Cheatsheets and Checklists
iOS Penetration Testing Cheatsheet
A hands-on guide to testing iOS app security using Frida, Objection, jailbreak detection bypass, SSL pinning, and runtime instrumentation—no fluff, just real techniques.
All posts
Cheatsheets and Checklists
Smali Debug Cheatsheet
A practical cheatsheet for reading, editing, debugging, and rebuilding Android apps at the Smali level, including Frida Gadget injection and Logcat printing.
Vulnerability
DNS Zone Transfers: Finding and Fixing Unrestricted AXFR
How I test DNS zone-transfer permissions, interpret the response, and restrict transfers without breaking secondary DNS servers.
Vulnerability
SNMP Exposure: Using Nmap and snmpwalk to Check Access
How I check SNMP exposure, interpret UDP scan results, and distinguish read access from dangerous management permissions.
Vulnerability
Kerberoasting, Silver Tickets, and Golden Tickets: Different Keys, Different Risks
How I separate Kerberoasting from Kerberos ticket forgery, check the prerequisites, and collect evidence that supports each finding.
Tools and Scripting
reconFTW: Building a Repeatable Reconnaissance Workflow
How I set up reconFTW, choose a bounded workflow, and turn collected reconnaissance data into findings I can verify.
Security Blogs
Reverse Analytics Lookup: Connecting Domains Through Shared Tags
How I use shared analytics identifiers as OSINT leads, account for historical data, and avoid treating a common tag as proof of ownership.
Security Blogs
XSS Payloads in JSP: Why the Output Context Matters
How I evaluate a small set of historical XSS probes and separate WAF behavior from a browser-confirmed application vulnerability.
Security Blogs
40 Security Research Resources, Grouped by the Question They Answer
A practical directory for infrastructure research, threat intelligence, code search, and historical context, with corrections to older entries.
Security Blogs
Sliver C2: Setting Up a Small Windows and Linux Lab
How I separate Sliver servers, operator clients, and implants, then build a bounded lab with evidence for each connection step.
Security Blogs
Download Website Files Recursively with Wget
How I use Wget to download linked files under a web directory, control recursion, and check what was saved.
Tools and Scripting
OutBandit: Investigating Out-of-Band Application Behaviour
Why I built OutBandit for Burp Suite, how I approach callback testing, and what an HTTP or DNS interaction can actually prove.
Capture The Flag
MuzzyBox: Practising Injection and Linux Privilege Boundaries
An introduction to my MuzzyBox CTF and the questions I use to investigate NoSQL injection, Python evaluation, SSTI, and Linux escalation.
Capture The Flag
FinitHicDeo: A CTF Built Around Protocol Behaviour
An introduction to FinitHicDeo, its programming and request-smuggling themes, and the evidence I would keep while solving the lab.
Security Blogs
Deep Learning for Threat Detection: Reading the Evidence Before the Accuracy Claim
How I read a survey of deep learning for threat detection, distinguish research claims from deployment evidence, and evaluate practical tradeoffs.
Security Blogs
Reading RAND on the Operational Feasibility of Adversarial AI Attacks
Why I separate an adversarial example in a paper from a feasible attack on a deployed system, and how that changes my risk assessment.
Tools and Scripting
Nuclei: Repeatable Security Checks with Templates
How I use Nuclei templates to run focused security checks, preserve evidence, and validate findings before reporting them.
Security Blogs
Donut Shellcode: Understanding the Loader and Testing Detection Claims
What Donut generates, how its managed-code loader works, and the evidence I need before describing any endpoint protection bypass.
Vulnerability
Server-Side Template Injection: Testing the Template Boundary
How I identify server-side template injection, reproduce it in a small Flask lab, and fix the separation between template source and data.
Tools and Scripting
Frida: Inspecting Android TLS Checks and Native Applications
How I use Frida to inspect Android TLS behaviour, distinguish UI changes from real bypasses, and trace selected Windows API calls.
All 20 posts shown