Blog

Two root-persistence tricks for Attack/Defense CTFs: a hidden SUID bash, and a login backdoor that survives new users.

Plain DNS is cleartext on port 53. How DoT, DoH, and DoQ encrypt it, how DoH rides HTTPS, and exactly what your ISP can still see. Part 3 of a DNS series.

DNS tunnelling, command-and-control, domain generation algorithms, exfiltration, fast flux, and DoH abuse, with real campaigns and how defenders catch them. Part 4 of a DNS series.

The DNS message format field by field: the 12-byte header and its flags, the question, the answer records, and EDNS. Plus the record types a domain actually holds. Part 2 of a DNS series.

Pick a public DNS resolver, set it, prove it works.

Turn a raw netcat shell into a full interactive TTY: job control, arrow keys, tab-completion, and a working Ctrl+C.

DNS 101: why it exists, the domain namespace, the recursive lookup through root, TLD, and authoritative servers, and caching. Part 1 of a DNS series.

Set up EPITA's IONIS network (eduroam) with PEAP/MSCHAPv2 and no CA certificate: GUI, nmcli, iwd, and netctl.

A two-year supply-chain operation hid a remote-code-execution backdoor in OpenSSH via the xz compression library. A half-second slowdown on ssh logins caught it days before it would have shipped to every Linux server.

France's official watermarking tool uploads your document before stamping it. The network trace, and a browser-only alternative that sends nothing.