HTTP/3 and QUIC: How the Web Moved to a New Transport
How QUIC rebuilt web transport on UDP: per-stream delivery, 1-RTT handshakes with TLS 1.3 inside, connection migration — and the real costs.
All articles published by
Hmmnm
Hands-on cybersecurity tutorials, CVE breakdowns, and guided learning paths. Every technique is explained, tested, and paired with its mitigation — so you learn the attack and the defense together.
Dependency Confusion Lab: Reproduce and Defend Your Pipeline
Build a CTF-style lab that reproduces dependency confusion and namespace squatting — then lock them down with scoped registries, lockfile pinning and reproducible builds.
Cosign Signing and Verification Lab: Sign, Verify, Enforce
Sign and verify artifacts step-by-step with Sigstore Cosign: keyless signing, transparency log entries, and admission-time verification in a hands-on lab.
Kerberos Attack Paths: Golden Tickets, Silver Tickets and Kerberoasting
Golden Ticket, Silver Ticket and Kerberoasting explained: what each forgery needs, what it bypasses, and the log signals that catch them.
DNSSEC Explained: Chain of Trust, NSEC3 and the October 2026 Root Rollover
How DNSSEC signs the DNS: RRSIG, DS chains anchored at the root, NSEC3 trade-offs, and the KSK rollover landing October 11, 2026.
BOLA and Broken Auth API Attacks with Burp Suite: Lab Guide
Hijack your own lab: find and exploit BOLA and broken-auth flaws in a vulnerable API using Burp Suite — then learn the authorization checks that actually fix them.
OWASP ZAP DAST Lab: Authenticated API Scanning Explained
Break your own API with OWASP ZAP: active scanning, authenticated scan contexts and API definitions in a step-by-step DAST lab you can rebuild for any target.
eBPF Explained: Verified Programs Inside the Kernel
How eBPF runs verified, JIT-compiled programs safely in the Linux kernel — and why networking and security tools bet their stacks on it.
SSRF to Cloud Metadata: The Attack Behind Capital One and How to Stop It
How SSRF turns one forged request into cloud-wide credential theft — the Capital One chain, IMDSv2, and the controls that actually block it.
Decode ACARS and VDL2 with acarsdec and dumpvdls2: SDR Lab
Decode live aircraft ACARS and VDL2 datalink traffic with about $30 of SDR hardware, acarsdec, dumpvdls2 and Wireshark — a complete hands-on radio lab.
Weekly Threat Intel: Agentic AI Abuse and Edge CVEs
Agentic-AI abuse, the fall 2026 Edge CVE wave and infostealer tradecraft — this week’s defensive priorities in one briefing.
Certificate Transparency: How Merkle Logs Ended Blind Trust in CAs
How Certificate Transparency Merkle logs, SCTs and monitors make every TLS certificate publicly auditable — and how they caught Symantec in 2015.