprinting the Swarm, a Defender's Read on Agent Noise
PentestCode's own README admits it isn't stealthy and repeats work it's already done. What does that actually look like on the wire, and does it give a defender anything a human red-teamer wouldn't?
-
AI Pentest Agents Part 7: Installing PentestCode, and Where the Sandbox Runs Out of Road
The sandbox verified PentestCode's root-free install claim, then ran out of road on an LLM credential. The real run happened on the Proxmox lab: three independent root vectors on Metasploitable2, $9.64, and a critic agent that caught a real technical error.
-
AI Pentest Agents Part 8: Does the Human Pentester Still Have a Job
Closing out the series: what changes for a working pentester when tools like this exist, why every project in this series still insists on a human in the loop somewhere, and how this question echoes the one this site already asked about Ansible.
-
Building a Home Lab Honeypot: Watching What Actually Knocks on Your Door
A ~50-line Python TCP honeypot, tested live in a sandbox with real logged connection attempts, deployable on Herald behind an nftables DNAT rule — what a low-interaction canary actually catches and why that's worth more than it sounds.
-
DNS Tunneling and Covert C2: iodine, dnscat2, and Catching It on the Wire
DNS is the one protocol almost every egress policy leaves wide open. iodine's real --help output and dnscat2's documented client/server model show why — plus the query-entropy and NXDOMAIN signals that actually catch it, tied back into the CONTOSO.LOCAL pivoting lab.
-
Living Off the Land: certutil, mshta, rundll32, and Bitsadmin as Attacker Primitives
The LOLBAS project's own documented syntax for certutil, mshta, rundll32, and bitsadmin — signed Microsoft binaries repurposed as download-and-execute primitives against WKS01 in the CONTOSO.LOCAL lab, plus the Sysmon event IDs that actually flag it.
-
CVE-2026-56155 and CVE-2026-20833: Why Patch Tuesday Keeps Rediscovering the Impacket Series
July 2026's record Patch Tuesday shipped a Kerberoasting CVE and an AD FS key-theft zero-day that map almost exactly onto techniques from the Impacket Deep Dive series. Real transcripts from that series, held up against four CVEs, to show why the same trust-chain weaknesses keep resurfacing.
-
Password Cracking and Wordlist Engineering Part 1: The Hash Landscape and Why Offline Cracking Is a Different Game
Every post in the Impacket series ended with a hash. This one starts there: what NTLM, Kerberoast, and AS-REP hashes actually are, why offline cracking is a fundamentally different problem from an online login attempt, and the hash landscape the rest of this series works through.
-
Password Cracking and Wordlist Engineering Part 2: Hashcat Fundamentals and the GPU Economics of Cracking
Verified against a real hashcat v6.2.6 install and a published RTX 4090 benchmark run: the actual attack-mode syntax, the real mode numbers for NTLM, Kerberoast, and AS-REP, and what it genuinely costs — in dollars, not hand-waving — to exhaust a keyspace against each one.
-
Password Cracking and Wordlist Engineering Part 3: John the Ripper, Core vs Jumbo, and When to Reach for It
apt install john does not give you a tool that can crack a Kerberoast hash — verified firsthand, not assumed. The distinction between core John the Ripper and the Jumbo community fork, and the cases where JtR earns a place next to hashcat rather than duplicating it.
-
Password Cracking and Wordlist Engineering Part 4: Building Wordlists That Actually Work
rockyou.txt is fourteen million real, breached passwords from 2009 — and it's the wrong tool the moment a target has any pattern to its passwords at all. Verified cewl and crunch syntax for building wordlists that actually match how a specific organization names things.
-
Password Cracking and Wordlist Engineering Part 5: The Rule Engine, best64, and Writing Your Own Mutations
B4ckup$SQL2024 isn't in any wordlist — it's a wordlist entry plus a predictable transform. Walking hashcat's real, bundled best64.rule line by line, what its 102 rules actually do, and writing a custom rule for the one leetspeak substitution best64 doesn't cover.
-
Password Cracking and Wordlist Engineering Part 6: Mask and Hybrid Attacks, and the Keyspace Math Behind Them
No wordlist, no rules — masks build candidates character-position by character-position, and a 40,824-line "compliant password" mask set bundled with hashcat covers realistic complexity-policy shapes 65,000 times more efficiently than blind brute force. The keyspace math for why.
-
Password Cracking and Wordlist Engineering Part 7: Cracking CONTOSO.LOCAL End to End
Two hashes the Impacket series pulled off CONTOSO.LOCAL and stated the plaintext for without explaining how. This post runs the actual pipeline — baseline wordlist, OSINT-built vocabulary, custom rules, and a combinator-plus-hybrid chain — that gets from ciphertext to both passwords.
-
Password Cracking and Wordlist Engineering Part 8: The Defensive Mirror — Passphrases, KDFs, and Why Rotation Policies Miss the Point
Seven parts of offense, closing with the defense that actually follows from it: why bcrypt/scrypt/Argon2 cost tuning matters more than complexity rules, what NIST SP 800-63B Revision 4 actually changed about rotation, and what specifically would have stopped both CONTOSO.LOCAL cracks.
-
Pivoting and Tunneling Part 1: Why Pivoting Is Just Routing With Extra Steps
Extending the Impacket lab with a segmented finance VLAN you can't reach directly, then working through SSH -L/-R/-D and SOCKS/proxychains as the baseline pivoting toolkit — and exactly where that baseline runs out of road.
-
Pivoting and Tunneling Part 2: Chisel and the HTTP Tunnel That Looks Like Nothing
Chisel's server/client model verified against the real v1.11.8 --help output — reverse SOCKS over plain HTTP, fingerprint-pinned key exchange, and why a tool that requires no SSH on the target still gets past egress policy that SSH itself can't.
-
Pivoting and Tunneling Part 3: ligolo-ng and Tunneling Without Proxychains
ligolo-ng's TUN-interface architecture verified against the real v0.9 binary — how a gVisor userland network stack turns a reverse connection into something your OS routing table treats as a real interface, no SOCKS or LD_PRELOAD required.
-
Pivoting and Tunneling Part 4: What Tunneling Does to Your Packets — MTU, Fragmentation, and PMTUD Inside a Tunnel
Every tunnel in this series stacks a new MTU on top of the path's real one. Why that makes Path MTU Discovery quietly fail inside pivots, why big transfers over a pivot "just hang," and how to diagnose it with the same tooling behind pmtud-sweeper.
-
Pivoting and Tunneling Part 5: Double Pivots, Multi-Hop Chains, and Catching Them From the Wire
Chaining a tunnel inside a tunnel to reach FIN-DB01 through two hops, why each additional hop compounds the MTU problem from Part 4, and the flow-level signals that actually catch multi-hop pivoting on a monitored fabric.
-
Pivoting and Tunneling Part 6: Defense in Depth — Segmentation, Egress Filtering, and Catching a Pivot on a Fortinet Fabric
The full chain from Impacket foothold to FIN-DB01 told end to end, followed by a concrete hardening checklist — internal segmentation firewalling, default-deny egress, TLS inspection, and the flow-based indicators from this series mapped onto real Fortinet configuration.
-
Impacket Deep Dive Part 1: Why Real Red Teams Skip the Metasploit Tutorials
Every beginner tutorial teaches Nmap, Hydra, and a Metasploit one-liner. Nobody assessing a real Windows domain works that way — they live in Impacket. Part 1: what it actually is, the lab this series runs against, and a verified tour of the toolkit.
-
Impacket Deep Dive Part 10: Defense in Depth and Detection
Nine posts of offense, consolidated into one defensive reference: every hardening control and detection signature from this series, an event ID cheat sheet, and where network-layer segmentation fits when the domain itself is already compromised.
-
Impacket Deep Dive Part 2: Domain Recon Without a Single Exploit
Before any password is cracked or any exploit fires, a Windows domain will hand an unauthenticated or low-privilege connection its entire user list, computer list, and RID space. Part 2: GetADUsers, lookupsid, rpcdump, and samrdump — and how to stop them talking.
-
Impacket Deep Dive Part 3: AS-REP Roasting with GetNPUsers.py
One unset checkbox — Kerberos pre-authentication — turns a domain account into a crackable hash that any authenticated, or sometimes any unauthenticated, client can request. Part 3: GetNPUsers.py, what AS-REP roasting actually exploits, and how to close it.
-
Impacket Deep Dive Part 4: Kerberoasting with GetUserSPNs
Any authenticated domain user can request a service ticket for any account with a registered SPN, and that ticket is encrypted with the service account's own password hash. Part 4: GetUserSPNs, why pre-auth doesn't save you here, and the gMSA fix.
-
Impacket Deep Dive Part 5: ntlmrelayx and the Passwordless Hijack
ntlmrelayx.py never cracks a password. It intercepts an NTLM authentication attempt already in flight and replays it, live, to a second target — turning a coerced login into administrative access before the victim's own request even completes.
-
Impacket Deep Dive Part 6: The Ghost Shells — wmiexec, smbexec, and atexec
Four Impacket scripts get you a remote shell on a Windows host, and they all abuse a different legitimate management protocol to do it. Part 6: wmiexec, smbexec, atexec, and dcomexec compared against classic PsExec, and why one of them is dramatically quieter than the rest.
-
Impacket Deep Dive Part 7: secretsdump.py, SAM, LSA, and DCSync
One shell on one member server is a foothold. secretsdump.py is what turns it into the entire domain's password material — local SAM hashes, cached domain logons, LSA secrets, and, if the account is right, every credential in Active Directory via DCSync.
-
Impacket Deep Dive Part 8: Forging Tickets with ticketer.py
With the krbtgt hash from Part 7 in hand, an attacker doesn't need any account's password ever again. ticketer.py forges Kerberos tickets outright — Golden Tickets for full-domain impersonation, Silver Tickets for a single quiet service, both bypassing the domain controller entirely.
-
Impacket Deep Dive Part 9: The Full Chain, Foothold to Domain Admin
Eight posts, eight tools, one domain. Part 9 runs CONTOSO.LOCAL's compromise start to finish, in the order a real intrusion actually uses these techniques — one phished workstation to a persistent, forged Domain Admin ticket.
-
Netcat: The Swiss Army Knife of TCP/IP, A Deep Dive
Netcat's origins and the OpenBSD/GNU fork split, core socket mechanics, file transfer and port scanning, bind vs reverse shells (with the mkfifo workaround for -e-less builds), and HTTP banner grabbers, mock servers, and relays — with firewall-testing use cases throughout.
-
The Hidden Kali Linux Shield: How Firejail Sandboxes Dangerous Exploits Without the VM Overhead
Firejail wraps any process in Linux namespaces, seccomp-bpf, and capability drops in milliseconds — no VM spin-up. How it actually isolates a process, real GitHub-PoC and exploit-testing workflows, and the root-user gotcha that quietly guts it on Kali.
-
Ansible Deep Dive Part 6: Variable Precedence and Ansible Vault — Secrets Done Right
Part 6: the full variable precedence ladder from role defaults to extra-vars, then Ansible Vault end to end — encrypting whole files and single strings, vault IDs for multiple secret tiers, and keeping vault passwords out of the repo entirely.
-
AI Part 8: Kali 2026.2's Nine New Tools, and the MCP Server With 150 More Behind It
Kali 2026.2 shipped nine new tools, one an AI CLI by default. I installed and ran every one I could in a rootless sandbox, then looked behind the curtain at a 17,000-line MCP server wrapping 150+ tools, and Kali's own local-LLM stack. No fabricated output.
-
Cilium: Kubernetes Networking and Security Built on eBPF
Cilium replaces iptables-based kube-proxy and overlay CNIs with eBPF programs on the kernel datapath. Connects back to namespaces, veth pairs, nftables, and eBPF/XDP, then covers identity-based network policy and Hubble observability.
-
AI Part 7: When an LLM Gets Nmap and Metasploit as Tools
I wired an LLM into nmap and Metasploit against a deliberately vulnerable lab. The exploit worked — a real, server-verified root shell — but the sharper finding was the models themselves: a 7B fabricated its tool output wholesale, an 8B mangled its arguments, and only a 32B drove the tools honestly. No fabricated transcripts — the model's included.
-
Nmap and the Scripting Engine: A Network Engineer's Field Guide to NSE
Nmap's scan engine and NSE scripting framework are as useful for firewall change validation and inventory work as for security assessments. Covers scan types, timing, NSE categories, writing a custom script, and practical recipes for network engineers.
-
strncpy Is Finally Gone: What Linux 7.2-rc1 Means for Kernel Security
Linus opened the 7.2 merge window and tagged 7.2-rc1 — and with it, strncpy() is finally gone from the kernel tree. Six years, 362 commits, 70 contributors. Here's what the function actually did wrong, why it took so long to kill, and why removal beats deprecation.
-
Building an Enterprise-Grade NTP Service with chrony and Integrating it with FortiGate: Chronos Keeps Time
Why we chose chrony over ntpd and timesyncd, what CIS and Fortinet hardening guides say about NTP, a full build walkthrough, the deny-all ordering mistake every network engineer will make, and how to generate NTP keys that FortiOS will actually accept.
-
Zero Trust Meets the Overlay: Converging ZTNA and SDWAN on Fortinet
The capstone to the SDWAN series: how Fortinet's ZTNA tags and access proxy let you fold per-application, identity-aware access control directly into the SDWAN fabric — built on the RADIUS/TACACS AAA backend and the PKI you already stood up for IPsec.
-
spectre-meltdown-checker: Auditing CPU Vulnerability Mitigations on Linux
A deep dive into spectre-meltdown-checker — how it actually works under the hood, what it tells you that /sys/devices/system/cpu/vulnerabilities does not, the alternative tools (lscpu, vendor microcode checkers, in-tree kernel reporting), and when to reach for each one on a production Linux box.
-
Configuring RADIUS Admin Auth on FortiGate SDWAN: RBAC and Three User Profiles (Part 2 of 2)
Part 2 of 2 on RADIUS for FortiGate SDWAN. Walks through the FortiOS config end-to-end — RADIUS server entry, group-to-profile mapping via VSA, three worked RBAC examples (senior engineer, NOC operator, compliance auditor), and the verification commands you'll need.
-
NSE5 Exam Syllabus: Study Roadmap (Part 1 of 10)
Part 1 of a 10-part study series for the Fortinet NSE 5 / FCP FortiManager Administrator certification. Covers the exam logistics, the official curriculum grouped into topic buckets, and the roadmap for the rest of the series.
-
RADIUS vs TACACS+ on FortiGate SDWAN: Choosing the Right AAA Backend (Part 1 of 2)
Part 1 of 2 on RADIUS for FortiGate SDWAN. Covers the protocol differences vs TACACS+, the RADIUS server options worth knowing (NPS, FortiAuthenticator, FreeRADIUS, ISE, Okta, Duo, Entra), and when each protocol is the right call for FortiOS.
-
iptables to nftables: Migrating Production Firewalls Without Downtime
A working engineer's guide to moving from iptables to nftables on production Linux firewalls — the mental model shift, where iptables-translate misleads you, atomic ruleset swaps, and a clean rollback strategy that means a bad migration costs you seconds, not your weekend.
-
SSH Hardening Beyond the Basics: Certificate Authorities, Bastion Patterns, and Session Auditing
A production-grade SSH setup that goes beyond disabling password auth — running your own SSH CA with short-lived user and host certificates, ProxyJump bastions, ForceCommand restrictions, and recording sessions with tlog and auditd.
-
NSE4 Exam Syllabus: Study Roadmap (Part 1 of 10)
Part 1 of a study series for the Fortinet NSE 4 / FCP FortiGate Administrator certification. Covers exam logistics, the official 16-lesson curriculum grouped into topic buckets, and the roadmap for the rest of the series.
-
NSE4 Part 2: Initial Configuration & the Security Fabric
Part 2 of the NSE4 study series — covers the day-one FortiGate configuration (interfaces, operation modes, admin access, DHCP, FortiGuard) and how the Security Fabric stitches multiple FortiGates and Fortinet products together.
-
NSE4 Part 3: Firewall Policies & NAT
Part 3 of the NSE4 study series — firewall policy structure, lookup order, NGFW modes, central vs policy NAT, source NAT pools, virtual IPs, and the session helpers behind protocol fixups.
-
NSE4 Part 4: Authentication, FSSO & Certificates
Part 4 of the NSE4 study series — local and remote authentication (LDAP, RADIUS), captive portal, Fortinet Single Sign-On (FSSO) modes, and certificate operations including SSL deep inspection.
-
NSE4 Part 5: Logging, Monitoring & Diagnostics
Part 5 of the NSE4 study series — log categories and severity, local vs remote storage, FortiAnalyzer and syslog forwarding, threat weight scoring, and the diagnostic commands you actually reach for under pressure.
-
NSE4 Part 7: SSL VPN
Part 7 of the NSE4 study series — SSL VPN modes (web, tunnel, full), portals, realms, MFA, split tunnelling and the diagnostic commands for tracking down a stuck client.
-
NSE4 Part 8: IPsec VPN
Part 8 of the NSE4 study series — IKEv1 vs IKEv2, route-based vs policy-based, site-to-site and dial-up, NAT traversal, dead peer detection, and the two diagnostic commands that separate a Phase 1 problem from a Phase 2 problem.