Short essays on how the internet works under the hood — networking concepts explained simply, the meaning behind IP and DNS data, and practical ways to use these tools.
A noisy Sigma rule is usually a good rule that has never met your environment. How to find what is firing, write filter selections an attacker cannot easily borrow, move local exceptions into Sigma filter files, and use correlation rules when only volume means anything.
Read →Most JWT vulnerabilities are not flaws in the format but verifiers trusting the token's own header. How decode-without-verify, alg=none, RS256-to-HS256 algorithm confusion, weak HMAC secrets, missing exp and unchecked aud each work, and the checklist that closes them.
Read →Nobody can reverse an MD5 digest. What broke is that two different files can now be made to share one, and that was enough to forge a trusted CA certificate in 2008 and a Microsoft code-signing certificate in 2012. How SHA-1 followed, what both are still safe for, and why SHA-256 is the default.
Read →What every field of an SSL report means and where it comes from. Why the certificate shown is the newest one issued rather than the one served, how wildcards cover exactly one label, how to compare fingerprints with the live server, and why a C grade usually means missing HSTS rather than a weak certificate.
Read →CAA decides which certificate authorities may issue for your domain and CT shows what they actually issued. How to inventory your issuers from the logs, write a CAA policy that will not block your own renewals, pin issuance to your ACME account, and what to do when an unexpected certificate appears.
Read →A WHOIS record says more than who owns a domain. Why the registry and the registrar hold different halves of it, which date resets when a domain changes hands, what each EPP status code means from transfer lock to pendingDelete, why the DNSSEC flag can say signed on a broken domain, and where to send an abuse report.
Read →Handshake scanners, certificate readers and client tests answer different questions. What Qualys SSL Labs grades and caps, when testssl.sh or SSLyze is the better fit, what openssl s_client shows in one line, what a Certificate Transparency lookup can and cannot tell you, and how badssl.com tests your own code.
Read →SecurityHeaders.com grades six headers and caps the grade when a value undermines one. What MDN HTTP Observatory, internet.nl, Google's CSP Evaluator and hstspreload.org check beyond that, what curl and developer tools show that no scanner can, and why two scanners can grade the same site differently.
Read →