Practitioner-grade cybersecurity content
Technical playbooks, war stories, and how-to-think guides — written by practitioners, anchored to the Indian context.
Want structured, step-by-step learning instead? Explore the Academy (guided courses) or the AI security hub.
Latest articles
Most recent practitioner playbooks across every track. Filter by topic in the sidebar, or use search.
Metasploit in 2026: The Practitioner Workflow
Metasploit beyond search-and-exploit — workspace management, database integration, payload customisation with msfvenom, listener management, post-exploitation modules, integration with BloodHound and modern C2.…
Blue TeamWireshark for Security Teams: Network Forensics That Works
Wireshark workflow for security analysis — display filters, TLS decryption setup, Kerberos analysis, follow-stream feature, IoC extraction with tshark, beaconing detection. From…
Red TeamingNmap for Pentesters: Beyond -sV -sC
Senior Nmap workflow — phased scanning (discovery, full TCP, service detection, vuln scripts, UDP), NSE scripts that find bugs (vulners, smb-vuln, ssl-enum-ciphers),…
Red TeamingProxyShell: The Exchange Vulnerability That Fueled Ransomware
ProxyShell (CVE-2021-34473/34523/31207) chain — pre-auth RCE on Exchange. Why it became ransomware fuel, IoCs (webshells in Exchange directories, anomalous PowerShell remoting), patching…
Threat IntelligencePython Pickle Deserialization: The 20-Year-Old Footgun
Pickle on untrusted input is RCE by design. Where it hides — cache layers, session storage, Celery task arguments, ML models, cookie…
Tools & TutorialsNoSQL Injection: MongoDB, Elasticsearch, DynamoDB
NoSQL injection class — MongoDB operator injection ($ne, $where), Elasticsearch DSL injection, DynamoDB attribute injection, CouchDB MapReduce. Test workflow with NoSQLMap and…
Security GuidesCSRF in 2026: Why SameSite Doesn’t Solve Everything
SameSite=Lax is the default; CSRF should be solved. It is not. SameSite=None for legitimate cross-site, GET-based state changes, subdomain CSRF, CORS misconfigurations,…
Security GuidesXXE: External Entity Injection in 2026 — Where It Still Hides
XXE in 2026 — document upload (DOCX, SVG, RSS), SOAP APIs, SAML, RSS processors. Blind XXE via out-of-band channels, XXE-to-SSRF chains, and…
Threat IntelligenceServer-Side Template Injection (SSTI) in 2026: Detection and Exploitation
SSTI test methodology — canary payloads for Jinja2, Twig, Smarty, Freemarker, Velocity, ERB, Razor. Where SSTI hides (email templates, error messages, report…
Threat IntelligenceSpring4Shell (CVE-2022-22965): Why It’s Still Hitting Java in 2026
Spring4Shell was disclosed in March 2022. Vulnerable Spring still found in Indian enterprise audits in 2026, particularly legacy Java apps and vendor…