Build an AiTM Phishing Lab with Evilginx: Understanding Session Cookie Theft and Detection
Build a safe, isolated AiTM phishing lab with Evilginx to see how session cookie theft works — and learn the detection signals blue teams can use to catch…
All articles published by
Hmmnm
Hands-on cybersecurity tutorials, CVE breakdowns, and guided learning paths. Every technique is explained, tested, and paired with its mitigation — so you learn the attack and the defense together.
Wireshark + Scapy Lab: Replay and Dissect Aircraft ADS-B and ACARS Traffic
A capture-free, hands-on lab using public aviation feeds, Wireshark, and Scapy to dissect and replay ADS-B and ACARS traffic, and understand passive…
Build a PCAP Triage Lab with Zeek and T-Shark: Spot C2 Beacons in Real Traffic
Build a hands-on PCAP triage lab with Zeek and tshark. Extract C2 beacon intervals, JA3 fingerprints, and DNS tunnels from sample captures with verified…
Write YARA Rules That Catch Ransomware Families: A Detection Lab with yara-python
A hands-on lab teaching you how to write, test, and tune YARA rules that detect ransomware families using yara-python, real indicators, and a repeatable…
Agentic AI Security Cheat Sheet: Threat Models, MCP Hardening Checklist and Detection Hooks
One-page agentic AI security cheat sheet: agent threat models, an MCP server hardening checklist, and the log sources and detection hooks blue teams need…
Alert Fatigue Is a Design Problem: Building a Detection Engineering Lifecycle That Survives Contact
Alert fatigue is a design flaw, not an analyst problem. Learn a full detection engineering lifecycle — hypothesis, build, tune, retire — with MTTD,…
Write Sigma Rules That Actually Fire: A Detection-as-Code Lab with SigmaCLI and splunk-react
Build a hands-on Detection-as-Code lab: author Sigma rules, validate them with sigma-cli, convert them to Splunk queries, and fire real detections in a CI…
Why Planes Don’t Get Hacked — And Where the Next Aviation Cyber Risk Really Is
A deep dive into aircraft cybersecurity: why planes resist hacking, the real attack surface in avionics, satcom, ADS-B, and ground systems, and where the…
What Is Prompt Injection and How to Prevent It: A Complete Exam Prep Guide
Learn what prompt injection attacks are, how they exploit LLMs, and the most effective defenses, ranked - a study guide for cybersecurity exam aspirants.
Pyramid of Pain to Production: How Detection Engineers Prioritize What to Hunt
A hands-on guide mapping the Pyramid of Pain and MITRE ATT&CK to real detection engineering decisions: what to hunt first, which telemetry to collect, and…
Build a Free Elastic Security SOC: Ingest Sysmon, Create Dashboards and Triage Alerts
Learn how to build a free SOC lab with Elastic Security: install Sysmon, ingest Windows event logs via Winlogbeat, build detection rules, dashboards, and…
Testing JWT Security with jwt-cli and Caido: Alg Confusion, Weak Secrets, and Expired Claims
Hands-on tutorial covering the four most common JWT flaws—alg confusion, weak HMAC secrets, expired claims, and missing validation—using jwt-cli and Caido, with verifiable commands and hardened configs.