Linux security
Server hardening, service isolation, privilege boundaries, release integrity, and the evidence required to show that a control changed a real attack path.
Every matching record.
Methods and named-vulnerability research remain visually and editorially separate.
Field notes 3
Kernel-Level Packet Sniffing with eBPF/XDP: Real-Time Credential Extraction and Exposure Auditing
How eBPF and XDP bypass userspace packet-capture bottlenecks to intercept authentication handshakes, NetNTLMv2 hashes, and cleartext credentials at line rate: architecture, protocol dissectors, and exposure auditing with driftnet2.
8 min read ↗Cloud Security · Nov 6, 2026Container Escape: Docker Socket, Privileged Mode, and the Boundary That Moves
A container is a namespace, a cgroup, and a set of capabilities — not a boundary. When one of those is handed to you, the host is a mount away. The Docker socket and --privileged are demonstrated live, and the cgroup v1 trick that modern systems already killed is called out.
6 min read ↗Exploit Development · Nov 6, 2026Stack Buffer Overflow: From Segfault to RIP Control (Ret2win)
The non-AD half of the journey: a 64-byte stack buffer, an unbounded read, and the exact steps that turn a segfault into control of the instruction pointer. Compiled live in a Linux container, with the one gotcha — the return address is not where the naive math says it is.
6 min read ↗