Sharing notes from my ongoing learning journey — what I build, break and understand along the way.
Static vs Dynamic Malware Analysis When I first got into malware analysis, it seemed a bit overwhelming. I imagined I’d need to be some kind of reverse engineering wizard fluent in assembly. But what helped me get started was learning…
Identifying WordPress Plugin Vulnerabilities Using SearchSploit When maintaining a WordPress site, we often focus on keeping the core up to date. However, the real risk may lie within third-party plugins. In this post, I’ll demonstrate how to use SearchSploit, a…
Simulating WordPress Brute-Force Attacks with Hydra – Full Lab Walkthrough In this post, I’ll walk through how to simulate a brute-force login attack on a WordPress installation using Hydra, a powerful and flexible password-cracking tool. This was done in a…
Scanning WordPress with WPScan – A Realistic Pentest Walkthrough In this post, I’ll walk through how I used WPScan to assess a WordPress installation in a controlled pentest lab environment. The goal? Understand what WPScan reveals, identify common WordPress misconfigurations,…
Post 2 – Adding a Real Target to Your Pentest Lab: WordPress Site Setup After setting up the core of my pentesting lab, I wanted a real target to practice on. For that, I cloned my own WordPress site and…
Build Your Own Pentest Lab (No Experience Needed) I’ve always wanted a safe, realistic place to test out security tools — one where I could try things without risking any production systems or breaking anything live. This week, I finally…