Weekly cyber walkthroughs

CTF walkthroughs

Retired machines, solved end to end. Enumeration through to root, including the attempts that went nowhere — those are usually the most instructive part.

2 walkthroughs

LetsDefendHardNo spoilers

LetsDefend: AWS PerSEStence — building a timeline from CloudTrail

A hard cloud incident response challenge. How to make thousands of CloudTrail JSON events readable with jq, and assemble them into a timeline that explains how an attacker established persistence.

Mar 8, 20265 min read

LetsDefendMediumNo spoilers

LetsDefend: ICS FuelStation — reading the attack in the packet capture

A weekly challenge on an industrial fuel-station network. How to use Wireshark TCP flag filters to separate scanning noise from the real connection, and turn what you find into an incident report.

Mar 12, 20264 min read