This is my first writeup of a capture-the-flag (CTF) challenge. I started one at BSidesLeeds 2018 but never managed to get to the flag. While I didn't get to the end, I did enjoy the journey it took me on. At work recently I have been deeply involved…
Just a quick note to myself on how to setup Putty defaults for my linking using PowerShell commands to set the appropriate registry keys # Create the 'Default Settings' registry key if it doesn't exist if (-not (Test-Path -Path HKCU:\Software\SimonTatham\PuTTY\Sessions\Default%20Settings)) {New-Item…
Having moved my blog to Ghost I lost a comments section for each post. This was functionality which was built into Blogger (my previous blogging platform) as a standard option, and I wanted to get it back The Ghost platform focuses primarily on the ease of creating the article, and…
This is how I think you can patch a large Windows Server estate on a regular basis balancing the needs of Infosec and a risk adverse corporation. Background In my wanderings round the internet, I've seen articles suggesting you should turn off Windows Update because of the latest…
This is how I stood up a blog platform for free using the open source Ghost software running on a free-tier Google Cloud Platform (GCP) compute instance Background For some time now I've been wanting to move my blog off the Blogger platform and something else for these…
Like many, I have a few domain names. One thecavedb.com [https://www.thecavedb.com] is registered with Amazon Web Services and their Route53 product. I did this back in October 2017 as a bit of a 'toe-in-the-water' type of affair to see how it would work. I…
A quick post, for my reference You have a physical server with a HBA & LUNs presented from a SAN. What's the WWN of a specific LUN? PS> (Get-WMIObject -Namespace root\wmi -Class mpio_disk_info).DriveInfo | Select-Object Name, SerialNumber The "SerialNumber" is the WWN.…
Assuming you've already got AD object auditing turned on, the following XML XPath filter can filter the Security log of a DC to only return the events related to AD GPO changes <QueryList> <Query Id="0" Path="Security"> <Select…