https://noob2root.com Offensive security field notes — CVE analysis, proof-of-concept write-ups and tooling. en https://noob2root.com/blog/purpleforest-part-1-building-the-lab https://noob2root.com/blog/purpleforest-part-1-building-the-lab Blog Stand up a Windows domain, a Graylog SIEM and Sysmon + Vector telemetry on one Windows host with VMware Workstation, Vagrant and Ansible. Fri, 25 Sep 2026 05:02:05 GMT https://noob2root.com/blog/purpleforest-ad-purple-team-lab https://noob2root.com/blog/purpleforest-ad-purple-team-lab Blog Most AD labs teach one half of the job. PurpleForest builds both: a Windows domain to attack, full telemetry through Vector, and Graylog to catch you. Run the attack, read the logs, write the rule, watch it fire, then evade it. Fri, 25 Sep 2026 05:00:00 GMT https://noob2root.com/blog/pihole-unbound-honeypot-grafana-telegram https://noob2root.com/blog/pihole-unbound-honeypot-grafana-telegram Blog Whole-house DNS filtering with Pi-hole + Unbound, an OpenCanary honeypot tripwire, a lightweight SIEM with Grafana + Loki + Alloy, real-time Telegram alerts, and a nightly AI summary from Hermes Agent. Every command included. Thu, 24 Sep 2026 04:05:40 GMT https://noob2root.com/blog/hermes-agent-raspberry-pi-openrouter-deepseek https://noob2root.com/blog/hermes-agent-raspberry-pi-openrouter-deepseek Blog Self-host Nous Research's Hermes Agent on a Raspberry Pi 4, talk to it from Telegram, and power it with DeepSeek through OpenRouter on a hard-capped budget. Mon, 21 Sep 2026 10:55:35 GMT https://noob2root.com/blog/soc-to-offensive-what-carried-over https://noob2root.com/blog/soc-to-offensive-what-carried-over Blog The first post on noob2root — where it all started. Wed, 16 Sep 2026 02:28:48 GMT https://noob2root.com/cve/cve-2024-3094-xz-backdoor https://noob2root.com/cve/cve-2024-3094-xz-backdoor CVE A multi-year social engineering campaign planted a backdoor in the xz release tarballs, hooking sshd via liblzma. Fri, 07 Aug 2026 12:10:40 GMT https://noob2root.com/cve/cve-2023-4966-citrixbleed https://noob2root.com/cve/cve-2023-4966-citrixbleed CVE An unauthenticated buffer over-read leaks session tokens from memory, allowing MFA to be bypassed by replaying a hijacked session. Wed, 29 Jul 2026 12:10:40 GMT https://noob2root.com/cve/cve-2022-22965-spring4shell https://noob2root.com/cve/cve-2022-22965-spring4shell CVE Data binding in Spring MVC on JDK 9+ could be abused to reach class-loader properties and write a web shell, giving remote code execution. Sat, 25 Jul 2026 22:46:39 GMT https://noob2root.com/cve/cve-2021-26855-proxylogon https://noob2root.com/cve/cve-2021-26855-proxylogon CVE An SSRF in Microsoft Exchange chained to arbitrary file write for unauthenticated RCE. Mass-exploited against on-prem Exchange worldwide. Tue, 21 Jul 2026 22:46:39 GMT https://noob2root.com/cve/cve-2019-0708-bluekeep https://noob2root.com/cve/cve-2019-0708-bluekeep CVE A use-after-free in Remote Desktop Services allowed unauthenticated, wormable remote code execution against a huge installed base of Windows hosts. Wed, 15 Jul 2026 22:46:39 GMT https://noob2root.com/cve/cve-2021-44228-log4shell https://noob2root.com/cve/cve-2021-44228-log4shell CVE User-controlled strings reaching a Log4j 2 logging call trigger a JNDI lookup, giving remote code execution. Mon, 13 Jul 2026 12:10:40 GMT https://noob2root.com/cve/cve-2017-0144-eternalblue https://noob2root.com/cve/cve-2017-0144-eternalblue CVE A flaw in Microsoft SMBv1 allowed remote code execution from a crafted packet. Weaponised by WannaCry and NotPetya into some of the costliest malware outbreaks on record. Thu, 09 Jul 2026 22:46:39 GMT https://noob2root.com/cve/cve-2014-6271-shellshock https://noob2root.com/cve/cve-2014-6271-shellshock CVE Bash evaluated trailing code in specially crafted environment variables, giving RCE through anything that passed attacker input into the environment — CGI especially. Sun, 05 Jul 2026 22:46:39 GMT https://noob2root.com/cve/cve-2014-0160-heartbleed https://noob2root.com/cve/cve-2014-0160-heartbleed CVE A missing bounds check in the OpenSSL TLS heartbeat extension let anyone read up to 64KB of server memory per request — including private keys. Fri, 03 Jul 2026 22:46:39 GMT