Field notes.
Writeups, postmortems, and short essays on offensive testing, blue-team operations, and the politics of writing good security policy.
Walking through PortSwigger's SQLi labs: from boolean to union-based.
A guided run through five Web Security Academy labs — what each vulnerability actually looks like in Burp, where the payload comes from, and the one defensive control that would have stopped every one of them.
read post →Walking through PortSwigger's SQLi labs: from boolean to union-based
Five Web Security Academy labs broken down step-by-step in Burp, with the one defensive control that would have stopped each of them.
Tuning Wazuh to stop crying wolf
A 4-week project to cut SIEM alert noise by 70%. The diff between rule volume and signal — and how I learned to write decoders that don't match everything.
Writing ISO 27001 policies that engineers actually read
Compliance reads like a wall. Field guide: how I rewrote 14 client policies into single-page mappings between control IDs and on-call playbooks.
DLP without the drama: building and rolling out the system
How I built the Python + YARA DLP engine, why most rollouts die by week two, and the phased approach that surfaces real exfil without breaking marketing's workflow.
Network forensics with a 200-line Scapy sniffer
Why I wrote a custom packet sniffer instead of leaning on tcpdump — and what structured logging unlocks for downstream correlation in Wazuh.
12 days of TryHackMe: notes from the writeup series
What I learned shipping 12 walkthroughs back-to-back. Privilege escalation patterns, the OSINT habits that keep paying off, and the rooms I'd skip.
Securing a FastAPI backend in under an hour
The four things I always set up first: signed sessions, rate limits, structured input validation, and an auth boundary that says no by default.
Office security audits: the checklist that survived contact with reality
What I actually look for when walking a floor — beyond the vendor checklist. Wi-Fi segmentation, badge habits, and the three printer settings nobody changes.