$ ls ./lab
Lab
Security writeups, cert prep notes, and the occasional CTF, eJPT and Security+ SY0-701 in flight. Tagged with #writeup, #ejpt, #secplus, #htb, #tryhackme.
4 min readWhat actually happens when a small site gets hacked
Small sites get hacked by scripts scanning for outdated software, not by people choosing targets. Here is what actually happens, from spam injection to the Google blocklist to the cleanup.
- #security
- #small-business
- #wordpress
- #websites
4 min readTwo-factor authentication, explained plainly
SMS codes, app codes, and hardware keys, ranked honestly, plus the three accounts to lock down first.
- #security
- #2fa
- #passwords
- #small-business
4 min readWhat is a YubiKey and should you get one?
A hardware key is the only common form of 2FA that a fake login page cannot beat. Here is what it fixes, what it does not, and why you should buy two or none.
- #security
- #2fa
- #yubikey
- #gear
4 min readThreat, vulnerability, risk: get the vocabulary straight
Threat, vulnerability, and risk are three different words, and exam questions are written to catch people who blur them. A broken door lock sorts them out in about a minute.
- #security-plus
- #sy0-701
- #study-notes
4 min readUpdates are a security feature, not an annoyance
Once a security patch is published, attackers scan for everyone who has not installed it. Here is what to auto-update and a 15-minute monthly checklist for the rest.
- #security
- #updates
- #patching
- #small-business
3 min readOne question a day beats a weekend cram
Cramming feels productive and fades in a week. One exam question a day, protected by a streak, is how I keep Security+ and eJPT material warm between real study sessions.
- #security-plus
- #ejpt
- #study-habits
- #streaks
3 min readWhat a security audit looks like for a small site
The exact five things I check on every small business site: headers, forms, admin panels, old software, and leaked keys. Plus what a finding looks like in plain words.
- #security
- #audit
- #small-business
- #web
3 min readUUIDs vs auto-increment IDs
Sequential IDs let strangers guess your URLs and chart your growth. Here is when UUIDs earn their ugliness and when a plain serial column is honestly fine.
- #databases
- #postgres
- #uuid
- #security
4 min readA test-day checklist for your first cert exam
What goes in a first-timer's test-day checklist: online proctor vs test center, the ID and room rules, flag-and-move pacing, and the energy dip at question 40.
- #security-plus
- #ejpt
- #certifications
- #study-tips
4 min readPublic wifi: what I actually worry about
HTTPS killed most of the old public wifi attacks. Here is what still worries me: evil twin networks, fake captive portals, and the person sitting behind you.
- #security
- #wifi
- #vpn
- #threat-model
3 min readSubnetting without tears
Subnetting on exams comes down to one mental model and two question types. Here is the finger-counting method I use while studying for Security+ and eJPT.
- #subnetting
- #security-plus
- #ejpt
- #networking
4 min readPhishing tests you can run on yourself
Four free drills you can run on your own inbox: hover the link, read the sender domain out loud, spot the urgency tell, and verify invoices by phone. The goal is a two-second pause.
- #phishing
- #security
- #small-business
4 min readA Security+ study plan that fits around a job
My real SY0-701 routine around client work: a daily question, flashcards in dead time, weekend labs, and the exam objectives PDF as the only syllabus.
- #security-plus
- #sy0-701
- #study-plan
- #certifications
4 min readA password manager is the best hour you will spend on security
Reused passwords are how small businesses actually lose accounts, not exotic hacks. One hour with a password manager closes the biggest hole, if you set up the recovery plan too.
- #security
- #passwords
- #password-manager
- #small-business
4 min readThe ports and protocols actually worth memorizing
About twenty ports cover almost every Security+ and eJPT question. Here is the short list, the memory hooks that made them stick for me, and why understanding beats rote for the rest.
- #security-plus
- #ejpt
- #networking
- #studying
4 min readThe OWASP Top Ten in plain English
All ten OWASP categories in one honest sentence each, with examples that could happen to a real shop on Main Street. No jargon walls.
- #owasp
- #security
- #small-business
- #web-basics
4 min readJWTs explained by decoding one
I take a real JWT apart piece by piece: header, payload, signature. What the signature actually proves, and why the payload is readable by anyone with no key at all.
- #jwt
- #security
- #web-dev
- #tutorial
4 min readLab time vs book time for eJPT
eJPT rewards hands-on enumeration reps, not reading. Here is my Kali VM setup, what one lab session looks like, and the note format that actually survives the exam.
- #ejpt
- #study
- #kali
- #notes
4 min readThe padlock proves less than you think
The padlock only proves the connection is encrypted, not that the site is honest. Phishing sites have it too, and your site still needs it anyway.
- #https
- #tls
- #phishing
- #security
4 min readHashing vs encryption: the difference that matters
Encryption is reversible and hashing is not, and that one difference decides how passwords should be stored. It also explains why a site that can email you your old password is a problem.
- #security
- #hashing
- #encryption
- #passwords
4 min readHow I take notes for technical certs
My Security+ and eJPT note system: plain Markdown files, own-words summaries, an explain-it-to-a-client test, and a weekly pass that turns notes into flashcards.
- #security-plus
- #ejpt
- #study-habits
- #notes
4 min readHow I handle client credentials without losing sleep
Client passwords should not live in a text thread. Here is my four-rule system: one vault, no secrets over email or SMS, least access, and a real offboarding step when the project ends.
- #security
- #passwords
- #credentials
- #small-business
4 min readFlashcards vs practice exams: what actually sticks
Flashcards build recall, practice exams build stamina and judgment. Here is how I split them while studying for Security+ and eJPT, and the streak habit that keeps me consistent.
- #security-plus
- #ejpt
- #flashcards
- #study
4 min readYour business email should be on your own domain
A free gmail address costs a local business trust, invites spoofing, and walks out the door when staff leave. Here is the case for email on your own domain, and what it honestly costs.
- #security
- #dmarc
- #local-business
3 min readBackup gear for a small business that fits in a drawer
The whole backup kit for a one-laptop business: an SSD for the daily copy, two rotating hard drives, a go-bag flash drive, and cloud as the third leg. It all fits in a drawer.
- #backups
- #gear
- #small-business
- #security
4 min readBase64 is not encryption
Base64 reverses in one line with no key. Here is what encoding is actually for, how to decode it on sight, and the ways people get burned treating it as protection.
- #base64
- #encoding
- #security
- #web-dev
4 min readeJPT vs Security+: which one first?
I am studying Security+ SY0-701 and eJPT at the same time. Here is what each one actually proves, what they cost, and how to pick if you can only afford one.
- #security-plus
- #ejpt
- #certifications
- #study
4 min readBackups: the boring thing that saves you
The 3-2-1 backup rule scaled down for a one-location business. What to save, what to skip, and why automation beats memory.
- #backups
- #security
- #small-business
5 min readeJPT prep, my enumeration checklist
A practical first pass for any box: what I check before I touch a single exploit. Notes from eJPT prep.
- #writeup
- #ejpt
- #security
- #enumeration
- #lab
5 min readThe CIA triad, explained simply
Confidentiality, Integrity, Availability. Three letters that decide your security strategy.
- #secplus
- #cybersecurity
- #fundamentals
5 min readWhy I'm learning Burp Suite (and you should too)
A web proxy is to a web pentester what a debugger is to a developer.
- #burp
- #cybersecurity
- #tools
- #ejpt
5 min readThe nmap commands I keep forgetting
Five flags I've had to look up more than once. Saving them here so I stop.
- #nmap
- #ejpt
- #cybersecurity
- #cheatsheet
5 min readeJPT Day 1: Kali in a VM
Setting up the lab. UTM on Mac, virt-manager on Linux, VirtualBox if you must.
- #ejpt
- #kali
- #cybersecurity