Posts on red-teaming
43 posts on red-teaming. Notes from public sources and my own test lab.
Human Vulnerability or System Failure? The Dirty Lab of Social Engineering
Forget those generic 'click for a pay raise' phishing simulations. Let's talk about how real-world social engineering works, the art of pretexting, and the silent dance of fileless payloads.
The Trojan in Our Pockets: The Unseen Side of Mobile Security and the 'Safe' Pitfalls
Mobile security is more than just FaceID. From hardcoded secrets in APKs to sensitive data leaking in SharedPreferences, let's dive into the defensive side of mobile app development through the eyes of a Red Teamer.
Could Your Smart Bulb Be Watching You? The 'Shodan' Illusion and Bitter Truths in IoT Security
IoT security is more than just scanning Shodan. Let's dive into the world of 'Embedded Insecurity,' firmware analysis, and why your office coffee machine might be your biggest vulnerability.
Unlocking Invisible Doors: IDOR and the Silent Guests at API Backdoors
Ever seen someone else's invoice just by changing a number in the URL? That's IDOR. Let’s look at why this 'old but gold' vulnerability still haunts modern APIs and how we can secure our systems.
Getting Lost in the Kubernetes Labyrinth: Can You Truly 'Hacker-Proof' Your Cluster?
Ever felt the cold sweat of a cloud bill exceeding your company valuation? Let's look at Kubernetes security through a Red Teamer's lens and fix those common YAML blunders.
Is Container Isolation a Lie? That Thin Line Between Docker Socket and Host
If you think your containers are bulletproof shells, think again. From Docker socket abuse to risky capabilities, let's talk about how that 'sandbox' can vanish in seconds and how to actually secure it.
The Packet That Stops the PLC: Air-Gap Fairy Tales and Realities in the OT World
When you intercept a 'Function Code 05' request from an unauthorized IP on Wireshark, you realize within seconds that the physical valve or motor is no longer under your control. Welcome to the world of OT.
Armored Vehicle or Glass Jar? The Illusion of Container Isolation
Think your containers are bulletproof? Think again. Let’s dive into why shared kernels and privileged flags are a Red Teamer’s dream and how you can actually lock things down.
The Trojan Horse Inside the Fortress: Why Network Segmentation is Always Misunderstood
A deep dive into why 'flat networks' are a Red Teamer's dream and how proper segmentation is more than just VLANs—featuring a cautionary tale from my early days in the field.
The Regret After Double-Clicking That File: Getting Lost in the Labyrinths of Malware Analysis
A deep dive into the 'wild' path of analyzing malware from a Red Teamer's perspective, starting with a personal 'bridge mode' disaster and moving into static and dynamic analysis techniques.
New Eye in the Terminal: Can Claude Code Actually Spot Security Vulns?
I put Anthropic’s new Claude Code CLI to the test. Here’s how its agentic workflow stacks up against traditional tools in finding real-world bugs.
Claude Code Terminale İndi: Kodun İçindeki Açıkları Bulmak Artık Çocuk Oyuncağı mı?
Claude Code duyuruldu ve işler iyice kızıştı. Peki bu yeni AI aracı gerçekten güvenlik açıklarını yakalayabiliyor mu yoksa sadece gürültü mü yapıyor?