root@PandorasBox:~#
This post was written as part of my internship with SANS Internet Storm Center. Through November 20 and November 21, 2025, automated vulnerability scanning was identified against the DShield Honeypot from 192[.]159[.]99[.]95 with the goal of gaining remote code execution against potential victims. These probing and scanning activities stood out as interesting as some POST requests were observed…
This post was written as part of my internship with SANS Internet Storm Center. To stay in tune with current threats in the cybersecurity landscape, it’s important to periodically review the various threat actors attacking organizations. Having a good working relationship with your Cyber Threat Intelligence (CTI) team can certainly help educate you on the current landscape, but nothing quite beats…
We’re onto the next competition category in the CISA ICS CTF - This time we’re taking a look at a challenge in Driftveil City; Register the Dots. This CTF has some infrastructure setup for the players to use; Malcolm , Arkime , NetBox and CyberChef . We probably won’t be using any of these services, but I’m putting this disclaimer in there just in case so we’re all on the same page if you see me…
I’d like to think this forensics challenge is word play for RAM (Random Access Memory && Read Askew Manuscripts), with a little bit of hinting at future challenges to come. This was a great one, so buckle up and let’s get on into it. After this last challenge set in Virbank, it’s Potpourri. Read Askew Manuscripts 1 Virbank Medical has recieved a call from Driftveil Police with news. Patient data…
Onto the next challenge category in the CISA ICS CTF - Virbank City. This time we’re going to be taking a look at the Mission Inconceivable challenge set. There was a ton to learn from this one, so I’m excited to take a shot at this one next. This CTF has some infrastructure setup for the players to use; Malcolm , Arkime , NetBox and CyberChef . Some of these services we’ll be using in this…
Well, another year has passed, which means its time for my annual CTF competition. This year I’m doing CISA’s ICS CTF solo-mode. This CTF has some infrastructure setup for the players to use; Malcolm , Arkime , NetBox and CyberChef . Some of these services we’ll be using in this challenge, some won’t. I’ll probably put this brief little introduction in each post so we’re all on the same page.…
Another challenge from Virbank city - this time Virbank employees have been spotted installing unauthorized software. An FTP server was recently setup on one of the hospital’s servers (yikes) and has been used for hosting video games and such! They identified an interesting executable of interest that is stored in malcolm . Our task is to find it and retrieve the hash. This CTF has some…
Oh boy, we’re down to the final few challenges! We’re back in the Verbank category with “Extend Your Stay”. This time Virbank Medical has detected a suspicious browser add-on installed on a users device; The question is to RE the extension and identify the flag. Let’s dive into it! Extend Your Stay 1 Okay, so we’re given a Chrome Extension (.crx) and we now need to do some analytical work on it.…
After a short nap and an Obsidian update, I’m back! This time we’re going to tackle Split32. We’re going to dive right into this guy and not spend as much time on initial theory unless relevant. Initial Program Usage & Static REing We should always initially use the program like an actual user before we dive into any behavior so we get a solid understanding of how the application actually works.…
Wow, it’s been a long while since I’ve written one of these things. Just over 7 months to be exact, going forward into ‘24, I should really be better about that. Anyways, I’m traveling this weekend and just finished up SANS SEC660/GXPN (I passed btw!). One of my major weakpoints in offensive ops is Binary Exploitation - I really truly suck at it and this is kinda my last ditch effort to try to be…