~/tag/blue-team
4 articles tagged blue team
The webshell is the cockroach of offensive security: one line of code, arbitrary command execution, and still everywhere. A deep dive into what webshells are, how attackers plant and use them, how red and blue teams both put them to work, plus a hands-on Docker lab where you build a vulnerable app, drop a shell, use it, and then detect and defend against it three different ways.
AI automation quietly became critical infrastructure that security never signed off on. A deep look at where automation actually is in 2026, the real differences between Zapier, Make, and n8n, when to reach for each, and why every one of them is a beautiful new attack surface: standing credentials, unauthenticated webhooks, shadow automation, and prompt injection into agents that hold tools.
A hands-on Impacket tutorial for beginners: build a lab, then walk Kerberoasting, AS-REP roasting, secretsdump/DCSync, and remote execution end to end — with the red team, blue team, and attacker view of each, plus the exact Windows event IDs that detect them and the controls that stop them.
Build a lab Active Directory domain, collect it with SharpHound, and use BloodHound CE to find the permission chains that lead to Domain Admin — plus how red teams, blue teams, and real attackers each use it, and how to detect and dismantle the paths.