-
Vulnerability Scanning with Nmap and Nessus on Metasploitable 2
Sep 27, 2026
A weekend lab running the full vulnerability management cycle against Metasploitable 2. Nmap for discovery, Nessus for scanning, then triage and a report. Non-credentialed found 61 issues. Credentialed found 91.
Read writeup -
Homelab - LOLBin Attack Chain & Detection
Sep 12, 2026
I built a small Active Directory lab, ran a real attack against a Windows machine, and then caught every step of it in Splunk. This writeup walks through the attack and the detection in plain language.
Read writeup -
Attacking IIS - From a Version Banner to a Shell on Windows
Jul 18, 2026
The Windows half of the web server series. Fingerprint IIS, use an old 8.3 filename trick to find hidden files, grab leaked WebDAV creds, and upload an ASPX shell. Every step maps to something attackers still do today.
Read writeup -
Getting Started with Burp Suite - Proxy, Site Map, and a Real XSS
Jul 18, 2026
My first proper walk through Burp Suite: proxy the browser, build a site map that surfaces a hidden endpoint, set a scope to cut noise, and edit a live request to slip an XSS past a client-side filter.
Read writeup -
Web Server Attacks I - Misconfigurations Across Apache, Nginx, Node, and Python
Jul 11, 2026
Four web servers on one host, the same misconfiguration patterns on each: version disclosure, directory listing, exposed status pages, and missing security headers.
Read writeup -
Walking An Application - Manual Web Review with Browser Dev Tools
Jul 11, 2026
A web app review using nothing but the browser. Page source, Inspector, Debugger, Network, and Storage, and why client-side controls are not security.
Read writeup -
Nmap Post Port Scans - Service Detection, OS Detection, and NSE
Jul 11, 2026
What to do after you find open ports: identify the service and version, fingerprint the OS, run NSE scripts, and save the results.
Read writeup -
Modern Web Stacks - Fingerprint the Stack, Then Target the CVE
Jul 11, 2026
Four stacks, four CVEs. Reading a stack from its HTTP signals so you know the attack surface before a scanner finishes running.
Read writeup -
Content Discovery - Manual, OSINT, and Gobuster
Jul 11, 2026
Finding the pages, files, and directories a site did not mean to expose, using conventional files, public OSINT, and automated brute forcing.
Read writeup -
Reconnaissance Fundamentals - Passive and Active Recon, and Where the Line Sits
Jul 4, 2026
Recon splits into two modes: pulling public data without touching the target, and probing it directly. The difference decides whether you leave a trace.
Read writeup -
Protocols and Servers - Reading Cleartext Email and File Transfer by Hand
Jul 4, 2026
FTP, SMTP, POP3, and IMAP all send credentials in the clear by default. A telnet client is enough to speak every one of them and see exactly what leaks.
Read writeup -
Protocols and Servers 2 - Sniffing, MITM, and Password Attacks on Cleartext Services
Jul 4, 2026
Three attacks against network protocols, sniffing, man-in-the-middle, and password attacks, and the encryption and authentication that shut each one down.
Read writeup -
Nmap Basic Port Scans - Connect, SYN, and UDP
Jul 4, 2026
The three scans that find running services on a host, how each one works at the packet level, and when to reach for it.
Read writeup -
Nmap Advanced Port Scans - Stealth Scans and Evasion
Jul 4, 2026
Odd TCP flag combinations that slip past simple firewalls, plus spoofing, decoys, and the idle scan for hiding where a scan comes from.
Read writeup -
Guided Pentest: Infrastructure - The Full Kill Chain In One Short Room
May 22, 2026
A short room that walks the classical kill chain end to end against a single host: recon, exploit a known backdoor, find plaintext credentials on disk, log back in as root by SSH.
Read writeup -
BOTSv3 in Splunk - Investigating AWS Breaches, Cryptomining, and an APT
May 21, 2026
The follow-up to BOTSv2. This dataset adds a big AWS component, so the investigation moves between cloud logs and endpoint logs. Notes on what the cloud side taught me.
Read writeup -
Guided Pentest: Web - Chaining Four Small Bugs Into Full Server Compromise
May 21, 2026
A guided web app pentest against a fictional recruitment platform. None of the individual findings are critical. The chain ends in remote code execution and a reverse shell.
Read writeup -
My First SIEM Investigation - What I Learned Working Through BOTSv2 in Splunk
May 12, 2026
Three days inside the BOTSv2 dataset on TryHackMe's Splunk 2 room. Four scenarios, one fake brewery. Notes on what clicked and what didn't.
Read writeup -
Skynet
May 10, 2026
Anonymous Samba leaks a custom wordlist, Hydra against SquirrelMail recovers a password, an email exposes the SMB password, and a Cuppa CMS RFI plus tar wildcard injection in a root cron ends at root.
Read writeup -
ItsyBitsy
May 10, 2026
An IDS alert from an HR workstation turns into a hunt for an unusual user-agent in Kibana, ending on a Pastebin paste being used as a tiny command-and-control channel.
Read writeup -
Brooklyn Nine Nine
May 5, 2026
Two completely independent attack chains land on the same root: anonymous FTP plus rockyou Hydra plus sudo less escape, and steghide on a web image plus sudo nano with NOPASSWD.
Read writeup -
Mr Robot
May 1, 2026
robots.txt to a leaked wordlist, WordPress username enumeration plus Hydra brute force, theme-editor PHP reverse shell, unsalted MD5 cracked on CrackStation, and SUID nmap interactive mode to root.
Read writeup -
Ignite
May 1, 2026
Fuel CMS 1.4.1 unauthenticated RCE via CVE-2018-16763 (create_function code injection), www-data shell, then a plaintext MySQL root password reused as the system root password.
Read writeup -
Microsoft Sentinel - Cloud SIEM Setup and KQL Detection
Apr 30, 2026
Self-directed Azure lab: stood up a Microsoft Sentinel workspace, connected threat intelligence data sources, and wrote KQL queries to detect suspicious sign-in patterns and IOC matches.
Read writeup -
Decryptify
Apr 29, 2026
Forged invite codes by brute forcing a leaked seed constant, then padbuster against a date parameter to decrypt and re-encrypt commands for full RCE.
Read writeup -
Nessus
Apr 27, 2026
Configured Nessus Essentials, ran a Basic Network Scan and a Web Application Tests scan, and triaged findings ranging from cleartext login forms to exposed .bak backup configs and missing X-Frame-Options.
Read writeup -
Overpass 2 - Hacked
Apr 23, 2026
PCAP forensics to recover a su password, cracked a deployed SSH backdoor's hash in hashcat, and exploited an .suid_bash with -p to root.
Read writeup -
Overpass
Apr 22, 2026
Bypassed client-side authentication, cracked an SSH key passphrase, and hijacked a root cron job via writable /etc/hosts.
Read writeup -
Net Sec Challenge
Apr 15, 2026
Network Security module capstone covering Nmap, Telnet banner grabbing, and Hydra against six services on a single target, plus a 0%-detection covert scan.
Read writeup -
Nmap Live Host Discovery
Apr 14, 2026
ARP, ICMP, and TCP/UDP ping-scan techniques and when each one is the right tool, with hands-on practice on a multi-host target range.
Read writeup -
Introduction to SIEM
Apr 14, 2026
Triaged a cryptominer alert (cudominer.exe on HR_02 workstation), traced it to a 4688 process-creation detection rule on the *miner* keyword, and actioned it as a true positive.
Read writeup -
SOC Simulator - Phishing Analysis
Mar 25, 2026
Five phishing alerts triaged in Splunk: two false positives, three true positives. Pivoted between email logs, URL reputation, and firewall data for each verdict.
Read writeup -
Benign - LOLBIN Investigation
Mar 14, 2026
EventID 4688 hunt across an HR workstation: imposter account identification via low-cardinality username analysis, scheduled-task persistence, and a certutil.exe LOLBIN download from controlc.com.
Read writeup -
Investigating with Splunk
Mar 10, 2026
Multi-host compromise investigation: WMI backdoor creation, decoded a double-encoded PowerShell Empire C2 beacon, and traced lateral movement through Sysmon and Windows event correlation.
Read writeup -
HackPark
Mar 7, 2026
Hydra brute force against BlogEngine.NET, RCE via CVE-2019-6714, then SYSTEM via a scheduled-task hijack on a world-writable scheduler directory. Done twice: with Metasploit and fully manually.
Read writeup -
Steel Mountain
Mar 6, 2026
Rejetto HFS RCE via CVE-2014-6287 then SYSTEM via an unquoted service path. Solved with both Metasploit and a fully manual chain using ExploitDB and msfvenom.
Read writeup -
Alfred
Mar 3, 2026
Jenkins default credentials to RCE, Nishang reverse shell, then SeImpersonatePrivilege abuse via Meterpreter Incognito for SYSTEM.
Read writeup -
Linux PrivEsc
Mar 1, 2026
18 Linux privilege escalation techniques: MySQL UDF, sudo and SUID abuse, cron hijacking, NFS no_root_squash, wildcard injection, and Dirty COW (CVE-2016-5195).
Read writeup -
VulnNet: Active
Feb 27, 2026
Unauthenticated Redis to a Responder NTLM capture, cracked the hash offline, used the credentials for SMB share abuse, then GodPotato to SYSTEM.
Read writeup -
Attacktive Directory
Feb 26, 2026
Full Active Directory methodology: Kerberoasting, AS-REP Roasting, and BloodHound attack-path mapping ending at Domain Admin.
Read writeup -
Active Directory - Full Domain Compromise
Feb 24, 2026
Built and attacked a home-lab Active Directory environment: NTLM dump, Pass-the-Hash, PSExec to SYSTEM, then krbtgt extraction and Golden Ticket forgery for persistent Domain Admin.
Read writeup -
Kioptrix Level 2
Feb 22, 2026
SQL injection auth bypass into a vulnerable ping form (command injection), then kernel privesc via the sock_sendpage() exploit.
Read writeup -
Basic Pentesting 1
Feb 21, 2026
WordPress credential attack to shell, then pkexec CVE-2021-4034 (PwnKit) for root.
Read writeup -
Metasploitable 2 - Manual RCE
Feb 20, 2026
UnrealIRCd RCE without Metasploit, sudo misconfiguration, and credential harvesting from accessible service config files.
Read writeup -
Metasploitable 2 - Multi Vector
Feb 19, 2026
Three independent attack vectors against Metasploitable 2 (vsftpd 2.3.4 backdoor, Samba CVE-2007-2447, Distcc CVE-2004-2687) plus an SUID-nmap privesc.
Read writeup -
DVWA - Blind SQLi (High)
Feb 18, 2026
Boolean-based blind SQL injection at the High security level via Burp Intruder and response-length differentials, extracting the database one character at a time.
Read writeup -
DVWA - SQLi, API & Sessions
Feb 17, 2026
UNION-based and boolean-based SQLi at elevated DVWA security, plus an API v1/v2 exposure and predictable session ID enumeration.
Read writeup -
DVWA - Foundational Vulnerabilities
Feb 16, 2026
OWASP Top 10 coverage across DVWA's foundational modules: SQL injection, reflected and stored XSS, CSRF, command injection, IDOR, and Local File Inclusion via php://filter.
Read writeup
Type
Difficulty