Weekly cyber walkthroughs
One challenge a week, worked through properly, with the video alongside. Tools used, filters used, and the reasoning behind each step — including the attempts that went nowhere, because that is usually where the lesson is. Each one says up front whether it spoils the answers.
7 walkthroughs
This one was a fun one. A hard cloud IR challenge: making thousands of CloudTrail JSON events readable with jq, and turning them into the story of how an attacker stayed in.
A water treatment plant with a compromised PLC. Learning Modbus from scratch, tracing the brute force, and the one-space filter mistake that cost me an hour.
This week I tackled ICS FuelStation. One tool, three Wireshark filters, and an incident response report at the end. Here is exactly how I worked through it.
A hard cloud IR challenge, and the one I deliberately do not hand you the answers to. Building an API-call cheat sheet, spotting the compromised identity, and the versioning trick behind the whole attack.
GET counts, CSRF tokens, plaintext credentials, a malicious plugin and a path traversal CVE. The Wireshark filters that answer each question.
A forensic image and a privilege escalation to reconstruct. Where I look first, how to use VirusTotal properly, and the two commands that do most of the work.
It worked in dev and fell over in production. Reading the TLS handshake, finding the RST_STREAM flood in the capture, and landing on the CVE.