Blog

• 2024-10-20

  Frog

  When a maze has no solution, read the source and call the function that generates the answer.

• 2024-10-14

  Huntress CTF 2024: warmup write-ups

  Nested QR codes, a cattle-themed esolang, a shop with no input validation, and an SGID find binary.

• 2024-09-10

  How C2 frameworks work

  The main parts of command and control, how they communicate, and how frameworks vary the timing.

• 2024-08-15

  Container security: escapes and hardening

  Common container escape paths, the conditions they need, and practical ways to reduce the risk.

• 2024-07-20

  Detecting Windows persistence with Splunk

  Two MITRE persistence techniques, the Sysmon events they leave behind, and the SPL to catch them.