Archives

2026

2023

2022

2021

  • Cyber Corp Case 2 Writeup - Part 3

    • Threat Hunting

    CyberCorp Case 2 part 3 — certutil download, LSASS dumping, WMI lateral movement to a domain controller, and tracking the second reverse shell C2 address.

  • Cyber Corp Case 2 Writeup - Part 2

    • Threat Hunting

    CyberCorp Case 2 part 2 — decoding a base64 gzipped registry payload, tracing PID spoofing in PowerShell, and identifying the reverse shell C2 IP.

  • Cyber Corp Case 2 Writeup - Part 1

    • Threat Hunting

    CyberCorp Case 2 threat hunting walkthrough — tracking WMI persistence, a malicious Word document, and a hidden iexproxy.dll download technique in Kibana.

  • New Tool Preview: vATT&CK

    • Tools

    vATT&CK is a visual relationship mapper for MITRE ATT&CK that shows linked malware, threat groups, mitigations, and subtechniques in a single interactive graph.

  • IOLI Crackme 0x04

    • Reverse Engineering

    IOLI Crackme 0x04 walkthrough — the password is any digits that sum to 15, revealed by tracing sscanf-based accumulation through static analysis in IDA.

  • Building my Virtual Cybersecurity Home Lab

    • Malware Analysis

    How I built a virtual cybersecurity home lab with pfSense, Metasploitable, Kali, Splunk, Snort, and a dedicated malware analysis network using Remnux.

  • Making a RAT

    • Malware Analysis

    Building RATwurst, a RAT in C and Python, with runtime DLL loading, socket comms, anti-sandbox checks, and basic AV evasion — for educational purposes only.

  • Finding phished passwords on a scam site

    • Security

    How I found a publicly accessible victims.txt file storing phished Facebook credentials on a 000webhost server and what happened when I reported it.

  • Emprisa Maldoc Writeup

    • CTF

    Writeup for the Emprisa Maldoc CTF — analyzing a CVE-2017-18822 exploit using rtfdump, speakeasy shellcode emulation, and EQNEDT32 process debugging.

  • Investigating an FB phishing site

    • Security

    OSINT into a Facebook phishing campaign spreading via friend-tagging — separate hosting domains, Vietnamese code traces, and possible Phishing-as-a-Service.

  • The Emprisa Maldoc Challenge

    • CTF

    How I turned a real-world malicious document exploit into the Emprisa Maldoc CTF on CyberDefenders — 14 questions targeting intermediate maldoc analysts.

  • IOLI Crackme 0x03

    • Reverse Engineering

    IOLI Crackme 0x03 walkthrough — reverse engineering a Caesar-style cipher that shifts each character by 3 to decode garbled success and failure strings.

  • Maldoc101 Writeup (Part 2)

    • Malware Analysis

    Continuing the Maldoc101 malware analysis — decoding obfuscated VBA string concatenation to reveal WMI class references used for process execution.

  • Maldoc101 Writeup (Part 1)

    • Malware Analysis

    Step-by-step maldoc analysis of the Maldoc101 challenge using oledump and olevba — deobfuscating VBA macros and tracing the WMI process execution chain.

  • IOLI Crackme 0x02

    • Reverse Engineering

    IOLI Crackme 0x02 walkthrough — computing the password via static analysis of x86 arithmetic, then confirming with dynamic analysis by stepping through IDA.

  • Introducing shcode2exe

    • Tools

    shcode2exe converts raw shellcode blobs or strings into debuggable executables targeting 32 or 64-bit Windows, with no Wine dependency when running on Linux.

  • IOLI Crackme 0x01

    • Reverse Engineering

    IOLI Crackme 0x01 walkthrough — converting hex to decimal to find the password, plus a closer look at how arguments are passed to functions in x86 assembly.

  • IOLI Crackme 0x00

    • Reverse Engineering

    IOLI Crackme 0x00 walkthrough — finding the hardcoded password in IDA Pro and patching the binary to accept any input by changing a jz opcode to jmp.

2020

2018

2017