DAEMONCORE ACADEMY // GLOBAL NODE REGISTRY
Complete Sitemap
INDEXING 260 DISCOVERABLE NODES (INCLUDING AUTOMATED FIELD NOTES)
Comprehensive index of our curriculum pathways, disposable ranges, operational tools, architectural documentation, and cron-published practitioner field notes.
260Total Live Nodes
47Platform & Tools
213Automated Field Notes
127Curriculum Labs
Core PlatformPrimary
Home // Landing & Threat Fabric/→
Core PlatformCurriculum
Cyber Security Training (Practical Course)/cyber-security-training→
Core Platform127 Labs
Curriculum Pathways (8 Pathways, 127 Lessons)/curriculum→
Core PlatformInteractive
Daily SOC Drill (Interactive 60s Scenario)/drill→
Core PlatformWar Room
FieldOps Pro // Tactical Cyber Operations/fieldops→
Core Platformv10
Download & Install (Windows Store & Linux)/download→
Core Platform
Free Education Manifesto // No Paywalls/free→
Core Platform
Financial Hardship License Application/hardship→
Core PlatformDemo
Interactive Web Preview Range/web-preview→
Core Platform
Support, Documentation & System Status/support→
Core Platformv10
Release Notes & Engine Changelog/release-notes→
Core PlatformPublication
Field Notes Archive (Practitioner Articles)/blog→
Interactive ToolsRange
Tradecraft // Interactive MITRE ATT&CK Labs/tradecraft→
Interactive ToolsLab
Digital Forensics & Memory Triage/forensics→
Interactive ToolsAD
Active Directory Privilege Escalation Graph/ad-escalation→
Interactive ToolsDetection
EDR Telemetry & Sysmon Rule Validator/edr-telemetry→
Interactive Tools
Web Application & API Security Targets/bug-bounty→
Interactive Tools
Black Hat Case Studies & Defensive Countermeasures/black-hat→
Interactive Tools
Egress & C2 Protocol Tester/egress-tester→
Interactive Tools
Canary Tokens & Decoy Management/canary→
Interactive ToolsReference
Operator Cheat Sheets & Command Syntax/cheat-sheets→
Interactive Tools
CVSS v3.1 / v4.0 Threat Calculator/cvss-generator→
Interactive ToolsTactical
Pivot Architect // Multi-Hop Chisel & SOCKS5/pivot-architect→
Interactive Tools
Reverse Shell Payload & Listener Architect/revshell→
Interactive Tools
Rules of Engagement (ROE) Builder/roe-builder→
Interactive Tools
Detection Rule Packs & Sigma Transpiler/rule-packs→
Interactive ToolsExam
Trial by Evidence // 10-Question Operator Exam/trial-by-evidence→
Interactive Tools
Raw Telemetry & Threat Intelligence Feed/feed-access→
Interactive Tools
Tactical Merchandise & Mission Apparel/merch→
Architecture & Trust
About DaemonCore // Collective Dossier/about→
Architecture & Trust
Pedagogical Methodology // Proof Over Paper/methodology→
Architecture & Trust
Transparency, Open Metrics & Funding Model/transparency→
Architecture & Trust
How We Build // Containerized Range Architecture/how-we-build→
Architecture & Trust
Set the Record Straight // Public Receipts/set-the-record-straight→
Architecture & Trust
Industry Perspective // What Others Won't Tell You/others→
Architecture & TrustLive
Operational Telemetry & Range Uptime Status/status→
Architecture & Trust
Supply Chain & Package Integrity Attestation/supply→
Architecture & Trust
Contact & PGP Key Fingerprint/contact→
Architecture & Trust
Privacy Policy & Zero Data Harvesting/privacy→
Technical Guides
Technology Stack & Low-Level Architecture/tech→
Technical Guides
Technology Focus: Rust Memory Safety in Security/tech/rust→
Technical Guides
Technology Focus: Python Offensive Tooling & Scapy/tech/python→
Technical Guides
Technology Focus: TypeScript Engine & React UI/tech/typescript→
Technical Guides
Fundamentals: What is a Terminal?/landing/what-is-a-terminal→
Technical Guides
Fundamentals: What is PuTTY?/landing/what-is-putty→
Technical Guides
Fundamentals: What is SSH Protocol?/landing/what-is-ssh→
Technical Guides
Fundamentals: What is an IP Address?/landing/what-is-an-ip-address→
Field Notes12m read
Evading process creation telemetry with doppelganging techniques/blog/evading-process-creation-telemetry-with-doppelganging-techniques2026.10.24
Field Notes12m read
Extracting credentials from minidump files/blog/extracting-credentials-from-minidump-files2026.10.23
Field Notes10m read
Writing actionable findings for developers/blog/writing-actionable-findings-for-developers-u37y2026.10.22
Field Notes10m read
Windows ETW: Patching EventWrite vs Kernel Providers/blog/windows-etw-patching-eventwrite-vs-kernel-providers2026.10.21
Field Notes12m read
Windows token manipulation: impersonation and delegation tokens/blog/windows-token-manipulation-impersonation-and-delegation-tokens2026.10.20
Field Notes10m read
Understanding iptables: How packet filtering chains work/blog/understanding-iptables-how-packet-filtering-chains-work2026.10.19
Field Notes12m read
Inside macOS TCC: Exploring database internals and SIP protections/blog/inside-macos-tcc-exploring-database-internals-and-sip-protections2026.10.18
Field Notes10m read
WebAuthn and FIDO2 authentication flow: Understanding passkeys/blog/webauthn-and-fido2-authentication-flow-understanding-passkeys2026.10.17
Field Notes10m read
How NAT reshapes your network understanding/blog/how-nat-reshapes-your-network-understanding-hejp2026.10.16
Field Notes10m read
Post-quantum cryptography transition: ML-KEM and ML-DSA algorithms/blog/post-quantum-cryptography-transition-ml-kem-and-ml-dsa-algorithms2026.10.15
Field Notes12m read
Setting up a high-interaction SSH honeypot with Cowrie/blog/setting-up-a-high-interaction-ssh-honeypot-with-cowrie2026.10.14
Field Notes12m read
Exploring DNS record types beyond the basics/blog/exploring-dns-record-types-beyond-the-basics2026.10.13
Field Notes12m read
Bypassing biometric authentication with presentation attack detection/blog/bypassing-biometric-authentication-with-presentation-attack-detection2026.10.12
Field Notes12m read
Container privilege escalation via Docker socket mounts and writable procfs/blog/container-privilege-escalation-via-docker-socket-mounts-and-writable-procfs2026.10.11
Field Notes10m read
Crafting actionable findings for developers/blog/crafting-actionable-findings-for-developers-w41a2026.10.10
Field Notes12m read
Kernel hooking with eBPF: Advanced detection strategies for rootkits/blog/kernel-hooking-with-ebpf-advanced-detection-strategies-for-rootkits2026.10.09
Field Notes12m read
Open-source tools for effective penetration testing/blog/open-source-tools-for-effective-penetration-testing2026.10.08
Field Notes10m read
Streamlining external scanning workflows for application security/blog/streamlining-external-scanning-workflows-for-application-security2026.10.07
Field Notes12m read
Firmware security: Extracting and modifying SPI flash ROMs with flashrom and binwalk/blog/firmware-security-extracting-and-modifying-spi-flash-roms-with-flashrom-and-binw2026.10.06
Field Notes12m read
Inspecting encrypted DNS with DoH and DoT/blog/inspecting-encrypted-dns-with-doh-and-dot2026.10.05
Field Notes12m read
Understanding inodes and file management in Unix filesystems/blog/understanding-inodes-and-file-management-in-unix-filesystems2026.10.04
Field Notes10m read
Managing GitHub token permissions in CI/CD workflows/blog/managing-github-token-permissions-in-ci-cd-workflows2026.10.03
Field Notes10m read
GraphQL security assessment: introspection and query complexity/blog/graphql-security-assessment-introspection-and-query-complexity2026.10.02
Field Notes12m read
Understanding Windows ALPC and RPC internals for inter-process security/blog/understanding-windows-alpc-and-rpc-internals-for-inter-process-security2026.10.02
Field Notes12m read
Exploring Windows ALPC and RPC internals for local inter-process security/blog/exploring-windows-alpc-and-rpc-internals-for-local-inter-process-security2026.10.02
Field Notes12m read
Assessing vendor claims about self-improving SOCs/blog/assessing-vendor-claims-about-self-improving-socs2026.09.30
Field Notes10m read
Crafting actionable findings for developers/blog/crafting-actionable-findings-for-developers2026.09.30
Field Notes12m read
Bypassing Windows LSASS PPL: Kernel Driver Exploitation Tactics/blog/bypassing-windows-lsass-ppl-kernel-driver-exploitation-tactics2026.09.29
Field Notes10m read
Understanding Unix domain sockets and file descriptor passing/blog/understanding-unix-domain-sockets-and-file-descriptor-passing2026.09.29
Field Notes12m read
Understanding the TLS 1.3 handshake: key exchange and 0-RTT/blog/understanding-the-tls-1-3-handshake-key-exchange-and-0-rtt2026.09.29
Field Notes10m read
Identifying SoftPerfect NetScan on Workstations/blog/identifying-softperfect-netscan-on-workstations2026.09.28
Field Notes10m read
Investigating SoftPerfect NetScan presence on workstations/blog/investigating-softperfect-netscan-presence-on-workstations2026.09.28
Field Notes10m read
Detecting SoftPerfect NetScan on a Workstation/blog/detecting-softperfect-netscan-on-a-workstation2026.09.28
Field Notes10m read
Web security audits: practical tips for beginners/blog/web-security-audits-practical-tips-for-beginners2026.09.28
Field Notes10m read
Finding the conversation that matters with Wireshark/blog/finding-the-conversation-that-matters-with-wireshark2026.09.28
Field Notes12m read
Decoding base58, base32, and hex for forensic analysis/blog/decoding-base58-base32-and-hex-for-forensic-analysis2026.09.28
Field Notes10m read
Decoding base58, base32, and hex in forensics and malware triage/blog/decoding-base58-base32-and-hex-in-forensics-and-malware-triage2026.09.28
Field Notes10m read
Decoding base58, base32, and hex for malware triage/blog/decoding-base58-base32-and-hex-for-malware-triage2026.09.28
Field Notes12m read
Decoding base58, base32, and hex in malware analysis/blog/decoding-base58-base32-and-hex-in-malware-analysis2026.09.28
Field Notes12m read
Android APK reverse engineering: Smali patching and Frida hooking/blog/android-apk-reverse-engineering-smali-patching-and-frida-hooking2026.09.27
Field Notes10m read
Extracting credentials from Windows minidumps/blog/extracting-credentials-from-windows-minidumps2026.09.26
Field Notes12m read
Exploring lesser-known DNS record types for better management/blog/exploring-lesser-known-dns-record-types-for-better-management2026.09.26
Field Notes10m read
Understanding SSH Agent Forwarding and Risks with Untrusted Hosts/blog/understanding-ssh-agent-forwarding-and-risks-with-untrusted-hosts2026.09.26
Field Notes10m read
HTTP keep-alive, pipelining, and connection multiplexing explained/blog/http-keep-alive-pipelining-and-connection-multiplexing-explained2026.09.26
Field Notes12m read
SSH agent forwarding: understanding the risks of untrusted jump hosts/blog/ssh-agent-forwarding-understanding-the-risks-of-untrusted-jump-hosts2026.09.26
Field Notes12m read
Automotive CAN bus reverse engineering: Sniffing and analyzing data/blog/automotive-can-bus-reverse-engineering-sniffing-and-analyzing-data2026.09.25
Field Notes12m read
Extracting UART Console Output and Interrupting U-Boot on Embedded Routers/blog/extracting-uart-console-output-and-interrupting-u-boot-on-embedded-routers2026.09.25
Field Notes12m read
Leveraging firewall logs for enhanced cybersecurity insights/blog/leveraging-firewall-logs-for-enhanced-cybersecurity-insights2026.09.25
Field Notes12m read
Mastering firewall log analysis for security monitoring/blog/mastering-firewall-log-analysis-for-security-monitoring2026.09.25
Field Notes12m read
Creating and auditing WDAC policies using PowerShell/blog/creating-and-auditing-wdac-policies-using-powershell2026.09.25
Field Notes12m read
Understanding hashing and why passwords aren't encrypted/blog/understanding-hashing-and-why-passwords-aren-t-encrypted2026.09.24
Field Notes12m read
Understanding asymmetric and symmetric encryption/blog/understanding-asymmetric-and-symmetric-encryption2026.09.24
Field Notes10m read
Asymmetric vs. symmetric encryption: Data-at-rest and data-in-transit/blog/asymmetric-vs-symmetric-encryption-data-at-rest-and-data-in-transit2026.09.24
Field Notes12m read
Understanding asymmetric and symmetric encryption in data security/blog/understanding-asymmetric-and-symmetric-encryption-in-data-security2026.09.24
Field Notes12m read
Navigating the Rules of Engagement to Avoid Legal Pitfalls/blog/navigating-the-rules-of-engagement-to-avoid-legal-pitfalls2026.09.24
Field Notes12m read
Understanding Kerberos: Tickets and the KDC/blog/understanding-kerberos-tickets-and-the-kdc2026.09.23
Field Notes10m read
Defending Active Directory objects: a practical approach/blog/defending-active-directory-objects-a-practical-approach2026.09.23
Field Notes10m read
Preparing for hands-on tests in junior cybersecurity interviews/blog/preparing-for-hands-on-tests-in-junior-cybersecurity-interviews2026.09.23
Field Notes10m read
Preparing for a hands-on cybersecurity interview with tools/blog/preparing-for-a-hands-on-cybersecurity-interview-with-tools2026.09.23
Field Notes12m read
Mastering Wireshark and Scapy for Cybersecurity Interviews/blog/mastering-wireshark-and-scapy-for-cybersecurity-interviews2026.09.22
Field Notes12m read
Preparing for hands-on cybersecurity tests with Scapy and Wireshark/blog/preparing-for-hands-on-cybersecurity-tests-with-scapy-and-wireshark2026.09.21
Field Notes12m read
Getting hands-on with cybersecurity interviews using Wireshark and Scapy/blog/getting-hands-on-with-cybersecurity-interviews-using-wireshark-and-scapy2026.09.21
Field Notes12m read
Mastering Protocol Subversion with Wireshark and Scapy for Interviews/blog/mastering-protocol-subversion-with-wireshark-and-scapy-for-interviews2026.09.21
Field Notes12m read
Active Directory object defense strategies for practitioners/blog/active-directory-object-defense-strategies-for-practitioners2026.09.21
Field Notes10m read
Why your EASM inventory changes between scans/blog/why-your-easm-inventory-changes-between-scans2026.09.21
Field Notes12m read
Why EASM inventory fluctuates between scans/blog/why-easm-inventory-fluctuates-between-scans2026.09.20
Field Notes10m read
Understanding EASM inventory changes between scans/blog/understanding-easm-inventory-changes-between-scans2026.09.20
Field Notes10m read
Investigating EASM Inventory Fluctuations Between Scans/blog/investigating-easm-inventory-fluctuations-between-scans2026.09.20
Field Notes12m read
Understanding fluctuations in EASM inventory between scans/blog/understanding-fluctuations-in-easm-inventory-between-scans2026.09.20
Field Notes12m read
Kubernetes RBAC assessment methodology in practice/blog/kubernetes-rbac-assessment-methodology-in-practice2026.09.20
Field Notes12m read
Validating PostgreSQL RLS policies in Supabase/blog/validating-postgresql-rls-policies-in-supabase2026.09.20
Field Notes12m read
Kerberos tickets and KDC: understanding the mechanics and failures/blog/kerberos-tickets-and-kdc-understanding-the-mechanics-and-failures2026.09.20
Field Notes12m read
Understanding the basics of threat hunting/blog/understanding-the-basics-of-threat-hunting2026.09.20
Field Notes12m read
Penetration testing fundamentals for beginners/blog/penetration-testing-fundamentals-for-beginners2026.09.20
Field Notes12m read
Assessing Kubernetes RBAC: A Practical Approach/blog/assessing-kubernetes-rbac-a-practical-approach2026.09.19
Field Notes12m read
Supabase RLS policies: validation methodologies and failure modes/blog/supabase-rls-policies-validation-methodologies-and-failure-modes2026.09.19
Field Notes10m read
Subnetting and CIDR mental math for assessments/blog/subnetting-and-cidr-mental-math-for-assessments2026.09.19
Field Notes10m read
Running a cybersecurity tabletop exercise effectively/blog/running-a-cybersecurity-tabletop-exercise-effectively2026.09.19
Field Notes12m read
Navigating rules of engagement to avoid criminal liability/blog/navigating-rules-of-engagement-to-avoid-criminal-liability2026.09.19
Field Notes10m read
Understanding Kerberos: Tickets and KDC Failures/blog/understanding-kerberos-tickets-and-kdc-failures2026.09.19
Field Notes10m read
Understanding Active Directory Objects for Defensive Strategies/blog/understanding-active-directory-objects-for-defensive-strategies2026.09.18
Field Notes12m read
Mitigating risks when clients get compromised/blog/mitigating-risks-when-clients-get-compromised2026.09.18
Field Notes10m read
Detecting client compromise to prevent security breaches/blog/detecting-client-compromise-to-prevent-security-breaches2026.09.18
Field Notes12m read
Crafting Effective Rules of Engagement for Assessments/blog/crafting-effective-rules-of-engagement-for-assessments2026.09.18
Field Notes10m read
Active Directory objects for defenders: an operational approach/blog/active-directory-objects-for-defenders-an-operational-approach2026.09.18
Field Notes12m read
Kerberos in practice: tickets, KDC, and pitfalls/blog/kerberos-in-practice-tickets-kdc-and-pitfalls2026.09.18
Field Notes12m read
Tabletop exercises for threat hunting: A practical approach/blog/tabletop-exercises-for-threat-hunting-a-practical-approach2026.09.18
Field Notes12m read
Conducting effective cybersecurity tabletop exercises/blog/conducting-effective-cybersecurity-tabletop-exercises2026.09.18
Field Notes12m read
Kerberos: Understanding tickets, the KDC, and common issues/blog/kerberos-understanding-tickets-the-kdc-and-common-issues2026.09.17
Field Notes12m read
Spotting Over-Permissive IAM Policies in Cloud Environments/blog/spotting-over-permissive-iam-policies-in-cloud-environments2026.09.17
Field Notes12m read
Understanding Kerberos: The Role of Tickets and KDC/blog/understanding-kerberos-the-role-of-tickets-and-kdc2026.09.17
Field Notes12m read
Understanding SQL Injection at the Query Level/blog/understanding-sql-injection-at-the-query-level2026.09.17
Field Notes12m read
Understanding Active Directory Objects for Effective Defense/blog/understanding-active-directory-objects-for-effective-defense2026.09.17
Field Notes12m read
Rust's ownership model and the elimination of certain vulnerabilities/blog/rust-s-ownership-model-and-the-elimination-of-certain-vulnerabilities2026.09.17
Field Notes12m read
Session management: cookies, flags, and attack vectors/blog/session-management-cookies-flags-and-attack-vectors2026.09.17
Field Notes12m read
Burp Suite: Streamlined usage in your authorized lab/blog/burp-suite-streamlined-usage-in-your-authorized-lab2026.09.17
Field Notes12m read
HTTP request smuggling through parser disagreement/blog/http-request-smuggling-through-parser-disagreement2026.09.16
Field Notes12m read
Segmenting a flat network without breaking the business/blog/segmenting-a-flat-network-without-breaking-the-business2026.09.16
Field Notes12m read
Backups as a security control: lessons from ransomware/blog/backups-as-a-security-control-lessons-from-ransomware2026.09.16
Field Notes10m read
Purple teaming: running a detection test that changes something/blog/purple-teaming-running-a-detection-test-that-changes-something2026.09.16
Field Notes10m read
Understanding Active Directory Objects for Defense/blog/understanding-active-directory-objects-for-defense2026.09.16
Field Notes10m read
Defending Active Directory: Understanding Objects and Their Roles/blog/defending-active-directory-understanding-objects-and-their-roles2026.09.16
Field Notes12m read
Evaluating Kubernetes RBAC: Methodology and Implications/blog/evaluating-kubernetes-rbac-methodology-and-implications2026.09.15
Field Notes12m read
Reconstructing Windows execution history through disk artifacts/blog/reconstructing-windows-execution-history-through-disk-artifacts2026.09.15
Field Notes12m read
Reconstructing Execution History Using Windows Disk Artifacts/blog/reconstructing-execution-history-using-windows-disk-artifacts2026.09.15
Field Notes12m read
Reconstructing execution history from Windows disk artifacts/blog/reconstructing-execution-history-from-windows-disk-artifacts2026.09.15
Field Notes12m read
Metasploit in a lab: what the framework does and where it lies to you/blog/metasploit-in-a-lab-what-the-framework-does-and-where-it-lies-to-you2026.09.15
Field Notes12m read
Environment variables and the security risks of a misconfigured PATH/blog/environment-variables-and-the-security-risks-of-a-misconfigured-path2026.09.15
Field Notes12m read
Decoding heap bug reports through C memory semantics/blog/decoding-heap-bug-reports-through-c-memory-semantics2026.09.15
Field Notes10m read
MFA implementations ranked by their common failure modes/blog/mfa-implementations-ranked-by-their-common-failure-modes2026.09.15
Field Notes12m read
Metasploit: Understanding its traps in a lab environment/blog/metasploit-understanding-its-traps-in-a-lab-environment2026.09.15
Field Notes12m read
Avoiding the criminal liability trap in assessments/blog/avoiding-the-criminal-liability-trap-in-assessments2026.09.14
Field Notes12m read
Deciphering TLS handshake failures with precision/blog/deciphering-tls-handshake-failures-with-precision2026.09.14
Field Notes12m read
OUR 100th ISSUE!! w00t!! Rapidly Rebuilding Your Windows and Linux Lab Range/blog/rapidly-rebuilding-your-windows-and-linux-lab-range2026.09.14
Field Notes12m read
Assessing Kubernetes RBAC: Methodologies and Pitfalls/blog/assessing-kubernetes-rbac-methodologies-and-pitfalls2026.09.14
Field Notes10m read
Metasploit in your lab: navigating its traps and truths/blog/metasploit-in-your-lab-navigating-its-traps-and-truths2026.09.14
Field Notes12m read
Understanding Kerberos: Tickets, KDC, and Common Pitfalls/blog/understanding-kerberos-tickets-kdc-and-common-pitfalls2026.09.13
Field Notes12m read
Memory acquisition: volatile data's evidential weight/blog/memory-acquisition-volatile-data-s-evidential-weight2026.09.13
Field Notes10m read
Kerberos demystified: navigating tickets and KDC pitfalls/blog/kerberos-demystified-navigating-tickets-and-kdc-pitfalls2026.09.13
Field Notes12m read
Git hygiene for security teams: managing secrets and history/blog/git-hygiene-for-security-teams-managing-secrets-and-history2026.09.13
Field Notes12m read
Testing Detection Mechanisms Through Active Changes/blog/testing-detection-mechanisms-through-active-changes2026.09.13
Field Notes10m read
Identifying over-permissive IAM policies in the cloud/blog/identifying-over-permissive-iam-policies-in-the-cloud2026.09.13
Field Notes10m read
Breaking down packet anatomy for network analysts/blog/breaking-down-packet-anatomy-for-network-analysts2026.09.13
Field Notes12m read
Testing detection efficacy through purple teaming/blog/testing-detection-efficacy-through-purple-teaming2026.09.13
Field Notes12m read
Prioritizing log sources for centralized analysis on a budget/blog/prioritizing-log-sources-for-centralized-analysis-on-a-budget2026.09.13
Field Notes8m read
Ransomware recovery: testing your backup strategy/blog/ransomware-recovery-testing-your-backup-strategy2026.09.13
Field Notes10m read
Evolving your detection: the art of adaptive purple teaming/blog/evolving-your-detection-the-art-of-adaptive-purple-teaming2026.09.13
Field Notes8m read
Burp Suite in practice: a hands-on approach in your lab/blog/burp-suite-in-practice-a-hands-on-approach-in-your-lab2026.09.13
Field Notes8m read
Understanding vulnerability assessments and penetration testing/blog/understanding-vulnerability-assessments-and-penetration-testing2026.09.13
Field Notes8m read
Correlating Windows event logs for authentication and process tracking/blog/correlating-windows-event-logs-for-authentication-and-process-tracking2026.09.13
Field Notes8m read
Managing PostgreSQL roles and row-level security effectively/blog/managing-postgresql-roles-and-row-level-security-effectively2026.09.13
Field Notes8m read
Memory acquisition: proving volatility and its limits/blog/memory-acquisition-proving-volatility-and-its-limits2026.09.13
Field Notes8m read
Assessing Kubernetes RBAC: Methodology and Tradeoffs/blog/assessing-kubernetes-rbac-methodology-and-tradeoffs2026.09.12
Field Notes8m read
Leveraging Python for security tools and parsing requests/blog/leveraging-python-for-security-tools-and-parsing-requests2026.09.12
Field Notes8m read
OSINT with discipline: scoping, sourcing, and recording findings/blog/osint-with-discipline-scoping-sourcing-and-recording-findings2026.09.12
Field Notes8m read
Using DNS logs to detect tunneling and beaconing/blog/using-dns-logs-to-detect-tunneling-and-beaconing2026.09.12
Field Notes7m read
Understanding Linux processes: PIDs, parents, and process trees/blog/understanding-linux-processes-pids-parents-and-process-trees2026.09.12
Field Notes8m read
Understanding bits, bytes, hex, and base64 encoding/blog/understanding-bits-bytes-hex-and-base64-encoding2026.09.12
Field Notes10m read
JWT validation pitfalls that permit silent access/blog/jwt-validation-pitfalls-that-permit-silent-access2026.09.12
Field Notes10m read
Metasploit in your lab: navigating its pitfalls and promises/blog/metasploit-in-your-lab-navigating-its-pitfalls-and-promises2026.09.12
Field Notes8m read
Common security misconceptions that survive testing/blog/common-security-misconceptions-that-survive-testing2026.09.12
Field Notes8m read
Developing a repeatable firewall ruleset review methodology/blog/developing-a-repeatable-firewall-ruleset-review-methodology2026.09.12
Field Notes8m read
SPF, DKIM, and DMARC: Trust in email authentication/blog/spf-dkim-and-dmarc-trust-in-email-authentication2026.09.11
Field Notes8m read
How NAT reshapes your network understanding/blog/how-nat-reshapes-your-network-understanding2026.09.11
Field Notes8m read
Crafting rules of engagement to avoid criminal liability/blog/crafting-rules-of-engagement-to-avoid-criminal-liability2026.09.11
Field Notes8m read
PowerShell objects versus text and hunting implications/blog/powershell-objects-versus-text-and-hunting-implications2026.09.11
Field Notes8m read
How a misconfigured PATH can lead to security issues/blog/how-a-misconfigured-path-can-lead-to-security-issues2026.09.10
Field Notes8m read
Transforming true positives into robust detection rules/blog/transforming-true-positives-into-robust-detection-rules2026.09.10
Field Notes8m read
Finding critical conversations with Wireshark/blog/finding-critical-conversations-with-wireshark2026.09.10
Field Notes8m read
Decoding common data formats: bits, bytes, and beyond/blog/decoding-common-data-formats-bits-bytes-and-beyond2026.09.10
Field Notes10m read
Persistence on Windows: overlooked locations in detection/blog/persistence-on-windows-overlooked-locations-in-detection2026.09.09
Field Notes8m read
Docker security defaults worth changing before anything ships/blog/docker-security-defaults-worth-changing-before-anything-ships2026.09.09
Field Notes9m read
Understanding the terminal, shell, and sessions in Linux/blog/understanding-the-terminal-shell-and-sessions-in-linux2026.09.09
Field Notes10m read
Container escape conditions and verification techniques/blog/container-escape-conditions-and-verification-techniques2026.09.08
Field Notes8m read
Using MITRE ATT&CK as an analysis tool/blog/using-mitre-att-and-ck-as-an-analysis-tool2026.09.08
Field Notes8m read
Decoding stack traces like a detective/blog/decoding-stack-traces-like-a-detective2026.09.08
Field Notes10m read
Isolated malware lab: unpacking behavior analysis/blog/isolated-malware-lab-unpacking-behavior-analysis2026.09.08
Field Notes7m read
Flattening the risks: network segmentation without disruption/blog/flattening-the-risks-network-segmentation-without-disruption2026.09.08
Field Notes8m read
Understanding public keys, private keys, and certificates/blog/understanding-public-keys-private-keys-and-certificates2026.09.08
Field Notes10m read
Verifying PostgreSQL RLS policies in Supabase/blog/verifying-postgresql-rls-policies-in-supabase2026.09.08
Field Notes7m read
Navigating the first two years of a security career/blog/navigating-the-first-two-years-of-a-security-career2026.09.08
Field Notes8m read
What root actually means on Linux, and why uid 0 is not magic/blog/what-root-actually-means-on-linux-and-why-uid-0-is-not-magic2026.09.07
Field Notes10m read
Privilege escalation on Windows: tokens, services, and ACLs/blog/privilege-escalation-on-windows-tokens-services-and-acls2026.09.07
Field Notes8m read
Active Directory objects: Defending your digital realm/blog/active-directory-objects-defending-your-digital-realm2026.09.07
Field Notes8m read
What a port really is and why 65535 of them exist/blog/what-a-port-really-is-and-why-65535-of-them-exist2026.09.07
Field Notes10m read
Enhancing detection through purple teaming exercises/blog/enhancing-detection-through-purple-teaming-exercises2026.09.07
Field Notes8m read
Identifying normal Windows processes and services pre-incident/blog/identifying-normal-windows-processes-and-services-pre-incident2026.09.07
Field Notes8m read
Understanding Linux file permissions: rwx, octal, and setuid/blog/understanding-linux-file-permissions-rwx-octal-and-setuid2026.09.07
Field Notes8m read
Red team infrastructure hygiene during authorized engagements/blog/red-team-infrastructure-hygiene-during-authorized-engagements2026.09.07
Field Notes8m read
API authorization vulnerabilities: object references and scopes/blog/api-authorization-vulnerabilities-object-references-and-scopes2026.09.06
Field Notes8m read
Hashing and password storage: what you need to know/blog/hashing-and-password-storage-what-you-need-to-know2026.09.06
Field Notes8m read
Privilege escalation on Linux: the enumeration order that pays off/blog/privilege-escalation-on-linux-the-enumeration-order-that-pays-off2026.09.05
Field Notes8m read
Operational security for practitioners: separating research from identity/blog/operational-security-for-practitioners-separating-research-from-identity2026.09.05
Field Notes8m read
What happens when you type a URL into a browser?/blog/what-happens-when-you-type-a-url-into-a-browser2026.09.05
Field Notes8m read
Static triage of suspicious binaries without execution/blog/static-triage-of-suspicious-binaries-without-execution2026.09.05
Field Notes8m read
Common security misconceptions that need testing/blog/common-security-misconceptions-that-need-testing2026.09.05
Field Notes8m read
Authentication versus authorization: learn from failures/blog/authentication-versus-authorization-learn-from-failures2026.09.05
Field Notes8m read
Dissecting HTTP requests and responses by hand/blog/dissecting-http-requests-and-responses-by-hand2026.09.04
Field Notes8m read
Client-side versus server-side: understanding web vulnerabilities/blog/client-side-versus-server-side-understanding-web-vulnerabilities2026.09.03
Field Notes6m read
Reading Nmap output like an operator/blog/reading-nmap-output-like-an-operator2026.09.02
Field Notes8m read
Certificate lifecycle failures that take production down/blog/certificate-lifecycle-failures-that-take-production-down2026.08.02
Field Notes5m read
From alert to containment: the first fifteen minutes/blog/from-alert-to-containment-the-first-fifteen-minutes2026.07.02
Field Notes6m read
Triaging a suspicious PowerShell execution end to end/blog/triaging-a-suspicious-powershell-execution-end-to-end2026.06.02
Field Notes6m read
Scoping rules of engagement so an assessment stays legal/blog/scoping-rules-of-engagement-so-an-assessment-stays-legal2026.05.02
Field Notes8m read
Phishing analysis: headers, links, and attachments, safely/blog/phishing-analysis-headers-links-and-attachments-safely2026.04.04
Field Notes8m read
Authorization design: policy at the boundary versus policy in the database/blog/authorization-design-policy-at-the-boundary-versus-policy-in-the-database2026.03.04
Field Notes8m read
Stop typing passwords: how SSH keys simplify authentication/blog/stop-typing-passwords-how-ssh-keys-simplify-authentication2026.02.03
Field Notes10m read
Containment decisions under uncertainty: isolate, monitor, or wait/blog/containment-decisions-under-uncertainty-isolate-monitor-or-wait2026.01.03
Field Notes6m read
How to read a firewall ruleset and find the hole/blog/how-to-read-a-firewall-ruleset-and-find-the-hole2025.12.02
Field Notes8m read
Password cracking concepts in a lab: length beats complexity/blog/password-cracking-concepts-in-a-lab-length-beats-complexity2025.11.03
Field Notes8m read
Understanding DNS resolution from stub resolver to authority/blog/understanding-dns-resolution-from-stub-resolver-to-authority2025.10.02
Field Notes9m read
Correlating Windows event logs for deeper insights/blog/correlating-windows-event-logs-for-deeper-insights2025.09.04
Field Notes8m read
Linux persistence techniques: systemd, cron, and shared objects/blog/linux-persistence-techniques-systemd-cron-and-shared-objects2025.08.03
Field Notes8m read
Mapping attack surfaces in inherited cloud environments/blog/mapping-attack-surfaces-in-inherited-cloud-environments2025.07.04
Field Notes6m read
Building a disposable lab range for practicing network attacks/blog/building-a-disposable-lab-range-for-practicing-network-attacks2025.06.02
Field Notes8m read
Seamless SOC shift handovers without losing investigation context/blog/seamless-soc-shift-handovers-without-losing-investigation-context2025.05.04
Field Notes6m read
Why capture-the-flag skills do not transfer to incident response/blog/why-capture-the-flag-skills-do-not-transfer-to-incident-response2025.04.02
Field Notes6m read
Evidence handling for screenshots and hash chains in security/blog/evidence-handling-for-screenshots-and-hash-chains-in-security2025.03.02
Field Notes8m read
TCP versus UDP: What breaks when you pick the wrong one/blog/tcp-versus-udp-what-breaks-when-you-pick-the-wrong-one2025.02.04
Field Notes7m read
Understanding bits, bytes, hex, and base64 in analysis/blog/understanding-bits-bytes-hex-and-base64-in-analysis2025.01.03
Field Notes8m read
Sysmon configuration choices that save time and money/blog/sysmon-configuration-choices-that-save-time-and-money2024.12.03
Field Notes6m read
Threat hunting with hypotheses instead of dashboards/blog/threat-hunting-with-hypotheses-instead-of-dashboards2024.11.02
Field Notes8m read
Burp Suite: Analyzing web applications in your lab/blog/burp-suite-analyzing-web-applications-in-your-lab2024.10.03
Field Notes8m read
Detecting log tampering with clock skew and impossible events/blog/detecting-log-tampering-with-clock-skew-and-impossible-events2024.09.03
Field Notes10m read
Lateral movement telemetry: identifying remote execution traces/blog/lateral-movement-telemetry-identifying-remote-execution-traces2024.08.03
Field Notes6m read
Credential theft paths most teams still leave open/blog/credential-theft-paths-most-teams-still-leave-open2024.07.02
Field Notes6m read
How a misconfigured PATH can become a security flaw/blog/how-a-misconfigured-path-can-become-a-security-flaw2024.06.03
Field Notes8m read
Bash pipelines for log triage with sort, uniq, awk, and cut/blog/bash-pipelines-for-log-triage-with-sort-uniq-awk-and-cut2024.05.03
Field Notes6m read
Evidence handling: what a defensible screenshot and hash chain looks like/blog/evidence-handling-what-a-defensible-screenshot-and-hash-chain-looks-like2024.04.02
Field Notes8m read
Deciphering SIEM query performance: slow and noisy detections/blog/deciphering-siem-query-performance-slow-and-noisy-detections2024.03.04
Field Notes6m read
Writing an incident timeline that survives review/blog/writing-an-incident-timeline-that-survives-review2024.02.02
Field Notes8m read
What a virtual machine gives you that a container does not/blog/what-a-virtual-machine-gives-you-that-a-container-does-not2024.01.04
Field Notes7m read
Writing actionable findings for developers/blog/writing-actionable-findings-for-developers2023.12.03