This week's verified threat intel: MCP tool-description tampering incidents, newly patched firmware and network device CVEs, and infostealer dump activity…
Learn to build a certificate transparency monitoring pipeline with crt.sh and the CT Logs API. Hands-on commands, JSON queries, and alerting for subdomain tracking.
A hands-on OpenSSL lab: create CSRs, add SANs, inspect x509 certificates, validate chains, and troubleshoot common TLS errors with commands you can run…
Step-by-step tutorial: build an isolated ransomware analysis sandbox with FLARE-VM and CAPE, safely detonate a sample, and automate C2 config extraction…
Hands-on blue team lab: simulate shadow copy deletion and mass file encryption in a VM, then hunt it with Sysmon, Velociraptor VQL, and Sigma rules.…
Weekly threat intel for defenders: LockBit affiliate reshuffles, actively exploited edge/VPN CVEs, and infostealer-to-ransomware chains with hands-on detection and hardening actions.
This week's threat intel: ransomware affiliate rotation between lockers, actively exploited CVEs defenders must patch now, and infostealer operations feeding the access broker economy. Actionable blue-team guidance.
Learn a hands-on urlscan.io OSINT workflow to pivot from a single phishing screenshot to the full campaign footprint using search operators, page.domains, and certificate data.
Hands-on lab showing why mounting /var/run/docker.sock gives containers host root access, with a full escape walkthrough and hardening via rootless Docker…
Build a safe, isolated AiTM phishing lab with Evilginx to see how session cookie theft works — and learn the detection signals blue teams can use to catch…
A capture-free, hands-on lab using public aviation feeds, Wireshark, and Scapy to dissect and replay ADS-B and ACARS traffic, and understand passive…
Build a hands-on PCAP triage lab with Zeek and tshark. Extract C2 beacon intervals, JA3 fingerprints, and DNS tunnels from sample captures with verified…