Archive
Field notes on security research, systems, and the web — CTF writeups, infrastructure deep-dives, and the occasional certification retrospective.
5 posts
f1rst 9 min read The console behind the recruitment kit in part one ships onboarding material for its customers, increments a build constant and shares its code, its services and its configuration variables with a phishing operation documented in September 2023 as RedLungfish. This is what the capture record and the panel build support.
f1rst 13 min read 1 parts
Some writeup for a mobile challenge on Hack The Box Lab.
f1rst 76 min read 8 parts
Some writeup for a web challenge on Hack The Box Lab.
f1rst 16 min read Technical analysis of a live General Motors careers phishing deployment and the kit behind it: cloned brand pages, a collection form, a fake identity provider, and a Socket.IO console that lets an operator steer the victim. 245 captures across 108 registrable domains, with detection opportunities and indicators.
f1rst 7 min read Notes on writing a lightweight CTFd container plugin for a university CTF, including per-team flags and flag sharing detection.