every command from the reels, explained: what it does, why it matters, and the fix. no fluff, no gatekeeping.
First, look for SUID binaries, programs that always run as their owner, no matter who launches them. Here, find is SUID root, which is a mistake.
whoamievery reel, broken down: the command, the plain-english explanation, and how to defend. dual-use tools get the concept and the defense, never a download.
gives the exact steps to set up a fast, themed, syntax highlighted terminal with zsh and starshi
You emptied the recycle bin.
concept + defenseEvery password you save in Chrome can be dumped in plaintext with one command, on your own machi
You think you know what's connected to your home wifi.
You browse in incognito thinking it's private.
Lose an encrypted USB stick, and a thief gets absolutely nothing.
Give a stranger one photo, and even with no GPS data, they can often find your neighborhood.
runs a dns server that refuses to resolve ad and tracker domains so they never load on any devic
That box your internet provider gave you?
Don't throw out that old laptop in your drawer.
This login page looks real.
shows how to run vaultwarden in docker so your password vault lives on your own hardware instead
Your laptop keeps a list of every wifi network it has ever joined, the coffee shop, the airport,
There's a good chance your password is already for sale online.
concept + defenseYour computer remembers every wifi password you've ever typed, in plaintext, one command away.
Every photo you post might be telling strangers exactly where you live.
Your smart TV is sending data out constantly, even when you're not watching.
chains sha256sum, mmls, fls, icat, exiftool, volatility, and strings to start a disk and memory
shows how to statically analyze an office macro to reveal an autoopen downloader and decode its
parses the windows amcache hive with amcacheparser to recover the name, hash, and first-seen tim
uses autoruns to list every persistence point on a system then filters out microsoft signed entr
shows how to use fls and mactime to turn disk artifacts into a readable, court grade incident ti
shows how capa statically analyzes a suspicious binary and maps its capabilities to mitre attack
it explains how to spot data theft through large outbound transfers, dns tunneling, and cloud up
shows how to hunt every linux cron location, including per user crontabs and dot file jobs, for
it shows how the master file table keeps deleted file records and timestamp mismatches that reve
it shows how attackers hide stolen data in dns txt queries and how to spot the abnormal volume o
this uses volatility's malfind to spot injected code in a memory dump by flagging private, writa
it explains how event ids for failed logons, process creation, new accounts, and cleared logs re
checks live connections, recent logins, and attacker traffic first so you understand the intrusi
covers the windows and linux spots attackers plant persistence and how comparing to a known good
shows how attackers hide persistence in systemd services and how to spot and inspect a malicious
it parses windows jump list files to tie a program to the exact files, shares, and usb drives it
walks through checking linux auth logs for failed then successful logins, new users, sudo abuse,
it walks through checking processes, sockets, deleted binaries, logins, and persistence on a liv
uses volatility 3 modules like pslist, netscan, malfind, and cmdline to find hidden processes, c
shows how osquery finds processes running from deleted binaries, a classic self delete trick, ac
it explains how to trace received headers, check spf dkim dmarc, and safely detonate urls and at
reads the psreadline history file to reveal every powershell command a user typed, including dow
this shows how parsing a windows prefetch file reveals run count, last run time, and the folder
it explains why you should isolate the host, find patient zero, and capture memory before reboot
shows checking email headers, spf, dkim, dmarc, and domain age to spot a spoofed phishing email.
explains how browser history, cache, cookies and sqlite files can be used to reconstruct a user'
parses windows shellbags to show folder paths and timestamps that survive even after the drive o
it explains how shimcache records paths and timestamps of executables windows has seen, which is
shows how to find a planted suid root binary by listing suid files newer than the original syste
it parses the srum database to reveal which process sent the most bytes without needing a packet
parses the ntfs usn journal to reveal file creations, renames, and deletions an attacker tried t
uses tshark to spot top talkers, dga beacons, suspicious user agents, and stream contents inside
shows how usbstor, setupapi.dev.log, and portable devices registry keys corroborate that a speci
it walks through hashing, string extraction, and file type checks before ever detonating a suspi
queries the userassist registry key to reveal every gui launched program with its run count and
queries endpoints like a database and dispatches a hunt to scope an entire breach across all mac
Windows keeps a running list of the files you've recently opened, sorted by type, in a registry
lists key windows registry locations like run keys, usbstor, shimcache and recentdocs used to re
shows how reading linux login success and failure logs together can reveal a brute force attack
explains how to write a yara rule with strings and conditions to scan a file or directory for kn
macOS keeps a unified log of almost everything that happens on your machine, including every sin
runs a recon sequence with nmap, whatweb and searchsploit to map live hosts, services and known
shows how trusting a jwt's own header let an attacker forge admin rights, and how pinning the al
shows how unparameterized queries allow sql injection and how parameterized queries fix it.
shows how arp has no authentication so an attacker can spoof both sides of a connection to inter
collects active directory users, groups, and permissions to reveal attack paths to domain admins
sets up an isolated virtualbox lab with kali linux and a vulnerable target so you can practice a
it shows how to use burp's proxy, repeater, intruder, and scanner to find logic flaws and inject
demonstrates mask and hybrid hashcat attacks that target predictable human password patterns ins
shows how a domain admin credential lets an attacker pull every hash including krbtgt from a dom
uses nmap, enum4linux, gobuster, and nikto to enumerate a target and reveal the foothold before
shows using evil-winrm with valid windows credentials to get an interactive shell over winrm.
it demonstrates how a publicly reachable .env file leaks credentials and how to verify and lock
shows how an exposed git folder on a web server lets anyone rebuild the full source and commit h
shows using ffuf to discover hidden directories, backup folders, and apis on a target site.
this shows how a misconfigured sudo permission on a normal binary like tar can be abused to spaw
walks through monitor mode, handshake capture, and offline wordlist attacks to show why a long r
shows how insecure direct object references leak data and how scoping the query to the logged in
One forgotten open port is often the whole game.
Watch a normal user become root.
requests a kerberos service ticket for a service account and cracks the hash offline to potentia
uses kerbrute to enumerate valid active directory accounts and spray passwords without tripping
recommends seclists, cewl, and crunch as better password wordlist sources than relying on rockyo
this runs linpeas to color-code privilege escalation paths and shows using a flagged sudo rule t
it walks through checking sudo rights, suid binaries, and writable cron jobs to escalate from a
shows how sending an extra role field the form never had let an attacker escalate to admin throu
this breaks down nmap's syn, connect, udp, version, and script scan modes and when to use each.
it demonstrates how unescaped user input causes xss and how templating plus a content security p
it compares hydra, hashcat, john, and password spraying to explain when each password attack tec
explains the difference between passive recon tools like whois, dns, and theharvester versus act
shows how an unsanitized file path lets an attacker read arbitrary files and how resolving and c
explains using ssh dynamic tunnels, proxychains, and chisel or ligolo to pivot tools like nmap a
shows how pspy watches running processes without root to reveal a writable root cron job you can
shows how responder answers LLMNR/NBT-NS broadcasts to capture an NTLMv2 hash that can then be c
it explains why a reverse shell that makes the victim connect outbound gets past firewalls that
Password strength isn't a vibe, it's math: the character set raised to the length.
breaks down three classic web vulnerabilities that all stem from trusting unvalidated user input
shows how an unrestricted url fetch lets an attacker steal aws credentials from cloud metadata a
this shows using certipy to find and abuse a vulnerable ad cs template, esc1, to request a certi
this walks through picking a metasploit module, setting a payload, and catching a reverse shell
this walks through how bloodhound mapping plus kerberoasting a weak service account leads to ful
it walks through the recon, escalate, persist, pivot, loot cycle attackers use after gaining ini
shows how trusting a filename and extension during file upload let an attacker run commands as w
concept + defenseThis is how a wifi password actually gets cracked.
it explains how subdomains, breach databases, employee names, and document metadata give attacke
shows wifite automatically scanning, capturing, and cracking wifi networks in one command.
shows using winPEAS to find windows misconfigurations like unquoted service paths to escalate to
sets up a fake service with opencanary on an unused port so attackers reveal themselves with zer
it confines a linux program to only the files and capabilities it needs so an exploit can't spre
sets up linux auditd rules to watch sensitive files and log command execution before an incident
it shows how a simple caddyfile config automatically fetches and renews a let's encrypt cert whi
it shows how dnstwist finds registered lookalike domains of your own so you can spot phishing se
installs crowdsec with a firewall bouncer to read logs, detect attacks, and share bans across th
sets up a default deny nftables policy that only allows established sessions, loopback, ssh, and
this shows why docker's own iptables rules bypass ufw and how to fix it with the ufw-docker help
it walks through configuring ban time, retry limits, and whitelists so fail2ban blocks brute for
lists five postgresql configuration changes, like binding to localhost and enforcing scram auth,
lists five nginx configuration changes, like enforcing modern tls and hiding server tokens, to h
it lists automatic patching, a default deny firewall, audit logging, and fail2ban as a basic lin
this walks through issuing a free certbot certificate, auto renewal, forcing https, hsts, and te
this covers running containers as a non-root user, dropping capabilities, read-only filesystems,
walks through moving ssh off port 22, rate limiting, kernel sysctl hardening, crowdsec bans, and
runs lynis to audit a linux system and produce a hardening index with a ranked to-do list of fix
it explains how describing an attacker technique once in sigma and converting it to your siem's
puts nginx in front of apps to terminate tls, load balance, filter attacks with a waf, and add s
A firewall sounds like a fortress.
it shows how rkhunter baselines clean binaries and then flags hidden directories or modified sys
describes limiting automatic updates to security patches only, excluding fragile packages, kerne
Can a stranger send email that looks like it came from your domain?
One curl grades your website's security posture.
signs a short lived ssh certificate so servers trust one CA instead of scattered keys.
it shows how logging process creation with sysmon and writing vendor neutral sigma rules lets on
shows a small set of kernel parameters that block syn floods, icmp redirect mitm, and expose les
lists the checklist for building a hardened bastion host with keys only, proxyjump, session logg
this uses log grepping and shodan data to show how many bots hit exposed ssh servers and why key
this lays out five sshd config lines, keys only, no root login, allowed users, that stop brute f
explains how spf, dkim and dmarc records together stop attackers from spoofing your domain in em
explains splitting users, servers, iot, and guests into separate vlans with acl controlled routi
this explains how to check what is listening on ipv6 and mirror your ipv4 firewall policy with i
configures radius, aaa, and dot1x on a cisco switch so ise enforces identity on each port with m
walks through the 802.1x nac flow where the switch just enforces while ise makes the actual acce
explains how cisco asa interface trust levels from 0 to 100 decide which traffic flows freely an
breaks down asa interface configuration with nameif, security level, ip, nat, and a default rout
compares asa's classic vpn focused firewall os to ftd's snort 3 based ngfw and explains why new
shows how mismatched native vlans between trunk ends leak untagged frames and open vlan hopping
walks through configuring ssh on a cisco device with rsa keys, local users, and vty restrictions
it shows how zones, class maps, and policy maps let ios routers statefully inspect and filter tr
walks through configuring an external bgp neighbor and confirming the session is up by checking
bundles multiple switch links into one port channel using lacp for more bandwidth and failover r
walks through interface status, vlan membership, mac table, trunk allowed vlans, and routing to
explains how hsrp lets two routers share a virtual gateway ip so hosts never notice a router fai
explains how hsrp priority, preempt, and interface tracking let a standby router silently take o
walks through building an ikev2 lan to lan vpn on cisco asa with strong crypto instead of legacy
this covers how per-vlan svis let a layer 3 switch route between subnets in hardware, replacing
explains how IOS-XE modernizes Cisco devices with isolated Linux processes, install versus bundl
Your guest wifi is only isolated if it's actually configured to be.
walks through configuring port security, dhcp snooping, and dynamic arp inspection to stop layer
shows how port security, dhcp snooping, and dynamic arp inspection lock down layer 2 switchports
shows how a layer 3 switch uses svis and ip routing to route between vlans at line rate instead
it configures a switch port to learn one sticky mac address and shut down if any other device co
it shows how pat maps an entire private network onto one public ip using port numbers.
configures nat overload so many private lan addresses share one public ip via port multiplexing
it explains how ospf uses area 0 as the backbone and abrs to summarize routes so big networks co
sets up ospf with a router id, area assignments, passive interfaces, and checks neighbor state t
configures an asa to use ise for radius authentication with change of authorization and shows te
configures ssh access on a router and disables telnet so router management traffic is encrypted
DNS is a phonebook that turns names into addresses.
HTTPS feels like magic, but you can watch the whole thing.
Every name lookup on the internet ultimately starts in one place: the DNS root.
Every network device has a MAC address, and the first half of it isn't random, it's the OUI, a r
it explains how IKE phase 1 and phase 2 with ESP link two private LANs over the internet as one
shows how tailscale authenticates in the browser and builds a private wireguard mesh with peer t
this lists six ios config steps, real credentials, ssh only, aaa, login throttling, and encrypte
explains how a firewall separates internet, dmz, and inside zones so a compromised public server
it lists the CCNA level starting configuration for a switch including hostname, vlans, trunking,
this explains how a switch with a higher vtp revision number can silently overwrite everyone's v
it shows how portfast, bpduguard, and root guard close off common layer 2 attack paths on switch
explains how dhcp snooping and dynamic arp inspection stop rogue dhcp servers and arp spoofing o
reveals that most browsers have quietly switched to hybrid ml-kem post quantum encryption ahead
shows how access ports carry one untagged vlan while trunk ports carry many vlans tagged with 80
demonstrates how a vrf lets one physical router keep separate routing tables so segments can't r
walks through building a wireguard vpn tunnel from generating keys to confirming the handshake
Reach every device in your house from anywhere in the world, with no port forwarding and no stat
it lists enabling cloudtrail, blocking public s3, requiring mfa, using roles instead of long liv
explains how to scope aws cloudtrail data event logging to avoid huge per-event billing while ke
it shows using Steampipe to query aws resources like s3 buckets and iam with sql instead of the
A container is not a tiny virtual machine.
compares aws's three layered network controls, stateful security groups, stateless nacls, and vp
it lists how to spot ai written phishing by checking sender domains, hovering links, and verifyi
discusses how ai speeds up soc response times and reshapes the tier 1 analyst role and siem mark
uses an llm to rank subdomains, explain scanner output, and chain into tools like nmap for faste
this explains how voice cloning from seconds of audio enables fraud and why a verification code
shows a visual node editor for building and sharing stable diffusion pipelines that run locally
lists five baseline controls for locking down ai and llm powered applications.
recaps black hat and def con 2026, showing how an ai agent got hijacked through observability lo
explains how attackers hijack llm apps by slipping rogue instructions into user input to leak se
uses a local llm through ollama to summarize and flag suspicious log lines without the data leav
explains pointing ai automation at internal back office tasks like ticket summaries, pdf extract
shows how to run open source llms on your own hardware with ollama so sensitive data never leave
a single tool, explained in plain english, every week. straight to your inbox.