Weekly cyber walkthroughs · Cyber concepts
Step-by-step CTF walkthroughs and certification study guides — written slowly, tested properly, and free to read. No shortcuts, no fluff, no paywall.
Everything here exists to close the gap between reading about security and being able to do it.
Retired machines, solved end to end. Every command shown, every dead end explained — because the dead ends are where the learning happens.
Exam objectives turned into something you can actually study from: what to know, why it matters, and how it appears on the exam.
The underlying ideas, explained once and explained clearly, so the tooling makes sense instead of being memorised.
Retired boxes only, solved start to finish.
A hard cloud incident response challenge. How to make thousands of CloudTrail JSON events readable with jq, and assemble them into a timeline that explains how an attacker established persistence.
A weekly challenge on an industrial fuel-station network. How to use Wireshark TCP flag filters to separate scanning noise from the real connection, and turn what you find into an incident report.
Free, thorough, and kept current with the exam objectives.
The hardest AWS security exam, domain by domain: detection and response, logging, infrastructure, IAM, data protection and governance — plus the service comparisons it tests relentlessly.
CySA+ is Security+ with the training wheels off: real log analysis, real vulnerability prioritisation, real incident response. Here is what it tests and how to prepare.
Everything Security+ actually tests, domain by domain, with a six-week study plan and the question patterns that catch people out.
Every study guide here comes from a certification that was actually earned — not summarised from a syllabus.
Amazon Web Services
SCS-C02Specialty-level exam on securing AWS workloads: identity, detection, incident response, infrastructure and data protection.
Amazon Web Services
CLF-C02Foundational AWS exam covering cloud concepts, core services, the shared responsibility model, billing and support.
GIAC
GCIHHands-on incident handling: detection, containment, eradication and recovery, plus the attacker techniques behind each.
CompTIA
CS0-003Behavioural analytics, threat detection, vulnerability management and incident response from the SOC analyst’s seat.
CompTIA
SY0-701The baseline security certification: threats, architecture, operations, and governance, risk and compliance.
Most security content optimises for looking impressive. This does the opposite: it optimises for you being able to repeat it.
That means showing the enumeration that found nothing, naming the assumption that turned out to be wrong, and explaining why a technique works rather than pasting the command that runs it.
It is slower to write and slower to read. It is also the only version that survives contact with a real engagement, or a real exam.
Every one written out in full, with every command you can copy and every dead end explained.
No. Each walkthrough states the prerequisites up front and links to the concepts it relies on. If a step needs background you do not have yet, there is a path to go and get it.
Retired and permanently public machines are written up in full. Challenges still live on a platform are covered method-only — the tooling, the filters, the reasoning — with no flags or answers, and are labelled “No spoilers”. Publishing an answer key for active paid content breaks most platforms’ rules and takes the learning away from everyone else.
No. The walkthroughs and study guides are free to read, with no account, no email wall and no upsell.
Yes — requests genuinely shape what gets written next. The fastest way to reach me is a message on LinkedIn.