Most SIEMs fail not because the technology can’t keep up but because the detection content is bad. This guide walks through how a detection engineer actually thinks about a rule, from data onboarding to deployment. The Lifecycle Threat → Hypothesis → Data → Query → Tuning → Deploy → Measure → Retire Skip any step and you produce noise. ...
The OWASP Top 10 isn’t just a checklist — it’s a snapshot of how real-world breaches happen. The 2021 revision reorganized the previous list around root causes rather than symptoms, which makes it a much better map for both developers and security engineers. This guide walks through each category with reproducible examples, fixes, and detections. ...
Crypto categories in CTFs intimidate more newcomers than any other. The barrier isn’t math — it’s pattern recognition. Almost every CTF crypto challenge is a known weakness applied to slightly different parameters. The First Pass — Identify the Family When a challenge drops, classify it in under 30 seconds: ...
Platform Hack The Box Difficulty Easy OS Windows Points 20 Release 2020-02-22 Tags AD, AS-REP Roasting, DCSync Sauna is a deceptively rich Active Directory box. Despite its Easy rating, it walks you through three classic AD attack primitives — AS-REP Roasting, credential reuse via AutoLogon, and DCSync — making it one of the best beginner boxes for anyone preparing for OSCP, CRTP, or AD-heavy red team interviews. ...
The Windows privilege escalation surface has narrowed since the days of unquoted-service-path goldmines, but it hasn’t disappeared. Token abuse, misconfigured services, and overlooked AutoLogon registry entries still net SYSTEM on a meaningful percentage of corporate hosts. Step 0: Baseline whoami /all systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"System Type" hostname whoami /all is the single most informative command. Look at: ...
Kerberoasting remains the highest-ROI Active Directory attack: any authenticated domain user can request a service ticket for any account with a Service Principal Name (SPN), and crack that ticket offline. No special privileges. No exploits. Just Kerberos working as designed. ...
You have a low-privilege shell. Now what? This cheat sheet is the ordered, opinionated checklist that solves the privesc step on most CTFs and audits. 0. Stabilize the Shell python3 -c 'import pty; pty.spawn("/bin/bash")' export TERM=xterm-256color stty raw -echo; fg # back in your terminal: stty rows X cols Y A broken shell wastes hours. ...
Platform TryHackMe Difficulty Easy OS Linux Points 10 Release 2019-08-29 Tags Web enum, command injection, sudo abuse Pickle Rick is the room every new TryHackMe user solves first. It’s a perfect introduction to the full pentest loop on a single host — enumeration, exploitation, and post-exploitation — with a forgiving difficulty curve. ...
Cross-site scripting is twenty-five years old and still topping bug bounty payouts. Modern frameworks make trivial reflected XSS rare — but the bug class evolved, not disappeared. Here’s the 2026 view. The Three Flavors Type Where the payload lives Trigger Reflected URL or form, echoed in response Victim clicks crafted link Stored Database, served back to other users Victim visits an infected page DOM-based Sink in client-side JS reads a source Anything that influences the source Stored XSS is highest impact (often worm-able). DOM XSS dominates modern SPAs because so much state lives in the browser. ...
SQL injection is twenty-five years old and still in the OWASP Top 10. This guide covers detection, exploitation, automation with sqlmap, and modern defenses — with examples that work on real, modern stacks. Detection: The First Tick The classic single-quote test still works against bad code: ...