Intermediate Security
How to Check a Plex Server for Compromise
How to check a Plex server for compromise after Plex2Shell: confirm the build, then inspect processes, the Codecs folder, Preferences.xml and outbound traffic.
Start learning
Knowledge Base
Learn Guides — Page 4
Showing 24 of 362 guides. Use the numbered pages to browse the complete archive.
Beginner Security
What Is Proxyware and Why Attackers Install It
What is proxyware? Software that sells your internet connection as an exit node for other people's traffic. How it works, what it costs and how to spot it.
Start learning
Intermediate Security
Why Vulnerability Chaining Beats CVSS Scores in Triage
Vulnerability chaining turns several medium CVEs into one critical attack. Why per-CVE CVSS triage misses it and how to rank chained flaws instead.
Start learning
Intermediate Security
How to Check for Nextcloud Web Shells and Clean Up
How to check for Nextcloud web shells: inventory apps with occ, run integrity checks, find unexpected PHP files, search access logs, then rotate secrets.
Start learning
Beginner Security
What Is a Web Shell and How Does It Get on a Server?
What is a web shell? A small script that lets attackers run commands through HTTP requests. How it gets on a server, why it survives patching, how to find it.
Start learning
Intermediate Security
Why Your Web Server Account Should Not Read Your Secrets
Web exploits land as the web server account, so everything it can read is exposed. Why limiting its reach contains breaches and covers unpatched bugs.
Start learning
Intermediate Security
How to Clean a Backdoored WordPress Site After a Bad Plugin
How to clean a backdoored WordPress site: restore a pre-compromise backup, remove the plugin, hunt persistence, rotate credentials, then reinstall.
Start learning
Beginner Security
What Is a Trojanized Software Update?
A trojanized software update is a real vendor release altered to carry malware. How it gets in, why it beats normal controls, and how to detect one.
Start learning
Intermediate Security
Why Premium WordPress Plugin Updates Need Their Own Controls
Premium WordPress plugin updates skip the repository's checks. Why paid plugins need staging, inventory, egress limits and vendor review of their own.
Start learning
Intermediate Security
How to Detect Firewall Logging Gaps That Hide an Intrusion
How to detect firewall logging gaps: baseline each device, alert on silence per log type, and cross-check against flow data, SNMP and auth server logs.
Start learning
Beginner Security
What Is Memory-Resident Malware on a Network Appliance?
Memory-resident malware runs only in RAM inside legitimate processes. Why it is hard to find on firewalls and VPN appliances, and what evidence it leaves.
Start learning
Intermediate Security
Why a Firewall Manager Compromise Exposes Every Device
A firewall manager compromise hands attackers every managed device's configs, credentials and keys. Why patching is not enough, and how to plan the response.
Start learning
Intermediate Security
How to Audit Remote Support Logs for Role Escalation
How to audit remote support logs after a compromise: off-appliance sources, role changes, admin logins, odd request paths, log gaps and file transfers.
Start learning
Beginner Security
What Is a Remote Support Appliance and What Can It Reach?
A remote support appliance brokers help desk sessions and holds agents, roles and stored credentials for every endpoint it can reach. Here is what is inside.
Start learning
Intermediate Security
Why Rebuild Before You Rotate Credentials After a Breach
Rotate credentials after a breach only once the compromised system is rebuilt, or the attacker captures every new secret. The right order and what to include.
Start learning
Intermediate Security
How to Use Patch Deployment Rings for a Windows Zero-Day
Patch deployment rings for a zero-day: patch the users attackers reach first, advance on written criteria, and verify coverage with two signals.
Start learning
Beginner Security
What Is Mark of the Web? How Windows Tags Downloads
What is Mark of the Web? It is the zone tag Windows writes on downloaded files so Office, SmartScreen and Protected View know to warn or block.
Start learning
Intermediate Security
Why Security Feature Bypass Bugs Deserve Emergency Patching
A security feature bypass switches off a protection instead of running code. Once exploited, it belongs on the emergency patch track, not later.
Start learning
Intermediate Security
How to Restrict Firewall Management Access to a Jump Box
Restrict firewall management access to a single hardened jump box: inventory interfaces, allow one source, test from the wrong places.
Start learning
Intermediate Security
What CVSS Privileges Required Means for Patch Triage
CVSS privileges required records the access an attacker needs first. Learn why a PR:H score still demands urgent patching once exploited.
Start learning
Intermediate Security
Why Exploited Admin-Only Bugs Demand a Firewall Admin Audit
An exploited admin-only flaw means someone held admin access. Run a firewall admin audit covering accounts, MFA, logins and config changes.
Start learning
Intermediate Security
How to Contain Active Directory Exposure After a VPN Appliance Is Compromised
A compromised VPN gateway can leak its directory credentials and everything they could read. A step-by-step order for rotating secrets without tipping off or locking out.
Start learning
Intermediate Security
What an Appliance's LDAP Service Account Can Read in Active Directory
VPN gateways, firewalls and mail appliances bind to Active Directory with a service account. What that account can read is what an attacker gets the day the appliance falls.
Start learning
Intermediate Security
Why a Clean Integrity Check Cannot Clear a Compromised Appliance
Vendor integrity scanners compare files on disk against a known-good list. Attacks that live in memory and restore what they touch leave nothing for those scanners to find.
Start learning