everything
Security notes, small apps, and a homelab build log. Some of it is polished. Most of it is me finding out in public.
pinned if you only read two 2
Fed Fed Fedora journal 9 min 01 Nov 2025 A dying laptop, a Lenovo warranty saga, and Windows telling me my license only supports one display language pushed me to Fedora KDE. Notes on what worked, what broke, and a few things I didn't expect. Homelab v0.1 – Why I Bought a Mini-PC Instead of Therapy journal 3 min 27 Dec 2024 The hardware-shopping-and-hallucinating-an-architecture origin story of this homelab series. Also known as "how I replaced therapy with a GMKtec K8 Plus."everything 140
Android Debugging notes 4 min 27 Sept 2026 How a crash shows up in logcat and how to isolate it: the ring buffers, priority and tag filters, the clear-reproduce-read sequence, and reading the FATAL EXCEPTION trace down to the line that caused it. Deep Links and URL Schemes on Android notes 3 min 27 Sept 2026 Testing Android deep links: how intent filters declare them, how App Links verify ownership while custom schemes cannot, and how to craft URIs that expose handlers trusting attacker-controlled data. Exported Components and the IPC Attack Surface notes 5 min 27 Sept 2026 How to test an Android app's exported components: enumerate activities, services, broadcast receivers, and content providers from the manifest, then invoke each one with am or drozer and judge whether the functionality behind it should be reachable from outside. Local Storage on Android notes 3 min 27 Sept 2026 Testing Android on-disk storage beyond SharedPreferences: internal files, cache, SQLite and Room databases, and external storage, plus reading the sandbox back with run-as and adb. SharedPreferences on Android notes 3 min 27 Sept 2026 Testing Android SharedPreferences: the plaintext XML backing store, the mode flags, EncryptedSharedPreferences and DataStore, and reading the store back from a device. WebViews in Android Apps notes 4 min 27 Sept 2026 Testing Android WebViews: the JavaScript bridge, what content the WebView loads, file and content access, mixed content and certificate errors, and remote debugging, with the pass and fail conditions for each. DIVA Lab Writeups notes 8 min 27 Sept 2026 Writeups for the DIVA (Damn Insecure and Vulnerable App) Android labs: each solved lab gets a section with the task, the vulnerable code, the exploit, and the finding, covering Insecure Logging, the hardcoded vendor key, the third-party credentials stored plaintext in SharedPreferences, a SQLite database, a temp file, and external storage, a SQL injection, and a WebView loading attacker content with JavaScript enabled. MHL IOTConnect Lab Writeup notes 3 min 27 Sept 2026 Solving the Mobile Hacking Lab IOTConnect challenge: every signup is a guest and guests are locked out of the master switch in the UI, the receiver that actually enforces the PIN is reachable from outside the app, and a broadcast brute force turns on every device. Ansible Foundations notes 3 min 25 Sept 2026 What Ansible is, how playbooks, inventory, and roles fit together, what idempotence and handlers mean, and how check mode makes changes safe to preview. Homelab v2.2 – Applying the Network with Ansible journal 3 min 25 Sept 2026 After writing the network layer down in v2.1, the next step was making those files apply themselves: an Ansible playbook that applies the network configs to the host, validates each one, and reloads services only when something changed. Homelab v2.1 – The Network, Explained Enough to Rebuild journal 6 min 23 Sept 2026 How the network layer of the homelab works: two uplinks with metric failover, two bridges instead of VLANs, dnsmasq for guest DHCP and DNS, nftables rules that isolate the lab, Tailscale for my own access, and a locked account for the AI assistant. Reverse Shells on Android notes 2 min 21 Sept 2026 Reverse shells on Android: mksh has no /dev/tcp, toybox nc has no -e, so sh is piped between two nc connections, with 10.0.2.2 as the emulator's alias for the host. MHL Cyclic Scanner Lab Writeup notes 5 min 21 Sept 2026 Solving the Mobile Hacking Lab Cyclic Scanner challenge: a foreground service that walks shared storage every six seconds, a sha1sum command built by string concatenation into sh -c, the file name as the injection vector, and an adb quoting mistake that runs the payload as root before the app ever sees it. MHL Strings Lab Writeup notes 5 min 20 Sept 2026 Solving the Mobile Hacking Lab Strings challenge: an exported deep-link activity, a date-stamped preference that no code path writes, AES parameters pulled out of the dex string pool, and a native function that returns a decoy while the flag stays in RAM. Unpacking and Rebuilding with apktool notes 6 min 19 Sept 2026 apktool for Android: decoding an APK into a readable manifest, resources, and smali, patching what you find, rebuilding, signing, and getting the patched build installed. Decompiling with jadx notes 5 min 19 Sept 2026 jadx for Android: turning an APK's bytecode back into readable Java from the CLI and the GUI, searching the tree for secrets and weak crypto, what the error count means, and when to fall back to smali, native tools, or Frida. The OWASP MAS Project notes 2 min 19 Sept 2026 The OWASP Mobile Application Security (MAS) project: what MASVS, MASWE, MASTG, and the MAS Checklist each do, and the testing profiles that set the bar for an assessment. Static and Dynamic Analysis of Mobile Apps notes 3 min 18 Sept 2026 Static and dynamic analysis of mobile apps: what each one covers, where manual code review finds what scanners miss, and why web findings like CSRF and reflected XSS rarely apply to a mobile app. Android Debug Bridge (ADB) notes 4 min 15 Sept 2026 The command reference for adb: connecting, shells, file transfer, package management, starting components, logcat, dumpsys, and the port forwarding that every other tool depends on. Android Lab Setup notes 5 min 15 Sept 2026 Setting up the Android testing lab: Android Studio and the SDK, an emulator you can actually root, a writable system partition, and the physical-device path when the emulator will not do. Dynamic Instrumentation with Frida notes 5 min 15 Sept 2026 Frida for mobile app testing: how injection works, matching frida-server to the device, spawning and attaching, writing hooks to read and rewrite an app's behaviour at runtime, Objection for the common jobs, and Gadget when the device is not rooted. Intercepting Traffic with Burp Suite notes 9 min 15 Sept 2026 Getting a mobile app's HTTPS through Burp: route traffic to the proxy, make the app trust the CA, and defeat certificate pinning. The steps below are the Android procedure; iOS follows the same three-step shape. Automated Analysis with MobSF notes 3 min 15 Sept 2026 MobSF for Android: running it in Docker, the static-analysis report, driving the dynamic analyzer against a rooted VM, the REST API for CI, and where automated triage stops and manual work begins. OSCP – The Only Certificate I Knew as a Kid cert reviews 3 min 14 Sept 2026 How I prepared for the OSCP with 1.5 months of Proving Grounds boxes and no course content, how the exam day went, and whether it's worth OffSec's price. Android Foundations notes 12 min 14 Sept 2026 How Android is built from the kernel up, the security features that protect it, and the basics of Android apps: the sandbox, the manifest, components, IPC, signing, and publishing. Active Directory Concepts notes 12 min 01 Aug 2026 The terms the Active Directory workflow and its attack notes assume. AD Lateral Movement notes 5 min 01 Aug 2026 Lateral movement reuses a credential (password or NT hash) to run code on another host, no cracking needed. AutoRecon notes 1 min 18 Jul 2026 AutoRecon runs port scans and starts additional enumeration based on the services it finds. Brute Forcing Logins notes 6 min 04 Aug 2026 Online guessing against a live service: many passwords against one account, until the service answers differently. BloodHound notes 4 min 01 Aug 2026 BloodHound ingests AD data and renders it as a graph of objects and the control relationships between them, then answers attack-path questions like 'shortest path to Domain Admin' directly. Chisel notes 3 min 10 Aug 2026 Chisel is a single Go binary that acts as both client and server, tunneling TCP over one outbound connection the client makes to the server. Cron Jobs notes 9 min 18 Jul 2026 Scheduled jobs run on a timer, often as root. evil-winrm notes 1 min 13 Sept 2026 Interactive PowerShell over WinRM, run from Kali. ExifTool DjVu Injection notes 2 min 25 Jul 2026 ExifTool parses the annotation chunk of a DjVu file and passes its contents through a Perl `eval`, so metadata inside the file becomes code. File Inclusion notes 6 min 21 Jul 2026 A file inclusion bug is a script that builds an `include`/`require` path from user input. File Transfers notes 5 min 22 Jul 2026 Getting tools onto a target after a foothold, and pulling loot back off it. Fixing Public Exploits notes 14 min 22 Jul 2026 Exploits from searchsploit or GitHub rarely run as-is. File Upload notes 6 min 03 Aug 2026 An upload form is a write primitive into the target's filesystem. FTP Enumeration notes 5 min 21 Jul 2026 FTP on 21 is worth three checks: the version banner for a known exploit, anonymous access for readable or writable files, and whether an upload directory doubles as a web root. git-dumper notes 2 min 24 Jul 2026 Rebuilds a git repository from an exposed `.git/` directory over HTTP. Kerberoasting notes 2 min 01 Aug 2026 Kerberoasting targets accounts that have a Service Principal Name (SPN). Kernel Exploits notes 5 min 19 Jul 2026 When the cheaper privilege-escalation vectors (`sudo -l`, SUID, cron, credentials at rest) are exhausted, an old kernel is the fallback. Ligolo-ng notes 8 min 01 Aug 2026 Ligolo-ng creates a TUN-based path through a compromised host. LinEnum notes 1 min 19 Jul 2026 LinEnum is a classic bash privilege-escalation enumeration script. LinPEAS notes 1 min 18 Jul 2026 LinPEAS enumerates a Linux host for privilege escalation vectors and highlights the most promising findings by likelihood. Linux Capabilities notes 3 min 22 Jul 2026 Capabilities split root's power into fine-grained units that can be granted to a single binary. linux-exploit-suggester notes 2 min 05 Aug 2026 `les.sh` maps a kernel version to public local privilege escalation exploits and ranks them. Linux Groups notes 3 min 25 Jul 2026 A supplementary group is an access-control grant that nothing in the user's own home reflects. linux-smart-enumeration notes 1 min 19 Jul 2026 `lse.sh` (linux-smart-enumeration) enumerates a Linux host for privilege-escalation vectors, like [LinPEAS](/collections/oscp/linpeas) but quieter and ranked by verbosity level. Metasploit notes 1 min 08 Sept 2026 The msfconsole workflow: find the module, set the addresses, run it. Mimikatz notes 3 min 01 Aug 2026 Mimikatz extracts secrets from a live Windows host: plaintext passwords, NT hashes, and Kerberos tickets held in memory by LSASS, plus the local SAM and LSA secrets. MySQL Privilege Escalation notes 5 min 18 Jul 2026 A MySQL account with high privileges is a path to the operating system. NTDS.dit Extraction notes 2 min 29 Aug 2026 Offline route to every hash in the domain: copy `ntds.dit` off a running DC and decrypt it on Kali. Password Spraying notes 4 min 01 Aug 2026 Spraying is the inverse of [Brute Forcing Logins](/collections/oscp/brute-forcing-logins): one password tried across many accounts, instead of many passwords against one account. PrivescCheck PowerUp SharpUp notes 2 min 29 Aug 2026 Three Windows privilege escalation enumerators that sit between [winPEAS](/collections/oscp/winpeas) and manual triage. pspy notes 2 min 25 Jul 2026 pspy watches process creation and scheduled jobs on a Linux host without root. Restricted Shells notes 2 min 13 Aug 2026 `rbash` (restricted bash, either the account's login shell or plain bash invoked with `argv[0]` starting with `r`) blocks a fixed set of things for the life of the session: `cd`, changing `PATH`, `SHELL`, `ENV`, or `BASH_ENV`, running any command whose name contains a `/` (so no absolute paths and no `./binary`), `exec`, and output redirection (`>`, `>>`, `<>`, `>&`, `&>`). Reverse Shells notes 15 min 18 Jul 2026 A reverse shell makes the target connect back to a listener on the attacker. Rubeus notes 1 min 01 Aug 2026 Rubeus is the Windows-side Kerberos toolkit: it requests and abuses tickets from a domain-joined host, which is where the OSCP assumed breach starts (RDP as the foothold user). Server-Side Template Injection notes 1 min 08 Sept 2026 Server-side template injection (SSTI) is when input reaches a template engine as template code instead of as data. Sudo notes 14 min 19 Jul 2026 `sudo` runs a program with another user's privileges, root by default. Virtual Hosts notes 1 min 19 Jul 2026 One IP can serve many sites. Windows Token Privileges notes 11 min 22 Jul 2026 Windows assigns privileges to users and groups. winPEAS notes 1 min 22 Jul 2026 winPEAS enumerates a Windows host for privilege escalation vectors and highlights the most promising findings. ImageMagick notes 4 min 07 Aug 2026 ImageMagick picks a coder from a file's contents, not its extension, and it shells out in more places than decoding pixels. Webshells notes 5 min 18 Jul 2026 A webshell is a small script left on a web server that runs commands sent through web requests. Windows Service Exploits notes 5 min 22 Jul 2026 Windows services run in the background, often as SYSTEM. DNS Enumeration notes 1 min 24 Jul 2026 DNS resolves names to addresses and stores other records describing a domain. RPC Enumeration notes 1 min 24 Jul 2026 RPC lets a client call functions on another machine. accesschk notes 1 min 22 Jul 2026 accesschk (Sysinternals) reports the effective access a user or group has to services, files, directories, and registry keys. feroxbuster notes 1 min 13 Sept 2026 Rust directory brute forcer whose distinguishing feature is recursion: hits on found directories are themselves enumerated by default. ffuf notes 1 min 13 Sept 2026 Web fuzzer built around a replaceable `FUZZ` keyword and response filtering. hashcat notes 1 min 13 Sept 2026 Password cracker built for GPUs: each hash format needs an explicit mode number, and the right `-m` comes from the format table in [Password Cracking](/collections/oscp/password-cracking). john notes 1 min 13 Sept 2026 Password cracker for offline cracking from Kali: CPU-based, auto-detects hash formats, and needs no GPU or OpenCL backend, which makes it the default for a single hash on the Kali VM. nc notes 1 min 13 Sept 2026 Netcat, the default listener and raw TCP tool on Kali. Password Cracking notes 4 min 22 Jul 2026 Offline recovery of a password from a captured artifact: a protected file, an encrypted key, or a hash. powercat notes 1 min 29 Aug 2026 Netcat written in PowerShell. tmux notes 3 min 24 Jul 2026 Terminal multiplexer for the working environment. Web Content Discovery notes 9 min 18 Jul 2026 Web servers rarely link to everything they host. Windows Remote Access notes 3 min 24 Jul 2026 RDP and WinRM usually become useful after credentials surface. Base64 and Encodings notes 1 min 18 Jul 2026 Encoded data shows up constantly: in files left on web servers, in config values, in tokens. Linux Permissions notes 4 min 19 Jul 2026 Every Linux privilege escalation is an access-control violation, and access control in Linux is built on permissions. Network Services Handbook notes 3 min 24 Jul 2026 Port numbers suggest what may be running, but the banner and protocol response decide what the service actually is. Privilege Escalation (Windows) notes 4 min 22 Jul 2026 Goal: turn a low-privilege shell into one running as Administrator or SYSTEM. Active Directory notes 3 min 01 Aug 2026 Active Directory (AD) is both a directory of an organisation's users, groups, and computers, and the management layer that controls them. Privilege Escalation (Linux) notes 4 min 18 Jul 2026 Goal: turn a low-privilege shell into root. Tunneling and Pivoting notes 7 min 01 Aug 2026 Pivoting uses a compromised host as a path into a network the attacker machine has no route to. Homelab v2.0 – The Useful One journal 3 min 12 Sept 2026 After the governed cluster came the hard reset, and Gitea, K3s, and pfSense went away rm -rf style. What rose from the empty Proxmox is the version I actually use, plus the verdict on the whole hobby. Information Gathering notes 6 min 18 Jul 2026 Start automation and manual enumeration together. Active Directory Enumeration notes 10 min 01 Aug 2026 Enumeration is most of the work in an AD assessment. Burp Suite notes 2 min 22 Jul 2026 Intercepting proxy for web testing. Credential Hunting notes 8 min 19 Jul 2026 A password reused by root is one of the cheapest escalations there is. Database Enumeration notes 11 min 21 Jul 2026 Credentials pulled from an app config (`db.php`, `wp-config.php`, `configuration.php`, `.env`) open the database behind the app. icacls notes 2 min 25 Aug 2026 Built-in Windows tool that prints and changes NTFS permissions on files and folders. Impacket notes 3 min 25 Aug 2026 Python collection for AD network protocols: SMB, WMI, Kerberos, LDAP, DRSUAPI, MSSQL. LAPS notes 2 min 03 Aug 2026 LAPS (Local Administrator Password Solution) exists because every machine deployed from one image shares one local Administrator password, so a single dumped hash pass-the-hashes across the whole estate. msfvenom notes 3 min 03 Aug 2026 Metasploit's payload generator, usable entirely on its own. NetExec notes 4 min 01 Aug 2026 NetExec is the maintained successor to CrackMapExec (CME), which was abandoned in 2023; the community forked it and renamed the binary `nxc`. SMTP Enumeration notes 3 min 22 Jul 2026 SMTP on 25 is a mail server, and the useful checks are three: read the banner for the daemon and version, ask the server which users exist with `VRFY`/`EXPN`, and test whether it will relay mail. SNMP Enumeration notes 3 min 22 Jul 2026 SNMP is a management protocol that answers queries about a host: users, running processes, installed software, network interfaces, and listening ports. SQL Injection notes 6 min 18 Jul 2026 SQL injection (SQLi) happens when user input is placed into a database query without being kept separate from the query's code. SUID Binaries notes 12 min 18 Jul 2026 A SUID (SetUID) binary runs with the effective UID of its owner, not the user who launched it. ACL Abuse notes 2 min 01 Aug 2026 Every AD object carries a DACL that lists who can do what to it. AS-REP Roasting notes 1 min 01 Aug 2026 AS-REP roasting targets accounts that have Kerberos pre-authentication disabled (`DONT_REQ_PREAUTH`). Command Injection notes 4 min 18 Jul 2026 Command injection (OS command injection) is when user input is passed into a system shell, so the input can append its own OS commands. Kerberos Delegation notes 2 min 01 Aug 2026 Delegation lets a service act on behalf of a user to reach a second service (the Kerberos "double hop"). LibreOffice Macros notes 4 min 29 Aug 2026 An ODT is a ZIP container that can carry a Basic macro library, and LibreOffice runs document macros on events such as the document being opened. LLMNR Poisoning and NTLM Relay notes 3 min 01 Aug 2026 When a Windows host cannot resolve a name over DNS, it falls back to broadcast name resolution (LLMNR, NBT-NS, mDNS) and asks the whole local segment "who is X?". pyGPOAbuse notes 3 min 25 Aug 2026 Partial Python port of SharpGPOAbuse. Silver and Golden Tickets notes 3 min 01 Aug 2026 Forged Kerberos tickets, built offline from a stolen key and injected without the DC ever issuing them. SSH Tunnels notes 2 min 08 Sept 2026 SSH port forwarding carries TCP through an SSH connection, so a port on one end answers on the other. Text4Shell notes 1 min 08 Sept 2026 Apache Commons Text 1.5 through 1.9 (CVE-2022-42889, fixed in 1.10) expands `${prefix:name...}` lookups in any string passed through its default StringSubstitutor, and the `script` lookup hands the expression to the JVM's JavaScript engine, so `${script:javascript:...}` runs arbitrary Java. Windows Autoruns and Scheduled Tasks notes 2 min 22 Jul 2026 A group of misconfigurations that all end the same way: place or modify something a privileged trigger later executes. Windows Credential Hunting notes 5 min 22 Jul 2026 Windows stores passwords in several places, some of them insecurely, and admins reuse them. WPScan notes 2 min 18 Jul 2026 WPScan enumerates WordPress sites for users, plugins, themes, and known vulnerabilities. AD Persistence notes 1 min 01 Aug 2026 Persistence keeps access to a domain after full compromise. DCSync notes 1 min 01 Aug 2026 DCSync abuses the directory replication protocol (MS-DRSR / DRSUAPI). kerbrute notes 1 min 01 Aug 2026 Kerbrute abuses Kerberos pre-authentication to test usernames and passwords against a DC quickly. SearchSploit notes 1 min 18 Jul 2026 SearchSploit searches the local Exploit-DB copy included with Kali. SMB Enumeration notes 3 min 21 Jul 2026 SMB on 139/445 exposes file shares and host information, often without credentials. Service Exploits notes 2 min 19 Jul 2026 A service is a program running in the background, accepting input or doing periodic work. Mass Assignment notes 2 min 07 Aug 2026 A mass assignment bug is a controller that binds a whole request hash onto a model in one call, so every column becomes settable from the request, including ones the form never showed. SSH Key Access notes 7 min 24 Jul 2026 Planting an SSH public key is often faster and more stable than a reverse shell, and it is the only option when a server is publickey-only. WebDAV notes 5 min 03 Aug 2026 WebDAV (RFC 4918) extends HTTP with verbs that turn a web server into a writable filesystem: `PROPFIND` to list, `MKCOL` to create a directory, and `PUT`, `DELETE`, `COPY`, `MOVE`, `LOCK` to manage files. Weak File Permissions notes 2 min 19 Jul 2026 Sensitive system files are protected by their permissions, not by secrecy. NFS no_root_squash notes 1 min 19 Jul 2026 NFS shares are exported from `/etc/exports`. Docker Cheat Sheet notes 1 min 27 May 2026 The Docker commands I keep looking up: running containers, building images, networks, volumes, Compose, and cleanup. Docker Foundations notes 6 min 27 May 2026 What a container is and isn't, why images are layered, and how the Dockerfile, networking, volumes, and registries fit together. Linux Cheat Sheet notes 1 min 27 May 2026 The Linux commands I keep looking up day to day: navigation, search, processes, services, and packages. SSH Foundations notes 8 min 27 May 2026 How the handshake works, host keys, public-key authentication, the agent, port forwarding, and why permissions matter. SSH Cheat Sheet notes 1 min 27 May 2026 The SSH commands I keep looking up: key generation and copying, port forwarding, file transfer, jump hosts, and sshd hardening. Homelab v1.4 – The Governance Wall: eBPF, Tunnels, and the Base64 Trap journal 3 min 14 Jan 2025 Namespaces, resource quotas, Sealed Secrets, and finally exposing the cluster to the internet through a Cloudflare Tunnel, along with a 502 that was actually a win because it meant the packets got all the way through. Homelab v1.5 – Real Governance: OIDC, Sealed Secrets, and the App-of-Apps Meltdown journal 4 min 14 Jan 2025 Single Sign-On with Gitea, Sealed Secrets for real, a Kyverno policy that broke the cluster I was trying to protect, and an App-of-Apps refactor that ended with me deleting the Cloudflare tunnel to force a sync (don't ask). Homelab v1.3 – The Silent Killers: DNS, Firewalls, and the Unbound Crash journal 5 min 09 Jan 2025 Four hours of debugging silent failures. A crashed DNS resolver, a CNI power struggle between Flannel and Cilium, an IPAM overlap that hijacked my LAN, and a hairpin loop I "fixed" by building a BGP highway before I realized I was fixing the wrong thing. Homelab v1.0 – From Server to Data Center (Homelab_v4.1_UltraOptimized(3).md) journal 3 min 31 Dec 2024 Throwing away the "simple Ubuntu server" plan and committing to a full K3s cluster with Proxmox, Longhorn, 3-2-1 backups, and four production-grade namespaces. Also known as "over-engineering for the vibes." Homelab v1.1 – The Great Wall of Fire: pfSense & Network Isolation journal 3 min 31 Dec 2024 Isolating the lab network from the home network with pfSense. Default-deny rules, aliases, and the anti-lockout trap that stumped me until I remembered DNS lives on the gateway. Homelab v1.2 – The Supply Chain: Golden Images & The Source of Truth journal 1 min 31 Dec 2024 Solving the bootstrap paradox with Cloud-Init templates, a self-hosted Gitea server outside the cluster, and why SQLite wasn't going to cut it when I'm hoarding 32GB of RAM. eWPTXv3 cert reviews 3 min 15 Sept 2024 I took the eWPTXv3 the day after passing the eCPPT, still tired, and finished it in 9 hours. It wore the eXtreme label but felt like a victory lap. eCPPTv3 cert reviews 3 min 14 Sept 2024 I skipped the INE material, prepared with the HTB CPTS path instead, and finished the 24-hour exam half-conscious. Notes on how it went and where it stands next to the OSCP and CPTS. Linux Foundations notes 5 min 04 Jan 2024 Components, distributions, the filesystem hierarchy, the shell, paths, redirection, and the permissions system.nothing matches that filter.