Build a self-hosted Evilginx3 lab to safely study adversary-in-the-middle phishing, session cookie theft, and why FIDO2/WebAuthn defeats AiTM attacks.
Deep dive into MFA fatigue and push bombing attacks: mechanics, the 2022 Uber breach, and practical defenses like number matching, rate limiting, and Conditional Access.
Learn attack surface reconnaissance with Shodan, Censys, and crt.sh in this hands-on OSINT tutorial for blue-teamers and CTF players, with clear ethical…
This week's threat intel digest: ransomware loader shifts, actively exploited CVEs, and how adversaries abuse AI agent tooling in software supply chains. Verified facts, hands-on detection guidance for blue teams.
Build a safe GraphQL attack lab: chain introspection, query depth abuse, and field-level auth bypass, then defend with persisted queries and cost limits. Step-by-step tutorial for security learners and blue teams.
How SQLite single-file, serverless, public-domain design conquered phones and browsers, what WAL mode buys, and when a server database is still right.
Hands-on SSRF lab: exploit a vulnerable URL-fetch parameter, pivot to cloud metadata endpoints, then enforce allowlist defenses. Verified commands and configs for blue teams and CTF players.
The proactive complement to alerting: hypothesis-driven hunts, Bianco Pyramid of Pain economics, the maturity model, and the detection conversion loop.
This week's threat intel: exploited CVEs, ransomware affiliates adopting AI agent tooling, stealer-to-ransomware handoff tradecraft, and hands-on blue-team detection guidance for 22 September 2026.
Field notes from building this site hands-on labs: the failure intuition certifications cannot teach, and how to start with zero budget.
This week's threat intel roundup: OAuth third-party app abuse, actively exploited Autumn 2026 CVEs, and malware loader trends — with defender actions mapped to each tradecraft pattern.
How WPA3 SAE replaces crackable PSKs with a Dragonfly PAKE, what Dragonblood actually broke, and how H2E fixed the transition.