Blog
Read
Long-form write-ups, the vulnerabilities that cost the industry most, and a live wire of what's landing today.
Write-ups
-
PurpleForest, Part 2: Kerberoasting a Domain That Fights Back
Every kerberoasting tutorial fails on a patched Server 2022 DC. Here is why, what actually works, and which of four detections survives the evasion.
purple-teamactive-directorykerberoastingdetection-engineeringsigmagraylogkerberoshashcatimpacket
-
PurpleForest, Part 1: Building an AD Purple-Team Lab from Zero
Stand up a Windows domain, a Graylog SIEM and Sysmon + Vector telemetry on one Windows host with VMware Workstation, Vagrant and Ansible.
purple-teamactive-directorydetection-engineeringgraylogvectorsysmonansiblevagranthomelab
-
PurpleForest: An Active Directory Lab That Fights Back
Most AD labs teach one half of the job. PurpleForest builds both: a Windows domain to attack, full telemetry through Vector, and Graylog to catch you. Run the attack, read the logs, write the rule, watch it fire, then evade it.
active-directorypurple-teamhomelabdetection-engineeringsiemgraylogvectorsigma
-
Pi-hole, Unbound, a Honeypot and Grafana: A Home Security Box on a Raspberry Pi
Whole-house DNS filtering with Pi-hole + Unbound, an OpenCanary honeypot tripwire, a lightweight SIEM with Grafana + Loki + Alloy, real-time Telegram alerts, and a nightly AI summary from Hermes Agent. Every command included.
raspberry-pipiholeunbounddnshoneypotopencanarygrafanalokisiemtelegramhomelabblue-team
-
Running Hermes Agent on a Raspberry Pi for Under US$10 a Month (OpenRouter + DeepSeek)
Self-host Nous Research's Hermes Agent on a Raspberry Pi 4, talk to it from Telegram, and power it with DeepSeek through OpenRouter on a hard-capped budget.
raspberry-piai-agentshermesopenrouterdeepseektelegramhomelab
-
What Three Years in a SOC Taught Me About Breaking In
The first post on noob2root — where it all started.
socred-teamcareer
Vulnerabilities that mattered
The bugs that reshaped the industry — what they were, why they worked, and what they cost — are taken apart one at a time in the CVE library.
9 write-upsField Guide
Every tool and idea the write-ups lean on, explained once: what it is, why I use it, what it costs you, and the gotchas I hit along the way.
22 entries