When speed becomes strategy 💨
When constant speed and firefighting stop being healthy in founder-led startups: how to tell what actually matters when everything feels urgent, how to spot the warning signs early, and when to reconsider staying.
Posts
Solving the Openfire Lab Blue team challenge
A blue-team walkthrough of the CyberDefenders Openfire challenge using Wireshark and Zui: recovering the CSRF token and credentials, tracing the malicious plugin upload and reverse shell, and identifying the exploited CVE.
Solving the ShadowCitadel Lab Blue team challenge
A host-based forensics walkthrough of the ShadowCitadel challenge: following the attack from a malicious email attachment through a PowerShell downloader and second-stage executable to the C2 beacon IP and persistence mechanisms.
How to prevent token misuse in LLM integrations
Preventing prompt injection and token abuse in LLM integrations: a Chrome-extension example attack, then defenses including input validation, narrow prompts, output filters, token limits, rate limiting, and LangChain for pre/post-processing and usage tracking.
Solving the XLMRat Blue team challenge
A blue-team walkthrough of the CyberDefenders XLMRat challenge: tracing the first-stage download URL and hosting provider from the PCAP, hashing the loader and executable payloads, and identifying the malware family and the LOLBin used for stealthy execution.
A pint with Jimothy: on fear, ego, and hiring smarter
A reconstructed conversation with an engineering manager who hesitates to hire a candidate sharper than himself, on the fear and ego behind hiring calls, and why hiring people stronger than you is the smarter move.
Billion-dollar brains: the real cost of AI
The hidden cost behind AI-assisted coding: the GPUs, power, and data-center infrastructure that make it work, whether current pricing reflects real demand, why providers lose money at scale, and what that means for you.
Solving the BlueSky Ransomware Blue team challenge
A blue-team walkthrough of the CyberDefenders BlueSky ransomware challenge: analyzing the PCAP to find the port-scan source IP, the targeted account, C2 process injection, the downloaded payload, and the registry keys used to disable Windows Defender.
When Slack starts to feel like a DDoS attack
Borrowing “exponential back-off” from networking to handle communication overload as an engineering lead: how to triage the constant stream of Slack pings, reviews, and requests with informal priority classes and respond with intention.
Solving the DanaBot Blue team challenge
A blue-team walkthrough of the CyberDefenders DanaBot challenge: using PCAP and threat intel to trace the initial-access IP, identify the malicious files and their SHA-256/MD5 hashes, and the process used to execute the banking trojan.