Writeups
Walkthroughs from the rooms I tinker with: methodology first, flags redacted, with notes on how you'd detect and prevent each step.
TryHackMe
Hands-on offensive security: cloud, Active Directory, and web.
- 339Rooms
- 55Badges
- 169Day streak
Plumbing two WANs and a segmented LAN into a virtual firewall
pfSense runs as a VM, so it has no physical ports to plug a fibre modem, a Starlink dish, and a LAN into. The answer is VLANs: four tags on one trunk that hand a virtualized HA firewall pair its two WANs, the LAN, and a private sync link. The network design behind the edge.
A LibreSDR + Hailo signal lab on a Pi 5: the half that fought back
A Raspberry Pi 5, a 26-TOPS Hailo accelerator, and a Pluto-class LibreSDR, meant to be a self-contained RF signal-analysis box. The radio enumerates and reports its AD9361 config over IIO, and then the open-source SDR toolchain and the vendor ML stack both fight to a standstill. An honest bring-up log.
Four Lenovo Tinys, one Proxmox cluster, and the bug that logged me out every five minutes
PMX-CLUSTER1 is a four-node Proxmox cluster on Lenovo M900 Tinys with deliberately local-only storage. Standing it up was easy; the bugs taught me more. A maddening five-minute logout loop, version drift, a Trixie repo gauntlet, and stale NVMe references. The debugging is the interesting part.
Monitoring on a too-new Debian: the Zabbix-on-Trixie saga
I wanted Zabbix watching the Proxmox nodes and the Cisco switch. The host was on Debian 13 (Trixie) before Zabbix shipped a Trixie repo, so apt had nothing, the build-from-source fallback went sideways, and PostgreSQL wasn't even installed where the guide assumed. A monitoring setup that fought back.
HA pfSense on Proxmox, with dual-WAN failover
Why I run pfSense as a virtualized active/passive CARP pair split across two Proxmox nodes, fronting a dual-WAN (fibre + Starlink) edge, and the firewall-virtualization gotchas that bite.
Giving an LLM the keys to my Proxmox cluster (carefully)
I built an n8n workflow that lets an LLM act as an ops agent over my four-node Proxmox cluster. The interesting part was deciding how to scope a confident, occasionally-wrong model so it can't take down my lab.
Running Wazuh at home: a dead dashboard and a flooded agent
Two failures from a home SIEM during a week of Proxmox and firewall rework. A TLS cert/key path mismatch that quietly took the whole dashboard down, and a level-12 "agent buffer flooded" alert that looked alarming but was actually the pipeline working.
When UDP-only firewall rules quietly broke DNSSEC
A home-lab outage where one protocol checkbox took down every .ai domain, and why DNS needs TCP.
Azure: Tapper
Part 1 Azure: Tapper, foothold and the managed identity
From an SSH foothold to an over-privileged VM managed identity that opens the Azure control plane, and lateral movement without ever guessing a password.
Part 2 Azure: Tapper, one permission to own the tenant
How an app-only Microsoft Graph token with a single narrow-looking permission (UserAuthenticationMethod.ReadWrite.All) becomes tenant-wide account takeover via a Temporary Access Pass.
MedBay.AI: Stored XSS in a Privileged Reviewer Bot and Coaxing EPOCH-1 with Prompt Injection
A medical-AI room where a "file a note" feature lands stored XSS in a privileged reviewer browser. HttpOnly cookies push you from cookie theft to a same-origin fetch proxy, while a parallel prompt-injection path leaks restricted data straight out of the agent.
MD2PDF: SSRF via a Server-Side PDF Renderer
A Markdown-to-PDF converter renders attacker-supplied HTML server-side, turning its remote-resource fetching into an SSRF that reaches a loopback-only admin page.
Cracking an MSSQL Hash with Hashcat, and Why Your GPU Vanishes Inside a VM
A captured MSSQL login hash, a wordlist that runs dry, and the methodical climb from rockyou to rules to masks to a length-bounded brute force, plus the VMware gotcha that drops you to CPU-only and triples your crack time.