Intermediate Security
How to Forward ESXi Syslog to a Remote Log Server
How to forward ESXi syslog to a remote collector with esxcli or Host Profiles, choose TCP or TLS, and verify the logs actually arrive.
Start learning
Knowledge Base
Learn Guides — Page 3
Showing 24 of 362 guides. Use the numbered pages to browse the complete archive.
Beginner Security
What Is an Insufficient Logging Vulnerability (CWE-778)?
An insufficient logging vulnerability lets actions happen without an audit record. Why CWE-778 scores low on CVSS and how to find these gaps.
Start learning
Intermediate Security
Why Hypervisor Log Retention Must Live Off the Host
Hypervisor log retention fails if logs stay on the host an attacker controls. How to plan off-host storage, retention length and a safe collector.
Start learning
Intermediate Security
How to Find Vulnerable Brotli Copies on Your Systems
How to find vulnerable Brotli copies in Node.js, Python, curl, Envoy, .NET and Linux packages, with the version checks published for CVE-2026-111497.
Start learning
Beginner Security
What Is Brotli Compression and Where Does It Run?
What is Brotli compression? How the HTTP format works, where its decoder hides in runtimes, proxies and packages, and why that matters for security.
Start learning
Intermediate Security
Why Patching Bundled Libraries Takes More Than One Update
Why patching bundled libraries is slow: every product ships its own copy and its own fix. How to plan around it, using the Brotli flaw as the example.
Start learning
Intermediate Security
How to Find Personal Data in Test Environments
A step-by-step way to find personal data in test environments: inventory every copy, scan for real identifiers, then delete, mask or isolate.
Start learning
Intermediate Security
Why Physical Access Control Belongs in Breach Scope
Physical access control systems hold PINs and badge data that open doors. Why breach response must include buildings, and how to plan for it.
Start learning
Beginner Security
What Is Data Masking? Keeping Real Data Out of Test
What is data masking? It swaps real personal data for realistic fakes so test systems stay useful. Techniques, static vs dynamic, and common gaps.
Start learning
Intermediate Networking
How to Restrict Wireless Controller Management Access
How to restrict wireless controller management access with a management VLAN, ACLs, PAPI filtering and logging, then test that the rules hold.
Start learning
Beginner Networking
What Is Aruba PAPI and Why Does It Matter?
Aruba PAPI is the UDP 8211 control protocol between access points and controllers. What it carries, why it is exposed and how to restrict it.
Start learning
Intermediate Networking
Why Firmware Release Trains Matter for Patching
A firmware release train decides whether a critical fix is a quick patch or a migration. How to choose trains and plan around end of maintenance.
Start learning
Intermediate Security
Why Deleting a Leaked API Key From Git Is Not Enough
A leaked API key keeps working until the issuer revokes it. Why force-pushing it out of Git fails, and how to revoke, verify and scope the blast radius.
Start learning
Intermediate Security
How to Pin Python Dependencies With pip Hash Checking
How to pin Python dependencies with exact versions and SHA-256 hashes so pip refuses a poisoned release, plus what hash checking cannot protect against.
Start learning
Beginner Security
What Is a Python .pth File and Why Attackers Use It
A Python pth file runs code every time the interpreter starts. Learn how .pth and sitecustomize hooks work, why attackers abuse them and how to inspect them.
Start learning
Intermediate Security
How to Disable PHP Session Upload Progress Safely
How to disable PHP session upload progress so applications cannot override it, restart every worker, and confirm the change on each PHP site.
Start learning
Intermediate Security
Why End-of-Life PHP Versions Need a Retirement Plan
End of life PHP branches get no official fixes. Why PHP 8.1 and older are a risk, how to inventory them and how to set dated retirement plans.
Start learning
Intermediate Security
mod_php vs PHP-FPM: Which PHP Setup Is Riskier?
mod_php vs PHP-FPM: how each runs PHP, why mod_php was the highest-risk setup for PHP2Shell, and when to move your sites to isolated FPM pools.
Start learning
Intermediate Security
How to Audit Read-Only Accounts on a Management Portal
How to audit read-only accounts on a management portal: export users and API keys, assign owners, remove the unclaimed and review activity.
Start learning
Beginner Networking
What Is an SD-WAN Orchestrator and What Can It Reach?
An SD-WAN orchestrator holds the configuration and credentials for every branch edge. Here is what it controls and why attackers target it.
Start learning
Intermediate Security
Why Repeat Zero-Days in One Product Need a Different Plan
Repeat zero-days in one product mean attackers are studying it. Plan for the next one: contain exposure, assume compromise, weigh replacement.
Start learning
Intermediate Security
How to Preserve Evidence Before Patching a Server
How to preserve evidence before patching an exploited server: vendor diagnostics, snapshots, log copies and hashes, in the order that keeps traces intact.
Start learning
Beginner Security
What Is a Host-Based WAF? Where It Runs and Why It Matters
A host-based WAF runs inside the web server and filters HTTP requests locally. How it differs from a network WAF and why its blast radius is larger.
Start learning
Intermediate Security
Why Vendor Security Advisory Subscriptions Matter
Vendors often warn contract customers before the public. Why your vendor security advisory subscriptions need an owner, and how to close the gaps.
Start learning