Posts

2026-09-04

Wiring Frontier Models Into OpenWebUI With Curapi

curapi wraps the Cursor CLI into an OpenAI-compatible API so OpenWebUI can run Claude, GPT, Gemini, and other frontier models on one Cursor subscription.

2026-08-27

Finding 0-Days With Claude in Under an Hour

Claude Code found CVE-2026-8795 in Velociraptor in under an hour: YAML injection in Windows.Collectors.Remapping, a working PoC, and notes for researchers and IR.

2025-11-28

Inside CVE-2025-59287: SoapFormatter RCE in WSUS

Walkthrough of CVE-2025-59287, a SoapFormatter RCE in WSUS, including validation, fake PoCs, detection, and honeypot evidence of in-the-wild exploitation.

2023-12-23

LLM Hacking: Prompt Injection

Prompt injection as the top LLM vulnerability: OWASP guidance, hands-on challenges, and HackMeGPT, an open-source app for practicing bypasses.

2022-06-12

Insecure Active Directory Lab For Training (IaC)

An Infrastructure-as-Code lab that builds an insecure Active Directory environment for teaching Kerberoasting, DCSync, and related attacks.

2021-11-24

Hacking From the Sky - Penetration Testing UAV

Building a penetration-testing UAV to deliver Wi-Fi, Bluetooth, and network attacks when physical access to a building is limited.

2021-11-24

Using Cobalt Strike with Tunnel-Manager for Distributed Hacking

Tunnel-Manager automates remote port-forward tunnels for Cobalt Strike across AWS nodes, including NATed on-prem servers.

2021-07-25

Mine for Local Privilege Escalation Vulnerabilities in Windows Applications Using Automation and Virtualization

Miner automates hunting local privilege-escalation bugs in Windows applications and led to more than 40 LPEs and 12 CVEs.

2021-07-02

Walkthrough: The detection and analysis of the ransomware incident in IRSeC 2021

Walkthrough of detecting, analyzing, and recovering from the hidden ransomware inject used in IRSeC 2021.

2021-06-20

Resource Efficient Internal Network Honeypots

Deploy cheap internal honeypots that alert on Slack when something unauthorized appears on the network.

2021-03-22

Applied Purple Teaming Series ( Attack, Detect, & Defend ) Part 3

Part 3: run common exploits against a homelab, find detection gaps, and close them with Suricata, YARA, and Sigma rules.

2021-02-14

Applied Purple Teaming Series ( Weaponize Windows ) Part 2

Part 2: install and wire Kolide Fleet, osquery, Wazuh, and rsyslog on Windows and Linux for a purple-team homelab.

2021-02-07

Applied Purple Teaming Series ( The Virtual Environment ) Part 1

Part 1: build a virtual purple-team lab with SIEM and EDR so you can practice red teaming, threat hunting, and IR.

2021-02-02

Studying Sysmon's Ability to Detect Process Injections Using Different Configuration Schemas

How far Sysmon configurations go toward detecting process injection, and where SwiftOnSecurity-style schemas still miss.

2019-12-22

2019 End-of-Year Infrastructure Upgrades

2019-10-30

6-Eyed-Spider Post-Exploitation Red-Team Tool

6-Eyed-Spider is a post-exploitation C2 that controls browsers instead of the whole operating system.

2019-10-11

Integrating C3 With Cobalt Strike via ExternalC2 And Studying Their Behavior

Integrating F-Secure C3 with Cobalt Strike ExternalC2 and looking at the channel from a detection perspective.

2019-05-18

A Golden Image for Our Pentest VMs

An Ansible playbook that rebuilds a consistent Kali golden image for our pentest VMs, with the tools the team actually uses.

Windows Exploit Development: Egg Hunting

Egg hunting in Windows exploit development: locating a payload in memory when space is tight.

Windows Exploit Development: Unicode and Venetian shellcode techniques

Unicode and Venetian shellcode techniques for Windows exploit development.

Detecting Bugs Using Network Protocol Fuzzing

Finding bugs with network-protocol fuzzing using Boofuzz.

Windows Exploit Development: Utilizing imported functions (WinExec)

Using imported functions such as WinExec when building a Windows exploit payload.

Manually Encode Bytes & Shellcode Carving

Manually encoding bytes and carving shellcode for Windows exploit development.

DHCP Infrastructure Security: Practical Implementation of DHCP Starvation & DHCP Spoofing

Practical DHCP starvation and spoofing on Cisco switches, and how DHCP snooping stops them.