Knowledge base
90 practical guides, newest first, organised for the people who operate and defend real systems.
Turn a Raspberry Pi 5 into a practical Mini SOC with Wazuh. Monitor up to 25 Windows, Linux and macOS endpoints, detect vulnerabilities, watch file changes and centralize security alerts without buying an enterprise SIEM.
Design RouterOS around roles, zones and policy before the network becomes complicated. Add VLANs, VPNs, servers and additional WAN links later without rebuilding the security model.
Use 2026 evidence to plan the next security budget around identity, exposed systems, recovery, telemetry, suppliers and AI — before buying another dashboard.
A practical Windows hardening guide for small businesses. Secure local administrators, Defender, BitLocker, RDP, firewall, LAPS, ASR rules, Office macros, updates and backups without building an enterprise security department.
CVE-2026-69730 is a critical Windows DNS Server remote code execution vulnerability rated CVSS 9.8. Learn what is affected, why domain controllers are at risk, how to check your servers, and why September's Windows updates also caused RDS problems.
A practical cURL guide for system administrators. Test APIs, DNS, HTTPS, certificates, authentication, proxies, redirects, webhooks, downloads, performance and network connectivity directly from the command line.
Learn what n8n is, how IT administrators and businesses can use it, practical automation examples, self-hosting basics, security risks, AI integration and real-world workflow ideas.
An administrative Windows password reset can restore sign-in while breaking access to DPAPI-protected secrets, EFS files and private keys. Learn how to identify the account type, preserve a working session, back up recovery material and prove the data still opens.
Two exploited Windows privilege-escalation flaws entered CISA KEV while unauthenticated DNS and DHCP Server RCEs scored 9.8. Identify affected roles, verify builds, patch, contain exposure and hunt for pre-patch compromise.
A practical cross-platform guide to choosing and deploying VPNs on MikroTik RouterOS 7, with working site-to-site and road-warrior configurations.
A blunt, evidence-led comparison of MikroTik and Cisco across price, licensing, security, performance, support and operational effort, with practical RouterOS and IOS XE audit commands.
Clone Windows 11 safely with Rescuezilla, Clonezilla or Hasleo, prepare a bootable USB, size EFI and recovery partitions correctly, and recover a clone that will not boot.
Understand what a web application firewall does, when it is useful, where it fails, and how to deploy Cloudflare Free or OWASP CRS without locking out real users.
Prevent injection with parameterised APIs, typed allowlists, shell-free design, contextual encoding, least privilege and deployment-level regression tests.
Combine code review, safe staging tests, structured application events, web telemetry and endpoint evidence to find injection flaws and investigate attempted exploitation.
Concrete SQL, NoSQL, command, LDAP, template, log and CSV injection examples, each paired with safer code and a regression check.
Follow an injection attack through decoding, string construction, interpretation and impact, including second-order injection and background-job trust boundaries.
SQL injection is one member of a larger injection family. Compare interpreters, evidence, impact and the controls that actually fit SQL, shell, LDAP and NoSQL sinks.
Data injection happens when untrusted data changes the meaning of a query, command, template or downstream protocol. Learn the trust boundary, common forms and first checks.
Build, convert and tune Sigma rules for SQL-injection strings, application validation failures and suspicious processes spawned by web servers.
An authenticated RouterOS API session may retain its old privileges after an account is downgraded. Here is how to find exposed services, terminate active sessions, restrict the API and verify the result.
A problem-and-solution hardening runbook for Ubuntu Server, Debian and Rocky Linux: patching, SSH keys, firewalls, Fail2ban, AppArmor or SELinux, audit logs, file-integrity checks and proof that the result actually works.
A source-checked look at the unusually dense 2026 run of Microsoft Defender vulnerabilities, what the thirteen CVEs actually affect, and how to verify Windows, macOS and Linux endpoints rather than merely hoping automatic updates worked.
CVE-2026-62832 lets a low-privileged local attacker abuse Windows User Profile Service and the venerable UsrClass.dat registry hive to reach another user's settings and turn them into privileged code execution.
A first-hour response that revokes access, preserves cloud evidence, checks the persistence paths attackers commonly leave behind, and explains the recovery route when you cannot sign in.
A practical fibre troubleshooting story: we investigated optical budgets, modules, speed and configuration before remembering that one transmitter must meet the other receiver.
How a helpful OpenClaw assistant turned a WhatsApp contact list into shared authority over Gmail and the host—and how to rebuild it with real trust boundaries.
What to do after running software of unknown origin: contain the computer, replace exposed sessions and secrets from a clean device, then decide whether to investigate or rebuild.
A practical perimeter check you can run today: find the correct public address, scan it from a genuinely external network, understand every result, fix exposure, and prove the change.
Check your own public IP, on-premises mail server and WordPress site with safe commands, evidence-led interpretation and practical remediation.
The 15 newest CISA Known Exploited Vulnerabilities entries, with safe version checks, exposure evidence, practical remediation, incident triage and closure tests.
Access-control failures let authenticated or anonymous users read, change, or invoke resources outside their intended authority.
Create a small virtual environment with clear trust boundaries, snapshots, controlled internet access, and a written reset plan.
Separate administration from daily work, require strong authentication, reduce standing privilege, and prepare monitored emergency access.
Use packet capture to explain endpoints, protocols, timing, and failures while respecting encryption and data sensitivity.
A role-based cloud identity response checklist from declaration through session revocation, evidence, persistence review, lockout recovery, and monitoring.
How to slow the damage, preserve options, and make recovery decisions without turning an outage into an evidence-destruction exercise.
Misconfiguration turns powerful features, management interfaces, sample content, and verbose errors into avoidable attack paths.
Capture a small, authorised traffic sample and turn DNS, TCP, TLS, and timing into a defensible explanation.
Reduce exposed authentication paths, require managed keys, limit privilege, and verify access before closing the existing session.
Use Nmap for asset and service discovery without turning an inventory task into an uncontrolled production test.
Coordinate business continuity, isolation, evidence, identity protection, external obligations, and clean recovery.
A proportionate response based on what the user entered, downloaded, approved, or executed—not panic based on the click alone.
Dependencies, build systems, package registries, updates, and release credentials form a trust chain that attackers can target upstream.
Deploy a single-node learning environment, add one endpoint, verify log flow, and document the first useful alert.
Use Microsoft’s baseline as a starting point, stage changes, record exceptions, and test both security and business workflows.
Understand agent, server, indexer, and dashboard responsibilities before scaling collection or importing rules.
Triage the message, interaction, identity, endpoint, and recipient scope without detonating the lure or deleting the only evidence.
Investigate consent abuse as an identity incident: permissions, users, tokens, app activity, and the path that convinced someone to approve it.
Cryptographic failures expose data because encryption, key management, transport protection, or algorithm choices do not match the threat.
Generate bounded failed logins against lab identities and build a detection that groups attempts by source, target count, and time.
Protect the management plane, remove unnecessary services, constrain the firewall, and make configuration recovery routine.
Write behaviour-focused rules with complete metadata, then validate field mapping and generated queries on the real target platform.
Capture the application and grant, disable access, find affected data and users, and prevent the same consent path from recurring.
Treat a failed restore as an incident, then separate media integrity, credentials, dependencies, capacity, and runbook failures.
Injection occurs when untrusted data changes the meaning of a query, command, template, interpreter, or downstream protocol.
Use a synthetic message to inspect headers, authentication results, URLs, and attachment metadata without contacting attacker infrastructure.
Reduce daemon authority, container privilege, mutable images, exposed sockets, and unbounded resources.
Build rules from stable combinations of strings and structure, with a corpus that measures both misses and false positives.
Use device state, encryption, data classification, identity, remote management, and legal requirements to choose proportionate action.
A careful triage path for suspicious processes, new persistence, unexpected network traffic, and altered accounts on a Linux host.
Insecure design describes missing or ineffective controls in the workflow itself, even when the implementation has no obvious coding bug.
Turn a specific behaviour and log source into a portable rule with metadata, test cases, and known false positives.
Inventory enterprise applications, permission grants, credentials, owners, and real use before removing stale or excessive access.
Use artefacts and VQL collections to answer scoped forensic questions while preserving provenance and limiting unnecessary data.
Replace and revoke the secret, but also establish exposure time, permissions, use, copies, dependencies, and newly created persistence.
Decide quickly using encryption, device state, cached credentials, data sensitivity, remote actions, and identity evidence.
Authentication failures include weak recovery, session handling, automated attack resistance, and MFA choices—not only password policy.
Create a narrow file-identification rule from synthetic samples, then test for false positives and brittle strings.
Separate backup identity and infrastructure, keep immutable or offline copies, and prove recovery with measured exercises.
Use SQL-like queries for inventory and state while respecting table cost, platform differences, scheduling, and result interpretation.
Protect availability while preserving web, identity, process, file, network, deployment, and cloud evidence.
Rotate the secret, but first understand where it appeared, what it could do, how it was used, and what automation depends on it.
Integrity failures arise when applications trust updates, serialised data, cached objects, plugins, or workflow messages without verifying origin and authorised change.
Scan a tiny lab subnet, compare discovered services with the expected inventory, and document ownership before assessing risk.
Harden registrar identity, transfer controls, DNS changes, mail records, certificate policy, and recovery contacts.
Configure focused Windows event generation, forward it reliably, and tie each event class to an investigation or detection need.
Separate malicious traffic, flash demand, dependency failure, and capacity exhaustion while keeping communication and evidence intact.
Coordinate identity response, payment interruption, bank contact, evidence preservation, and business communications when an invoice is manipulated.
Security logging fails when important events are absent, ambiguous, delayed, unprotected, or impossible to turn into a timely decision.
Collect a small, documented set of endpoint artefacts from a disposable Windows VM and preserve provenance for review.
Set safe transport and browser policies, but verify application compatibility and avoid treating headers as a substitute for secure code.
Use deterministic recipes for decoding, hashing, extraction, and comparison while avoiding accidental data disclosure.
Coordinate legal, HR, privacy, identity, endpoint, and data evidence without tipping off the subject or exceeding authorised monitoring.
Recover registrar control, stabilise authoritative DNS, protect email, and determine whether the change enabled credential or certificate abuse.
Systems become insecure when errors, resource exhaustion, partial failure, or unexpected state bypasses controls or leaves data inconsistent.
Measure recovery point, recovery time, dependencies, and data integrity by restoring a synthetic service into an isolated environment.
Collect the events responders need, protect the pipeline, and assign alerts before expanding volume.
Scan images, filesystems, configuration, and dependencies with scope and policy, then connect findings to deployed exposure and an owner.
Turn a supplier notification into an inventory, access, data, continuity, and evidence response for your own organisation.