Wireshark for Blue Teams: Spot Suspicious Traffic
Wireshark is the microscope of network defence. Logs tell you that something happened. A packet capture shows you exactly what
Learning Paths
Learning Paths
Sysmon Configuration: Build a Config That Actually Detects
Sysmon is the single most valuable free upgrade you can give a Windows machine. Out of the box, Windows tells
Learning Paths
Sysmon Event IDs Explained: The Ones That Matter
Sysmon writes dozens of event types, and a beginner who opens the log sees a wall of numbers. The trick
Learning Paths
Splunk SPL for Security: 5 Queries Every SOC Analyst Needs
Splunk is one of the most common SIEM tools in real SOCs, and its search language, SPL, is a skill
Linux, CTF Writeups, Hack The Box
HTB DutyBound Writeup — Hack The Box Season 12
Introduction This HTB DutyBound writeup walks through a medium Linux machine from Hack The Box Season 12, where several seemingly
Hack The Box, CTF Writeups
HTB Autopilot Writeup — Insane Windows AD Machine (Season 12)
DifficultyInsaneOSWindows / ADSeasonHTB Season 12Authorthecybertrack.com // attack chain Grommunio→Seafile SSRF→Redis Poison→grofiles RCE→PHP-FPM→Postfix root→Chisel pivot→NTLM relay→firepwd→XOR runas→Domain Admin HTB Autopilot writeup
PHP2Shell (CVE-2026-109618 & CVE-2026-109619): Critical PHP RCE Explained, Detection and Mitigation
PHP2Shell (CVE-2026-109618 & CVE-2026-109619) is a critical unauthenticated RCE in the PHP core. Learn which versions are affected, how to patch, verify and detect exploitation.
Windows Active Directory Attacks: A Practical Guide for Penetration Testers
Active Directory is the backbone of almost every enterprise network. It handles authentication, authorization, group policies, and trust relationships across
HTB Stream Writeup — Hack The Box Season 12
HTB Stream — Full Writeup An Insane-rated Linux box built around a real-world airline data pipeline. The attack chains XXE injection, Kafka
Flax Typhoon Exploits Five Old Flaws: CISA KEV Update and What to Patch
In short: CISA has added five actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog after a joint advisory