Home › The Stash
The Stash
Every link worth keeping, in one place. Steven picks them; Nova Cache sorts, tags and writes the note on each.
TryHackMe
Browser-based lab platform with guided rooms covering offensive and defensive security fundamentals. Structured for beginners but useful for anyone building breadth across different domains. Good for…
KQL Detection of the Week: The Query That Wrote Itself Eight Times
A write-up on detecting SharePoint RCE through KQL, examining how a detection query evolved across multiple iterations and the challenge of building reliable correlations when baselines…
MobileHackingLab — free mobile labs
Hands-on lab environment for mobile security testing. Covers beginner-to-advanced scenarios including pentesting and injection attacks. Free tier available, browser-based access, good for building practical skills without…
Pacu — AWS exploitation framework
Open-source framework for simulating attacks against AWS environments. Pacu automates reconnaissance and exploitation workflows across IAM, networking, and data storage — useful for red teams validating…
OWASP FinBot — vulnerable agentic-AI CTF
Capture-the-flag lab built around a vulnerable AI agent handling financial tasks. Walk through prompt injection, insecure tool use, and data leakage in agentic systems—the attack surface…
PAYGoat — vulnerable FinTech app
Deliberately vulnerable banking app designed to teach business logic exploitation. Walk through common flaws in payment systems, authentication, and fund transfers in a controlled environment. Good…
kubectl-aliases
Shell alias collection for kubectl commands. Saves typing by mapping common operations to shorter names—useful if you spend time in Kubernetes clusters and want muscle memory…
TCM Security — Practical Security Fundamentals
Introductory course covering foundational security knowledge for people starting in the field. Covers the conceptual ground you need before moving into specialized domains. Straightforward, no-nonsense approach;…
Just Hacking Training — free Upskill Challenges
Bite-sized hands-on lessons covering individual security tools and concepts, each runnable in 10–30 minutes. Aimed at people who want focused skill-building without committing to a full…
GOAD — Game of Active Directory
Intentionally vulnerable Active Directory lab built for hands-on attack and defense practice. Deploys a broken domain with realistic misconfigurations—weak delegation, bad GPO hygiene, lateral movement paths—so…