Blog

• 2024-10-20

  Flare-On 11: Frog

  When the maze has no solution, don't play the game — read the source and call the win function yourself.

• 2024-10-14

  Huntress CTF 2024: warmup write-ups

  Nested QR codes, a cattle-themed esolang, a shop with no input validation, and an SGID find binary.

• 2024-09-10

  How C2 frameworks work

  Servers, agents, listeners, beacons — the moving parts of command and control, and how attackers hide the traffic.

• 2024-08-15

  Container security: escapes and hardening

  Four ways a misconfigured container hands you the host — and the full set of switches that lock it back down.

• 2024-07-20

  Detecting Windows persistence with Splunk

  Two MITRE persistence techniques, the Sysmon events they leave behind, and the SPL to catch them.