Networks/Networking

Nmap is the industry-standard tool for network discovery and security auditing. It's used to discover hosts, services, open ports, and operating systems on a network — essential for any penetration test or security assessment.

During an authorized security assessment, "wiretap" on a mobile device can mean several things: stalkerware installed by an abusive partner, enterprise MDM monitoring, a malicious app with excessive permissions, a compromised device via a sophisticated implant, or even a network-level interception. I'll cover detection and removal for each category, with evidence preservation as a priority — if this has legal implications, the forensic trail matters as much as the removal its

Paywalls are access control mechanisms, and like all access controls, they can be tested. During an authorized engagement, your goal is to identify weaknesses in the paywall implementation so the client can harden them. Every bypass technique here corresponds to a specific implementation flaw. I'll walk through how paywalls work, then methodically break each type.

An IP leak is any scenario where your real IP address is exposed to a target, observer, or adversary when you intended it to be hidden. For pentesters and red teamers, this is catastrophic — it burns your infrastructure, potentially exposes your firm, and in worst cases can lead to the target retaliating against your real network. Here's a comprehensive breakdown of every leak vector and how to close it.

These three operating systems are often mentioned together but they solve fundamentally different problems. Tails is for transient anonymous sessions. Whonix is for persistent anonymous infrastructure. Qubes is for long-term security compartmentalization. Picking the wrong one for your threat model is dangerous. Here's how they compare across every meaningful dimension.

Tails OS (The Amnesic Incognito Live System) is a Debian-based live operating system that forces all internet connections through the Tor network and leaves no trace on the host computer. It boots entirely from a USB stick or DVD, runs in RAM, and wipes itself clean on shutdown. Every session starts fresh — zero persistence by default, zero forensic footprint.

Whonix is an anonymity-focused operating system built on a split-VM architecture: every installation consists of two virtual machines — the Whonix-Gateway and the Whonix-Workstation — that work together to enforce all traffic through Tor with zero chance of DNS or IP leaks.

The Packet Squirrel Mark II is a matchbook-sized Ethernet implant that sits inline between a target device and the network. Packets go in one RJ45 port and out the other — what happens in between is entirely up to your payload. It's a full Linux box running OpenWrt with a 4-way physical payload-select switch, DuckyScript support, VPN (OpenVPN + WireGuard), Cloud C2 remote access, and 20+ new low-level network manipulation commands over the original model.

This is the top-tier, fixed-installation WiFi auditing platform from Hak5. Where the Mark VII is a portable companion and the Pager is a pocketable tool, the Enterprise is a 1U rack-mountable device built for permanent deployments, large-scale operations, and the most demanding RF environments. It's designed to stay plugged into AC power and Ethernet and run continuously.

Here's a(n) article / guide to change / spoof your MAC address across different operating systems.

IP discovery is a core recon technique. Here are all the methods, from passive OSINT to active network attacks. This article/guide is on how to find someone's IP Address.

Let me be direct: running a game server hosting business off a NAS is like trying to run a food truck out of a dorm room mini-fridge. It can work for very specific, lightweight scenarios, but there are hard technical and business limitations you need to understand before sinking time or money into this. This is a guide on renting game servers from NAS Servers.

A NAS is not the ideal platform for renting game servers commercially. While some powerful NAS devices can run containers or virtual machines, they are generally designed for storage, not for hosting multiple game servers with paying customers. This is a guide on renting out video game servers using NAS servers.

Here's how to set up a NAS server, framed for pentest operations — whether it's for exfiltration staging, payload hosting, or as a target for security assessment. This is a guide on how to set up a NAS server for hacking.

Here's the complete guide to building your own VPN for pentesting — from quick WireGuard tunnels to full multi-hop infrastructure. This is a guide on how to build your own VPN for hacking.

Here's the full bait-and-switch attack methodology, covering all three major variants: network evil twin, physical device swap, and web-based redirection. This is a guide on how to perform a "Bait and Switch" attack.

GPG is a core pentest tool — for encrypted comms with clients, secure submission of findings, and authenticating your identity on darknet forums. Here's the operational guide on how to send messages using PGP encryption.

Aerial wardriving gives you a 3D signal propagation map that ground surveys can't produce. WiFi signals bleed upward through windows, roof vents, and atriums. Rooftop APs and point-to-point bridges are invisible from the parking lot but wide open from 100 meters up. This is advanced physical-layer recon and it's incredibly effective when authorized. This is a guide on how to aerial warflying / wardriving works.

The term "dark web" in pentesting usually means Tor onion services, plus sometimes I2P and other overlay networks. This is how to actually find and navigate .onion services safely during an engagement. This is a guide on how to access the dark web.

Parking barriers and gate remotes are one of the most reliable Sub-GHz wins in physical pentesting. Most systems are fixed-code or use weak rolling codes, and the Flipper handles them cleanly. Here's a guide on hacking parking barriers & gates with the Flipper Zero.