Blog

Learn to build a certificate transparency monitoring pipeline with crt.sh and the CT Logs API. Hands-on commands, JSON queries, and alerting for subdomain tracking.

A hands-on OpenSSL lab: create CSRs, add SANs, inspect x509 certificates, validate chains, and troubleshoot common TLS errors with commands you can run…

Step-by-step tutorial: build an isolated ransomware analysis sandbox with FLARE-VM and CAPE, safely detonate a sample, and automate C2 config extraction…

TL;DR: Yes, You Can Catch Ransomware Before Encryption Starts Shadow copy deletion, mass file writes, and ransom note drops are all detectable before encryption completes—using Sysmon Event IDs 1, 11,…

Weekly threat intel for defenders: LockBit affiliate reshuffles, actively exploited edge/VPN CVEs, and infostealer-to-ransomware chains with hands-on detection and hardening actions.

This week's threat intel: ransomware affiliate rotation between lockers, actively exploited CVEs defenders must patch now, and infostealer operations feeding the access broker economy. Actionable blue-team guidance.

Learn a hands-on urlscan.io OSINT workflow to pivot from a single phishing screenshot to the full campaign footprint using search operators, page.domains, and certificate data.

Hands-on lab showing why mounting /var/run/docker.sock gives containers host root access, with a full escape walkthrough and hardening via rootless Docker…

Build a safe, isolated AiTM phishing lab with Evilginx to see how session cookie theft works — and learn the detection signals blue teams can use to catch…

A capture-free, hands-on lab using public aviation feeds, Wireshark, and Scapy to dissect and replay ADS-B and ACARS traffic, and understand passive…

Build a hands-on PCAP triage lab with Zeek and tshark. Extract C2 beacon intervals, JA3 fingerprints, and DNS tunnels from sample captures with verified…

A hands-on lab teaching you how to write, test, and tune YARA rules that detect ransomware families using yara-python, real indicators, and a repeatable…