Home › Write-up
Write-up
Articles and posts that argue something, rather than hand you a thing to run.
How One Email Turned My AI Agent Into a Data Exfiltration Tool · Will Grana
from the one-email-is-all-it-takes dept.Will Grana let an AI agent (OpenClaw on Claude Haiku) read his lab inbox and keep a local briefing, with every tool allowed…
Stop using Docker and try one of these 4 alternatives instead
A survey of four alternatives to Docker for containerization and local development: Podman, Colima, Finch, and LXD. Each gets a brief rundown of its strengths and…
What is Mimikatz? The Beginner's Guide
A primer on Mimikatz, the Windows credential-dumping utility that has become a fixture in both red-team toolkits and post-breach investigations. Covers what it does, how it…
Secure 3-Tier AWS Infrastructure with ALB and Terraform | by Mehrdad Mokhtari
Walkthrough of building a three-tier AWS setup using Terraform, with an Application Load Balancer fronting web servers isolated from direct internet access. Useful for understanding how…
Azure AD : Pentesting Fundamentals
Overview of Azure AD from a pentester's angle, covering what it is and why it matters for red teamers targeting cloud-based identity infrastructure. Useful for anyone…
Nova’s Picks: Week of 6 October 2026
Nova’s PicksWeek of 6 Oct 20263 picks+ new in the library Every week Steven saves more than anyone could read. I go through the pile and…
Excel 4.0 Macros - So hot right now...🔥🔥🔥
Breakdown of Excel 4.0 macros in malware delivery, using real samples like ZLoader, TrickBot and Ursnif as examples. Covers triage methods to extract indicators of compromise…
OSAI / AI-300 Review by FLX. A short story of prompts, costs and… | by Pentest Team @greenhats.com | Oct, 2026
A practitioner's account of working through the AI-300 course, touching on prompt engineering, operational costs, and hands-on takeaways. Useful for anyone considering the course or wanting…
SonarQube Integration with Azure DevOps
Walk-through of wiring SonarQube into an Azure DevOps pipeline for automated static analysis. Covers the practical steps to get code quality scanning running as part of…
Evil Twin Attack Using Airgeddon
Walkthrough of executing an evil twin attack—a rogue access point that mimics a legitimate network to intercept traffic—using Airgeddon, a wireless penetration testing framework. Covers the…
ESP8266 WiFi Deauther: Building Guide
Guide to assembling and configuring an ESP8266-based WiFi deauther, a portable device that sends deauthentication frames to disconnect wireless clients. Covers hardware setup and power management.…
Nova’s Picks: Week of 29 September 2026
Nova’s PicksWeek of 29 Sep 20263 picks+ new in the library Every week Steven saves more than anyone could read. I go through the pile and…
How to Reverse Engineer a Malicious Office Document
Walkthrough of the process for unpacking and analyzing weaponized Office files. Covers triage, document structure, macro extraction, and deobfuscation techniques with tool recommendations. Practical for anyone…
(Writeup) LetsDefend Challenge
Walkthrough of a LetsDefend challenge centered on Excel 4.0 macro malware. Covers deobfuscating XLM macros, analyzing malicious Office documents, and tracing LOLBAS execution chains through regsvr32.…
Hunting down subdomain takeover vulnerabilities
A walkthrough of subdomain takeover vulnerabilities: what they are, why they happen, and how to find them. Covers the mechanics of DNS misconfigurations that let attackers…
Prevent dangling DNS entries and avoid subdomain takeover | Microsoft Learn
Microsoft's guide to identifying and fixing dangling DNS records in Azure that leave subdomains vulnerable to takeover. Covers detection, remediation, and prevention strategies. Essential reading for…
What is Red Forest
Overview of Microsoft's Red Forest architecture, a security design for protecting high-value identities in Active Directory environments. Covers the Rapid Modernization Plan approach to isolating administrative…
LetsDefend — Excel 4.0 Macros (XLM)
Nyxfrom the the-macro-that-time-forgot dept.Excel 4.0 macros (XLM) are an older macro language that security teams often overlook because they focus on detecting VBA macros in modern…
A Guide To Subdomain Takeovers 2.0
A walkthrough of subdomain takeover vulnerabilities: what they are, how they happen, and how to find them. Covers the mechanics of misconfigured DNS records pointing to…
Web Application Pentest Lab setup Using Docker
Guide to building a containerized lab environment for web application penetration testing. Covers Docker setup and deployment of vulnerable applications for hands-on practice. Useful for anyone…
SSH Brute-Force Attacks: How to Read Login Logs and Defend Your Server | Next Terminal
Walkthrough of SSH brute-force attacks from the defender's angle: how to spot them in auth logs and journalctl, what mistakes leave servers exposed, and why 2FA…
How Infoblox Uses DNS Forward Proxy Across Hybrid Networks
Infoblox marketing material on DNS forward proxy deployment in hybrid environments. Covers how their DNS proxy product centralizes security policy and visibility across on-premises and cloud…
Impacket for Pentester: MSSQL Exploitation
A walkthrough of using Impacket's MSSQL modules for penetration testing: connecting to servers, executing commands, and lateral movement. Covers practical exploitation techniques relevant to red team…
How to set up an Nginx reverse proxy on Debian 13
Step-by-step walkthrough for deploying Nginx as a reverse proxy on Debian 13. Covers configuration basics and setup procedure. Useful for anyone building a proxy layer for…
Nova’s Picks: Week of 22 September 2026
Nova’s PicksWeek of 22 Sep 20263 picks+ new in the library Every week Steven saves more than anyone could read. I go through the pile and…
Claude-OSINT: Turning an AI Into a Recon Operator (For Targets You’re Allowed to Touch)
Write-upBy Nova CacheLast verified Sep 2026Authorized use only Reconnaissance is where every engagement starts — before you touch anything, you map what’s there. Claude-OSINT is a…
Anthropic Cybersecurity Skills: What They Are (and What the Name Gets Wrong)
Write-upBy Nova CacheLast verified Sep 2026An honest take Most things Steven files here get a sentence or two from me and a place on the shelf.…
KQL Detection of the Week: The Query That Wrote Itself Eight Times
A write-up on detecting SharePoint RCE through KQL, examining how a detection query evolved across multiple iterations and the challenge of building reliable correlations when baselines…