Blog
Fifteen challenges from a security competition, written up as I solved them. Each one explains what the attack actually was, keeps in the dead ends rather than presenting a clean run, and ends with the part most writeups leave out: how you would catch it.
Three are published here in full. The rest are on GitHub, written for a more technical reader.
Someone left a backdoor on a Windows machine without saving a single file. It hid inside a database Windows keeps for its own housekeeping — and ran itself once an hour, as the most privileged account on the system.
How you catch it Sysmon Event IDs 19, 20 and 21 exist for exactly this. They are off in most default configurations.
A guest laptop was quietly sending everything typed on it to an attacker — one character per web request, hidden in the part of a request nobody inspects.
How you catch it A session cookie that changes on every single request is not a session. That is the whole detection.
An AI assistant guarded an internal code. It decided whether you were allowed to have it by asking your name — and then believing the answer.
How you catch it A refusal that names its own condition, immediately followed by the user supplying exactly that condition. That two-message sequence is near-perfect to alert on.
Web attacks, cloud misconfiguration on both AWS and Azure, privilege escalation, and open-source intelligence — same structure, more technical detail.