What Is That Process Touching? Finding the Files a Running Process Uses on Linux, macOS, and Windows
Manny FernandezA practitioner guide to executables, libraries, mapped files, handles, and sockets, with the exact commands for all three operating systems....
Read More
Graylog Open 7.1 on Ubuntu 24.04: Install and Configure a Core Cluster
Manny FernandezExecutive Summary Objective Stand up a working Graylog Open 7.1 Core cluster (Graylog + MongoDB on one node, Data Node...
Read More
Deepfake Readiness: 16 Best Practices to Stop a Cloned Voice From Moving Money or Access
Manny FernandezThe Tuesday Afternoon Call It is a quiet Tuesday afternoon. The HR director's video flickers to life on Zoom, or...
Read More
TLS 1.0 vs 1.1 vs 1.2 vs 1.3: What Actually Changed and What to Disable Today
Manny FernandezA practitioner breakdown of every TLS version: handshakes, cipher suites, the attacks that killed the old ones, and the exact...
Read More
Windows Event Types for Forensic Investigations
Manny FernandezThe event IDs, log channels, and audit settings that actually solve cases In this post Executive Summary How Windows Event...
Read More
Anatomy of a SQL Injection Attack “SQLi”
Manny FernandezAnatomy of a SQL Injection Attack Executive Summary Objective: Walk a SQL injection (SQLi) attack from first probe to...
Read More
FortiGate ACME Beyond Let’s Encrypt: ZeroSSL, Sectigo, and Internal step-ca
Manny Fernandez1. Title and Executive Summary Objective: Configure a FortiGate to enroll and auto-renew its public-facing certificate from an ACME certificate...
Read More
The 47-Day Certificate: The Whole Industry Is Going Let’s Encrypt’s ACME Model
Manny FernandezTL;DR Every public CA is moving to the Let's Encrypt model: short-lived TLS certificates renewed automatically, usually over ACME. The...
Read More
Every Type of Mass Storage, Explained: HDD, SSD, Tape, Optical, and Beyond
Manny FernandezExecutive Summary Objective: Give practitioners one reference that covers every major class of mass storage in use today: how each...
Read More
Essential Cybersecurity Acronyms: The Practitioner’s Decoder Ring
Manny Fernandez27 acronyms you will hear in every SOC standup, vendor pitch, and audit meeting, explained in plain language with the...
Read More
auditd on Linux: Install, Configure, and Actually Use the Linux Audit Framework
Manny FernandezExecutive Summary Objective: Deploy the Linux Audit Framework (auditd) on Ubuntu Server 24.04 LTS and RHEL 9 family hosts, build...
Read More
Quick Tip: FortiConverter Route File Format for Importing Static Routes from an ASA firewall
Manny FernandezFor those that may not know, Fortinet has a product named FortiConverter that will get a config file from a...
Read More
Logcheck on Linux: How to Install It, Configure It, and Run It
Manny FernandezExecutive Summary Objective: Deploy logcheck on a Debian or Ubuntu server so that every hour it reads the new log...
Read More
Ettercap in 2026: ARP Poisoning, DNS Spoofing, and Content Filtering on the LAN
Manny FernandezEttercap in 2026: ARP Poisoning, DNS Spoofing, and Content Filtering on the LAN Executive Summary Objective. Stand up ettercap in...
Read More
Trivy on macOS: Install It, Verify It, Run It
Manny FernandezWhat Trivy Is and Why You Want It Trivy is Aqua Security's open source, all-in-one scanner: one binary that finds...
Read More
Red Team Tool Series: Six DNS Recon Utilities Every Practitioner Should Own
Manny FernandezExecutive Summary Objective: Give you a working reference for six classic DNS reconnaissance and auditing utilities. For each tool you...
Read More
Blue Team Tool Series: “arpwatch” on Ubuntu 24.04: Layer 2 Change Detection That Still Earns Its Keep
Manny FernandezExecutive Summary ARP has no authentication. Any host on a broadcast domain can claim any IP address, and every neighbor...
Read More
Blue Team Tool Series: Logwatch Deep Dive: Turning /var/log Noise Into a Daily Security Briefing
Manny Fernandez1. Executive Summary Every Linux box you own is writing a diary nobody reads. auth.log, syslog, secure, mail.log, the journal:...
Read More
Red Team Tool Series: “tcpflow” Read the Conversation, Not the Packets
Manny FernandezExecutive Summary tcpdump shows you packets. Most of the time, what you actually care about is what the two endpoints...
Read More
How HTTPS Works: From ClientHello to Encrypted GET
Manny FernandezA practitioner walk-through of DNS, TCP, TLS 1.3, certificates, and the record layer, with the commands to watch every step...
Read More
