Weekly cyber walkthroughs
CTF walkthroughs
One challenge a week, worked through properly, with the video alongside. Tools used, filters used, and the reasoning behind each step — including the attempts that went nowhere, because that is usually where the lesson is. Each one says up front whether it spoils the answers.
7 walkthroughs
LetsDefend: AWS PerSEStence — building a timeline from CloudTrail
This one was a fun one. A hard cloud IR challenge: making thousands of CloudTrail JSON events readable with jq, and turning them into the story of how an attacker stayed in.
LetsDefend: Compromised ICS Device — a PLC, a water pump and Modbus
A water treatment plant with a compromised PLC. Learning Modbus from scratch, tracing the brute force, and the one-space filter mistake that cost me an hour.
LetsDefend: ICS FuelStation — finding the attack in the packet capture
This week I tackled ICS FuelStation. One tool, three Wireshark filters, and an incident response report at the end. Here is exactly how I worked through it.
LetsDefend: AWS Bucketware — thinking your way through CloudTrail
A hard cloud IR challenge, and the one I deliberately do not hand you the answers to. Building an API-call cheat sheet, spotting the compromised identity, and the versioning trick behind the whole attack.
LetsDefend: Compromised Chat Server — ten questions, one pcap
GET counts, CSRF tokens, plaintext credentials, a malicious plugin and a path traversal CVE. The Wireshark filters that answer each question.
LetsDefend: Kernel Exploit — working a forensic image with find and grep
A forensic image and a privilege escalation to reconstruct. Where I look first, how to use VirusTotal properly, and the two commands that do most of the work.
LetsDefend: HTTP/2 Rapid Reset — why the web server died at go-live
It worked in dev and fell over in production. Reading the TLS handshake, finding the RST_STREAM flood in the capture, and landing on the CVE.