9 write-ups
Capture theflag
- 2026.05.17CTF writeupTJCTF 2026
Treasure Hunt
A flag split across four places, a hidden DOM element, a cookie and the site's images, and why the hidden attribute hides nothing from an attacker.
Web · Easy · 109 pts
- 2026.05.07CTF writeuppicoCTF 2026
Shared Secrets
Diffie-Hellman is only as strong as its private exponents. Once one leaks, the shared secret falls with it.
Cryptography · Easy
- 2026.05.07CTF writeuppicoCTF 2026
StegoRSA
An RSA private key hex-encoded into an image's metadata, and why hiding a key is not the same as protecting it.
Crypto · Steganography · Easy
- 2026.05.05CTF writeuppicoCTF 2025
Crack the Gate 1
A ROT13 developer comment points to a custom request header that walks straight past the login.
Web exploitation · Easy
54 room notes
TryHackMelearning paths
SOC Level 1
54 notes · 11 modules
- 2026.04.19Room notesCore SOC solutions
Introduction to SOAR
Orchestration, automation and response: how SOCs remove repetitive triage so enrichment is waiting before the analyst opens the ticket.
SOC solutions · Easy
- 2026.04.19Room notesCyber defence frameworks
The Pyramid of Pain
Ranking indicators by how much it costs an attacker when you detect them, from trivial hash changes to rebuilding TTPs.
Cyber defence frameworks · Easy
- 2026.04.19Room notesNetwork security
Snort: reading and writing detection rules
Snort's three modes, rule anatomy and why the syntax is unforgiving, the hardest room in the network security module.
Network security · Hard
- 2026.04.19Room notesBlue team introduction
Humans as Attack Vectors
Why people: not systems: are the most frequently exploited attack surface, how social engineering works, and what the SOC's role is in detecting and responding to human-targeted attacks.
SOC Fundamentals · Easy
Wazuh × Shuffle
Detection engineeringlab
- 2026.07.22Security researchDetection engineering
Detecting Linux privilege escalation with custom Wazuh rules
Three rules for sudo abuse the default ruleset doesn't cover, how each was tuned against false positives, tested against a real simulated attack, and mapped to ATT&CK.
Wazuh · MITRE ATT&CK
- 2026.07.22Security researchDetection engineering
Wazuh → Shuffle SOAR Automation
A Shuffle workflow that receives Wazuh alerts over a webhook, filters them by severity, and automatically sends an email notification for anything serious enough to warrant one: instead of relying on someone watching the Wazuh dashboard.
Wazuh · Shuffle SOAR
- 2026.07.20Security researchDetection engineering
Automating Wazuh Alert Notifications Using Shuffle SOAR
A hands-on SIEM and SOAR integration lab: Wazuh detects a real SSH attack, forwards the alert to Shuffle, and an automated email notification fires within seconds: no manual dashboard monitoring required.
Wazuh · Shuffle SOAR