diff --git a/assets/images/blog/blog-3.jpg b/assets/images/blog/blog-3.jpg
index 1bded40..a042ca9 100644
Binary files a/assets/images/blog/blog-3.jpg and b/assets/images/blog/blog-3.jpg differ
diff --git a/assets/images/blog/blog-4.jpg b/assets/images/blog/blog-4.jpg
index 38ecab3..2391197 100644
Binary files a/assets/images/blog/blog-4.jpg and b/assets/images/blog/blog-4.jpg differ
diff --git a/assets/images/gallery/project-1.jpg b/assets/images/gallery/project-1.jpg
index ea4990b..887cdc3 100644
Binary files a/assets/images/gallery/project-1.jpg and b/assets/images/gallery/project-1.jpg differ
diff --git a/assets/images/project/project-1.jpg b/assets/images/project/project-1.jpg
index ea4990b..887cdc3 100644
Binary files a/assets/images/project/project-1.jpg and b/assets/images/project/project-1.jpg differ
diff --git a/assets/images/project/project-2.jpg b/assets/images/project/project-2.jpg
index 5258851..9275996 100644
Binary files a/assets/images/project/project-2.jpg and b/assets/images/project/project-2.jpg differ
diff --git a/content/_index.md b/content/_index.md
index 0ec382a..683a1ab 100644
--- a/content/_index.md
+++ b/content/_index.md
@@ -110,7 +110,7 @@ education:
projects:
enable: true
button:
- link: "projects/"
+ link: "project/"
label: "All Projects"
diff --git a/content/blog/_index.md b/content/blog/_index.md
index 5bc70e0..dd06278 100644
--- a/content/blog/_index.md
+++ b/content/blog/_index.md
@@ -1,5 +1,5 @@
---
-title: "Recent Articles"
+title: "Recent Posts"
description: ""
draft: false
----
\ No newline at end of file
+---
diff --git a/content/blog/post-3.md b/content/blog/post-3.md
new file mode 100644
index 0000000..9770938
--- /dev/null
+++ b/content/blog/post-3.md
@@ -0,0 +1,46 @@
+---
+title: "Securing Cyberspace: Belgian Cyber Command at Howest"
+image: "images/blog/blog-3.jpg"
+date: "2024-11-12 00:00:00 +0000 UTC"
+description: "Colonel Gunther Godefridis of Belgian Cyber Command shares insights on cyber defense, digital threats, and national resilience at Howest."
+categories: ["cybersecurity", "event", "defense"]
+draft: false
+---
+
+# Securing Cyberspace: Belgian Cyber Command at Howest
+
+On November 12, we had the opportunity to attend a Tech&Meet session unlike any other. The speaker was **Colonel Gunther Godefridis**, Director for Development & Readiness at Belgian Cyber Command, and the topic: safeguarding our country in the digital domain.
+
+Held at Howest Campus Brugge Station, the event drew students, researchers, and professionals eager to understand how military-grade cybersecurity operations are run, and why they matter more than ever.
+
+#### Defending in the Digital Age
+
+Colonel Godefridis began by outlining the **core mission of Belgian Cyber Command**: protecting Defense’s networks and weapon systems, supporting intelligence operations (ADIV), and conducting defensive and offensive operations in cyberspace. In short, Cyber Command isn’t just watching traffic, it’s **actively shaping Belgium’s digital resilience**.
+
+With society’s increasing reliance on digital infrastructure, the risks of **espionage, disinformation, and attacks on critical systems** are no longer theoretical. Godefridis highlighted the urgency of being able to respond to, not just detect, those threats.
+
+#### Working Together: Academia, Industry, Government
+
+One theme that stood out was **collaboration**. Cyber Command doesn’t operate in a vacuum. It works closely with national agencies, NATO partners, academic institutions, and the private sector. The colonel emphasized that **defending cyberspace requires broad cooperation**, and Belgium’s approach is to engage across domains, military, civil, and industrial.
+
+He also made it clear that this isn’t just about defense systems or classified data. As the line between civil and military digital infrastructure blurs, vulnerabilities in civilian systems can become national security issues. That’s where cooperation becomes essential.
+
+#### Leading with Innovation
+
+With over 20 years in military service, Colonel Godefridis brings a unique perspective. From artillery innovation to defense technology strategy, and now to cyber development, his background reflects the evolving nature of conflict and the military's response.
+
+He discussed how **innovation, including artificial intelligence, is becoming central to cyber defense**. Cyber Command is investing in tools and skills to automate threat detection, analyze large datasets, and simulate attack scenarios. It’s not just about building walls, it’s about **staying several moves ahead**.
+
+#### A Transparent, Human Conversation
+
+The Q&A session at the end made the evening especially memorable. Questions ranged from technical details of cyber defense capabilities to the human side of cyber careers: how people are trained, what skills are valued, and how students might contribute.
+
+Colonel Godefridis was honest about the challenges. Cyber operations evolve quickly, and so do adversaries. But he was equally clear about the opportunity: **Belgium is building a capability that matters, and it needs talent**.
+
+#### Final Thoughts
+
+If you walked into this talk expecting a dry presentation on military infrastructure, you were wrong. This session was a deep, realistic, and engaging look into **how Belgium is preparing for cyber conflict**, and how students like us could be a part of that mission.
+
+Whether you’re in cybersecurity, software development, or systems engineering, there’s a growing role to play. And as Colonel Godefridis made clear: it’s not just a job. It’s part of defending a society that’s more vulnerable, and more connected, than ever before.
+
+{{< notice tip >}}Want to learn more about Cyber Command? Visit the official website at [mil.be](https://www.mil.be/nl/over-defensie/cyber-command/){{}}
diff --git a/content/blog/post-4.md b/content/blog/post-4.md
new file mode 100644
index 0000000..5ec08e2
--- /dev/null
+++ b/content/blog/post-4.md
@@ -0,0 +1,54 @@
+---
+title: "Red Team Talk: Een Blik Achter de Schermen bij Offensive Security"
+image: "images/blog/blog-4.jpg"
+date: "2025-05-20 00:00:00 +0000 UTC"
+description: "In deze aflevering van Red Team Talk spreken studenten Joren Schipman en Mattia Punjwani met Thomas Castronovo, ethical hacker bij Deloitte."
+categories: ["cybersecurity", "podcast", "interview"]
+draft: false
+---
+
+# Red Team Talk: Een Blik Achter de Schermen bij Offensive Security
+
+In deze eerste aflevering van **Red Team Talk** nemen wij, Joren Schipman en Mattia Punjwani, studenten Cybersecurity aan Howest, jullie mee in een gesprek met **Thomas Castronovo**, ethical hacker en consultant bij Deloitte. Samen duiken we in de wereld van offensieve security, red teaming, en de realiteit van een carrière als pentester.
+
+#### Van Interesse tot Loopbaan
+
+Thomas deelt hoe zijn interesse in cybersecurity begon tijdens zijn opleiding, met hands-on projecten zoals het hacken van virtuele machines. Een stage bij Deloitte in 2019 zette hem op het pad naar een voltijdse functie binnen het **Offensive Security Team**. Vandaag werkt hij al drie jaar bij Deloitte België en specialiseert hij zich in offensieve testen.
+
+#### Offensive vs. Defensive Security
+
+Hoewel zijn hart bij offensieve security ligt, kreeg hij recent ook ervaring aan de defensieve kant. Het leverde hem een breder perspectief op: “Het geeft een heel ander zicht op hoe aanvallen eruitzien vanuit de andere kant.” Toch blijft het **red team werk zijn voorkeur** behouden.
+
+#### Wat doet een pentester nu echt?
+
+Thomas legt uit hoe een typische pentest verloopt: van het ontvangen van de scope, over het scannen van het netwerk en het zoeken naar kwetsbaarheden, tot het rapporteren van bevindingen. Tools zoals **Nessus**, **BloodHound** en **PingCastle** worden ingezet, vaak gecombineerd met zelfgebouwde scripts die de output analyseren en structureren.
+
+#### Kwetsbaarheden in Active Directory
+
+Een groot deel van zijn werk focust op **Active Directory (AD)**, waar hij telkens weer dezelfde pijnpunten tegenkomt: legacy-instellingen, onvoldoende gepatchte systemen, en misconfiguraties die vaak pas worden rechtgezet na een echte aanval. Twee voorbeelden die hij aanhaalt:
+
+- **LLMNR/MDNS/NetBIOS poisoning** om credentials te verkrijgen
+- **DNS wildcard records** die leiden tot man-in-the-middle aanvallen
+
+#### Tools, Tips en Oefenen
+
+Voor wie zelf wil beginnen raadt hij aan om zelf een AD op te zetten en tools als PingCastle en BloodHound uit te proberen. De meeste kennis verwerf je volgens Thomas door **zelf te oefenen, dingen stuk te maken, en vooral: blijven proberen**.
+
+#### De Praktijk vs. Certificaten
+
+Hoewel certificaten nuttig zijn (zoals WPT voor webapp testing), benadrukt Thomas dat **de echte leerschool het werkveld is**. “90% van wat ik weet, heb ik geleerd door het gewoon te doen,” zegt hij. Oefenen op Hack The Box, zelf een netwerk opzetten, en leren van collega’s zijn voor hem essentieel.
+
+#### Afsluiter
+
+De aflevering toont hoe breed het vakgebied offensive security is: van interne pentests tot phishingcampagnes, van legacy exploits tot zero-days. Maar vooral: het is een vak waar **creativiteit en nieuwsgierigheid centraal staan**.
+
+
@@ -9508,7 +9822,7 @@
diff --git a/public/blog/index.xml b/public/blog/index.xml
index b780583..82107d3 100644
--- a/public/blog/index.xml
+++ b/public/blog/index.xml
@@ -1,26 +1,40 @@
- Recent Articles on Professors - Personal Portfolio Theme
- http://192.168.90.54:1313/blog/
- Recent content in Recent Articles on Professors - Personal Portfolio Theme
+ Recent Posts on Professors - Personal Portfolio Theme
+ http://localhost:1313/professors/site/blog/
+ Recent content in Recent Posts on Professors - Personal Portfolio ThemeHugoen
- Tue, 13 May 2025 00:00:00 +0000
-
+ Tue, 20 May 2025 00:00:00 +0000
+
+
+ Red Team Talk: Een Blik Achter de Schermen bij Offensive Security
+ http://localhost:1313/professors/site/blog/post-4/
+ Tue, 20 May 2025 00:00:00 +0000
+ http://localhost:1313/professors/site/blog/post-4/
+ <h1 id="red-team-talk-een-blik-achter-de-schermen-bij-offensive-security">Red Team Talk: Een Blik Achter de Schermen bij Offensive Security</h1>
<p>In deze eerste aflevering van <strong>Red Team Talk</strong> nemen wij, Joren Schipman en Mattia Punjwani, studenten Cybersecurity aan Howest, jullie mee in een gesprek met <strong>Thomas Castronovo</strong>, ethical hacker en consultant bij Deloitte. Samen duiken we in de wereld van offensieve security, red teaming, en de realiteit van een carrière als pentester.</p>
+ Cyber Defence on the Digital Frontline: A Mission with NATO
- http://192.168.90.54:1313/blog/post-1/
+ http://localhost:1313/professors/site/blog/post-1/
Tue, 13 May 2025 00:00:00 +0000
- http://192.168.90.54:1313/blog/post-1/
+ http://localhost:1313/professors/site/blog/post-1/<h1 id="cyber-defence-on-the-digital-frontline-a-mission-with-nato">Cyber Defence on the Digital Frontline: A Mission with NATO</h1>
<h4 id="on-a-mission-with-nato-cyber-defence-on-the-frontline">On a Mission with NATO: Cyber Defence on the Frontline</h4>
<p>Howest’s ongoing commitment to world-class cybersecurity training took center stage again as six lecturers from the Cyber Security program joined forces with experts from Latvia, Luxembourg and Belgium in one of NATO’s most intensive simulations: the Locked Shields exercise, hosted by the Cooperative Cyber Defence Centre of Excellence (CCDCOE). Now in its fifth year of participation, the Howest team shared their firsthand experiences at a special evening talk at Howest Bruges.</p>Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience
- http://192.168.90.54:1313/blog/post-2/
+ http://localhost:1313/professors/site/blog/post-2/
Sat, 15 Mar 2025 00:00:00 +0000
- http://192.168.90.54:1313/blog/post-2/
+ http://localhost:1313/professors/site/blog/post-2/<h1 id="reversing-rebuilding-and-failing-better-my-cyber-security-challenge-belgium-qualifier-experience">Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience</h1>
<p>On March 14 and 15, I joined the Cyber Security Challenge Belgium qualifiers with three teammates. For two days, we threw ourselves at CTF challenges covering binary exploitation, Android reversing, cryptography, and more.</p>
+
+ Securing Cyberspace: Belgian Cyber Command at Howest
+ http://localhost:1313/professors/site/blog/post-3/
+ Tue, 12 Nov 2024 00:00:00 +0000
+ http://localhost:1313/professors/site/blog/post-3/
+ <h1 id="securing-cyberspace-belgian-cyber-command-at-howest">Securing Cyberspace: Belgian Cyber Command at Howest</h1>
<p>On November 12, we had the opportunity to attend a Tech&Meet session unlike any other. The speaker was <strong>Colonel Gunther Godefridis</strong>, Director for Development & Readiness at Belgian Cyber Command, and the topic: safeguarding our country in the digital domain.</p>
+
diff --git a/public/blog/post-1/index.html b/public/blog/post-1/index.html
index eb4662d..f84bee7 100644
--- a/public/blog/post-1/index.html
+++ b/public/blog/post-1/index.html
@@ -1,7 +1,7 @@
-
+
Cyber Defence on the Digital Frontline: A Mission with NATO
@@ -28,11 +28,11 @@
-
-
-
-
-
+
+
+
+
+
@@ -41,7 +41,7 @@
-
+
@@ -70,7 +70,7 @@
-
+
@@ -159,8 +159,8 @@
-
-
+
+
@@ -187,7 +187,7 @@
-
+
@@ -271,7 +271,7 @@
-
+
@@ -300,27 +300,27 @@
URLs and URLs in angle brackets will automatically get turned into links.
-http://www.example.com or http://www.example.com and sometimes
-example.com (but not on Github, for example).
-
Some text to show that the reference links can follow later.
-
-
Paragraph
-
Lorem ipsum dolor sit amet consectetur adipisicing elit. Quam nihil enim maxime corporis cumque totam aliquid nam sint inventore optio modi neque laborum officiis necessitatibus, facilis placeat pariatur! Voluptatem, sed harum pariatur adipisci voluptates voluptatum cumque, porro sint minima similique magni perferendis fuga! Optio vel ipsum excepturi tempore reiciendis id quidem? Vel in, doloribus debitis nesciunt fugit sequi magnam accusantium modi neque quis, vitae velit, pariatur harum autem a! Velit impedit atque maiores animi possimus asperiores natus repellendus excepturi sint architecto eligendi non, omnis nihil. Facilis, doloremque illum. Fugit optio laborum minus debitis natus illo perspiciatis corporis voluptatum rerum laboriosam.
You can also use raw HTML in your Markdown, and it’ll mostly work pretty well.
-
-
Definition list
-
Is something people use sometimes.
-
Markdown in HTML
-
Does *not* work **very** well. Use HTML tags.
-
-
-
-
-
-
-
-
-
-
-
Note
-
-
This is a simple note
-
-
+
Securing Cyberspace: Belgian Cyber Command at Howest
+
On November 12, we had the opportunity to attend a Tech&Meet session unlike any other. The speaker was Colonel Gunther Godefridis, Director for Development & Readiness at Belgian Cyber Command, and the topic: safeguarding our country in the digital domain.
+
Held at Howest Campus Brugge Station, the event drew students, researchers, and professionals eager to understand how military-grade cybersecurity operations are run, and why they matter more than ever.
+
Defending in the Digital Age
+
Colonel Godefridis began by outlining the core mission of Belgian Cyber Command: protecting Defense’s networks and weapon systems, supporting intelligence operations (ADIV), and conducting defensive and offensive operations in cyberspace. In short, Cyber Command isn’t just watching traffic, it’s actively shaping Belgium’s digital resilience.
+
With society’s increasing reliance on digital infrastructure, the risks of espionage, disinformation, and attacks on critical systems are no longer theoretical. Godefridis highlighted the urgency of being able to respond to, not just detect, those threats.
+
Working Together: Academia, Industry, Government
+
One theme that stood out was collaboration. Cyber Command doesn’t operate in a vacuum. It works closely with national agencies, NATO partners, academic institutions, and the private sector. The colonel emphasized that defending cyberspace requires broad cooperation, and Belgium’s approach is to engage across domains, military, civil, and industrial.
+
He also made it clear that this isn’t just about defense systems or classified data. As the line between civil and military digital infrastructure blurs, vulnerabilities in civilian systems can become national security issues. That’s where cooperation becomes essential.
+
Leading with Innovation
+
With over 20 years in military service, Colonel Godefridis brings a unique perspective. From artillery innovation to defense technology strategy, and now to cyber development, his background reflects the evolving nature of conflict and the military’s response.
+
He discussed how innovation, including artificial intelligence, is becoming central to cyber defense. Cyber Command is investing in tools and skills to automate threat detection, analyze large datasets, and simulate attack scenarios. It’s not just about building walls, it’s about staying several moves ahead.
+
A Transparent, Human Conversation
+
The Q&A session at the end made the evening especially memorable. Questions ranged from technical details of cyber defense capabilities to the human side of cyber careers: how people are trained, what skills are valued, and how students might contribute.
+
Colonel Godefridis was honest about the challenges. Cyber operations evolve quickly, and so do adversaries. But he was equally clear about the opportunity: Belgium is building a capability that matters, and it needs talent.
+
Final Thoughts
+
If you walked into this talk expecting a dry presentation on military infrastructure, you were wrong. This session was a deep, realistic, and engaging look into how Belgium is preparing for cyber conflict, and how students like us could be a part of that mission.
+
Whether you’re in cybersecurity, software development, or systems engineering, there’s a growing role to play. And as Colonel Godefridis made clear: it’s not just a job. It’s part of defending a society that’s more vulnerable, and more connected, than ever before.
@@ -686,233 +570,19 @@ example.com (but not on Github, for example).
fill="currentColor" />
Tip
-
This is a simple note
+
Want to learn more about Cyber Command? Visit the official website at mil.be
-
-
-
-
-
-
-
-
Info
-
-
This is a simple note
-
-
-
-
-
-
-
-
-
-
-
Warning
-
-
This is a simple note
-
-
-
-
Tables
-
Colons can be used to align columns.
-
-
-
-
Tables
-
Are
-
Cool
-
-
-
-
-
col 3 is
-
right-aligned
-
$1600
-
-
-
col 2 is
-
centered
-
$12
-
-
-
zebra stripes
-
are neat
-
$1
-
-
-
-
There must be at least 3 dashes separating each header cell.
-The outer pipes (|) are optional, and you don’t need to make the
-raw Markdown line up prettily. You can also use inline Markdown.
URLs and URLs in angle brackets will automatically get turned into links.
-http://www.example.com or http://www.example.com and sometimes
-example.com (but not on Github, for example).
-
Some text to show that the reference links can follow later.
-
-
Paragraph
-
Lorem ipsum dolor sit amet consectetur adipisicing elit. Quam nihil enim maxime corporis cumque totam aliquid nam sint inventore optio modi neque laborum officiis necessitatibus, facilis placeat pariatur! Voluptatem, sed harum pariatur adipisci voluptates voluptatum cumque, porro sint minima similique magni perferendis fuga! Optio vel ipsum excepturi tempore reiciendis id quidem? Vel in, doloribus debitis nesciunt fugit sequi magnam accusantium modi neque quis, vitae velit, pariatur harum autem a! Velit impedit atque maiores animi possimus asperiores natus repellendus excepturi sint architecto eligendi non, omnis nihil. Facilis, doloremque illum. Fugit optio laborum minus debitis natus illo perspiciatis corporis voluptatum rerum laboriosam.
-
-
Ordered List
-
-
List item
-
List item
-
List item
-
List item
-
List item
-
-
-
Unordered List
+
Red Team Talk: Een Blik Achter de Schermen bij Offensive Security
+
In deze eerste aflevering van Red Team Talk nemen wij, Joren Schipman en Mattia Punjwani, studenten Cybersecurity aan Howest, jullie mee in een gesprek met Thomas Castronovo, ethical hacker en consultant bij Deloitte. Samen duiken we in de wereld van offensieve security, red teaming, en de realiteit van een carrière als pentester.
+
Van Interesse tot Loopbaan
+
Thomas deelt hoe zijn interesse in cybersecurity begon tijdens zijn opleiding, met hands-on projecten zoals het hacken van virtuele machines. Een stage bij Deloitte in 2019 zette hem op het pad naar een voltijdse functie binnen het Offensive Security Team. Vandaag werkt hij al drie jaar bij Deloitte België en specialiseert hij zich in offensieve testen.
+
Offensive vs. Defensive Security
+
Hoewel zijn hart bij offensieve security ligt, kreeg hij recent ook ervaring aan de defensieve kant. Het leverde hem een breder perspectief op: “Het geeft een heel ander zicht op hoe aanvallen eruitzien vanuit de andere kant.” Toch blijft het red team werk zijn voorkeur behouden.
+
Wat doet een pentester nu echt?
+
Thomas legt uit hoe een typische pentest verloopt: van het ontvangen van de scope, over het scannen van het netwerk en het zoeken naar kwetsbaarheden, tot het rapporteren van bevindingen. Tools zoals Nessus, BloodHound en PingCastle worden ingezet, vaak gecombineerd met zelfgebouwde scripts die de output analyseren en structureren.
+
Kwetsbaarheden in Active Directory
+
Een groot deel van zijn werk focust op Active Directory (AD), waar hij telkens weer dezelfde pijnpunten tegenkomt: legacy-instellingen, onvoldoende gepatchte systemen, en misconfiguraties die vaak pas worden rechtgezet na een echte aanval. Twee voorbeelden die hij aanhaalt:
-
List item
-
List item
-
List item
-
List item
-
List item
+
LLMNR/MDNS/NetBIOS poisoning om credentials te verkrijgen
+
DNS wildcard records die leiden tot man-in-the-middle aanvallen
You can also use raw HTML in your Markdown, and it’ll mostly work pretty well.
-
-
Definition list
-
Is something people use sometimes.
-
Markdown in HTML
-
Does *not* work **very** well. Use HTML tags.
-
-
-
-
-
-
-
-
-
-
-
Note
-
-
This is a simple note
+
Tools, Tips en Oefenen
+
Voor wie zelf wil beginnen raadt hij aan om zelf een AD op te zetten en tools als PingCastle en BloodHound uit te proberen. De meeste kennis verwerf je volgens Thomas door zelf te oefenen, dingen stuk te maken, en vooral: blijven proberen.
+
De Praktijk vs. Certificaten
+
Hoewel certificaten nuttig zijn (zoals WPT voor webapp testing), benadrukt Thomas dat de echte leerschool het werkveld is. “90% van wat ik weet, heb ik geleerd door het gewoon te doen,” zegt hij. Oefenen op Hack The Box, zelf een netwerk opzetten, en leren van collega’s zijn voor hem essentieel.
+
Afsluiter
+
De aflevering toont hoe breed het vakgebied offensive security is: van interne pentests tot phishingcampagnes, van legacy exploits tot zero-days. Maar vooral: het is een vak waar creativiteit en nieuwsgierigheid centraal staan.
+
+
-
-
-
-
-
-
-
-
-
Tip
-
-
This is a simple note
-
-
-
-
-
-
-
-
-
-
-
Info
-
-
This is a simple note
-
-
-
-
-
-
-
-
-
-
-
Warning
-
-
This is a simple note
-
-
-
-
Tables
-
Colons can be used to align columns.
-
-
-
-
Tables
-
Are
-
Cool
-
-
-
-
-
col 3 is
-
right-aligned
-
$1600
-
-
-
col 2 is
-
centered
-
$12
-
-
-
zebra stripes
-
are neat
-
$1
-
-
-
-
There must be at least 3 dashes separating each header cell.
-The outer pipes (|) are optional, and you don’t need to make the
-raw Markdown line up prettily. You can also use inline Markdown.
@@ -9355,7 +9355,7 @@
diff --git a/public/categories/ctf/index.xml b/public/categories/ctf/index.xml
index 64336a8..7fd20f5 100644
--- a/public/categories/ctf/index.xml
+++ b/public/categories/ctf/index.xml
@@ -2,18 +2,18 @@
CTF on Professors - Personal Portfolio Theme
- http://192.168.90.54:1313/categories/ctf/
+ http://localhost:1313/professors/site/categories/ctf/
Recent content in CTF on Professors - Personal Portfolio ThemeHugoenSat, 15 Mar 2025 00:00:00 +0000
-
+
- From Android Reversing to Broken TLS: My Experience at the Cyber Security Challenge Belgium Qualifiers
- http://192.168.90.54:1313/blog/post-2/
+ Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience
+ http://localhost:1313/professors/site/blog/post-2/
Sat, 15 Mar 2025 00:00:00 +0000
- http://192.168.90.54:1313/blog/post-2/
- <h1 id="from-android-reversing-to-broken-tls-my-experience-at-the-cyber-security-challenge-belgium-qualifiers">From Android Reversing to Broken TLS: My Experience at the Cyber Security Challenge Belgium Qualifiers</h1>
<p>On March 14 and 15, I participated in the qualifiers of the 2025 Cyber Security Challenge Belgium. Together with three friends, we formed a team and spent two days on the CTF platform solving as many challenges as we could. This post sums up the problems I personally worked on—some I solved, some I didn’t, all of them worth the effort.</p>
+ http://localhost:1313/professors/site/blog/post-2/
+ <h1 id="reversing-rebuilding-and-failing-better-my-cyber-security-challenge-belgium-qualifier-experience">Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience</h1>
<p>On March 14 and 15, I joined the Cyber Security Challenge Belgium qualifiers with three teammates. For two days, we threw ourselves at CTF challenges covering binary exploitation, Android reversing, cryptography, and more.</p>
diff --git a/public/categories/cybersecurity/index.html b/public/categories/cybersecurity/index.html
index 77f06f0..8e42a09 100644
--- a/public/categories/cybersecurity/index.html
+++ b/public/categories/cybersecurity/index.html
@@ -1,7 +1,7 @@
-
+
Cybersecurity
@@ -28,11 +28,11 @@
-
-
-
-
-
+
+
+
+
+
@@ -41,7 +41,7 @@
-
+
@@ -70,7 +70,7 @@
-
+
@@ -154,8 +154,8 @@
-
-
+
+
@@ -182,7 +182,7 @@
-
+
@@ -266,7 +266,7 @@
-
+
@@ -295,27 +295,27 @@
@@ -9486,7 +9822,7 @@
diff --git a/public/categories/cybersecurity/index.xml b/public/categories/cybersecurity/index.xml
index 0726cb0..302a9ca 100644
--- a/public/categories/cybersecurity/index.xml
+++ b/public/categories/cybersecurity/index.xml
@@ -2,25 +2,39 @@
Cybersecurity on Professors - Personal Portfolio Theme
- http://192.168.90.54:1313/categories/cybersecurity/
+ http://localhost:1313/professors/site/categories/cybersecurity/
Recent content in Cybersecurity on Professors - Personal Portfolio ThemeHugoen
- Tue, 13 May 2025 00:00:00 +0000
-
+ Tue, 20 May 2025 00:00:00 +0000
+
+
+ Red Team Talk: Een Blik Achter de Schermen bij Offensive Security
+ http://localhost:1313/professors/site/blog/post-4/
+ Tue, 20 May 2025 00:00:00 +0000
+ http://localhost:1313/professors/site/blog/post-4/
+ <h1 id="red-team-talk-een-blik-achter-de-schermen-bij-offensive-security">Red Team Talk: Een Blik Achter de Schermen bij Offensive Security</h1>
<p>In deze eerste aflevering van <strong>Red Team Talk</strong> nemen wij, Joren Schipman en Mattia Punjwani, studenten Cybersecurity aan Howest, jullie mee in een gesprek met <strong>Thomas Castronovo</strong>, ethical hacker en consultant bij Deloitte. Samen duiken we in de wereld van offensieve security, red teaming, en de realiteit van een carrière als pentester.</p>
+ Cyber Defence on the Digital Frontline: A Mission with NATO
- http://192.168.90.54:1313/blog/post-2/
+ http://localhost:1313/professors/site/blog/post-1/
Tue, 13 May 2025 00:00:00 +0000
- http://192.168.90.54:1313/blog/post-2/
+ http://localhost:1313/professors/site/blog/post-1/<h1 id="cyber-defence-on-the-digital-frontline-a-mission-with-nato">Cyber Defence on the Digital Frontline: A Mission with NATO</h1>
<h4 id="on-a-mission-with-nato-cyber-defence-on-the-frontline">On a Mission with NATO: Cyber Defence on the Frontline</h4>
<p>Howest’s ongoing commitment to world-class cybersecurity training took center stage again as six lecturers from the Cyber Security program joined forces with experts from Latvia, Luxembourg and Belgium in one of NATO’s most intensive simulations: the Locked Shields exercise, hosted by the Cooperative Cyber Defence Centre of Excellence (CCDCOE). Now in its fifth year of participation, the Howest team shared their firsthand experiences at a special evening talk at Howest Bruges.</p>
- On a Mission with NATO: Cyber Defence on the Frontline
- http://192.168.90.54:1313/blog/post-1/
- Tue, 13 May 2025 00:00:00 +0000
- http://192.168.90.54:1313/blog/post-1/
- <h1 id="on-a-mission-with-nato-cyber-defence-on-the-frontline">On a Mission with NATO: Cyber Defence on the Frontline</h1>
<p>I didn’t expect to leave a Tuesday evening talk thinking about satellite law, botched firewall configs, and how easy it is to accidentally nuke your own DNS root. But that’s exactly what happened at <strong>Howest Bruges</strong> on May 13.</p>
+ Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience
+ http://localhost:1313/professors/site/blog/post-2/
+ Sat, 15 Mar 2025 00:00:00 +0000
+ http://localhost:1313/professors/site/blog/post-2/
+ <h1 id="reversing-rebuilding-and-failing-better-my-cyber-security-challenge-belgium-qualifier-experience">Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience</h1>
<p>On March 14 and 15, I joined the Cyber Security Challenge Belgium qualifiers with three teammates. For two days, we threw ourselves at CTF challenges covering binary exploitation, Android reversing, cryptography, and more.</p>
+
+
+ Securing Cyberspace: Belgian Cyber Command at Howest
+ http://localhost:1313/professors/site/blog/post-3/
+ Tue, 12 Nov 2024 00:00:00 +0000
+ http://localhost:1313/professors/site/blog/post-3/
+ <h1 id="securing-cyberspace-belgian-cyber-command-at-howest">Securing Cyberspace: Belgian Cyber Command at Howest</h1>
<p>On November 12, we had the opportunity to attend a Tech&Meet session unlike any other. The speaker was <strong>Colonel Gunther Godefridis</strong>, Director for Development & Readiness at Belgian Cyber Command, and the topic: safeguarding our country in the digital domain.</p>
diff --git a/public/categories/defense/index.html b/public/categories/defense/index.html
new file mode 100644
index 0000000..432582d
--- /dev/null
+++ b/public/categories/defense/index.html
@@ -0,0 +1,9373 @@
+
+
+
+
+
+
+Defense
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Professors - Personal Portfolio Theme
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
@@ -10673,7 +10987,7 @@
diff --git a/public/index.json b/public/index.json
index 23d6aa3..ee56da2 100644
--- a/public/index.json
+++ b/public/index.json
@@ -40,4 +40,24 @@
-[{"categories":null,"contents":"DRMDTool is an automation-centric utility designed to streamline the processing of .drmd files by tightly integrating with the N_m3u8DL-RE downloader. The tool offers robust automation via a watch folder and an intuitive web-based interface, significantly reducing the friction for managing and processing DRM-protected streaming content.\nWhat’s New DRMDTool has evolved into a comprehensive platform for batch downloading with enhanced support for user interaction and background processing. It features granular job tracking, dynamic download control (pause, resume, abort), and a refined WebSocket-based console for real-time command output. Subtitle handling now includes automatic downloading and conversion from VTT to SRT, and the downloader adapts based on metadata, organizing content into categorized directories.\nGoals and Use Case The primary aim is to automate .drmd file processing with minimal manual input. Users can configure download formats, specify directories, and enable real-time command broadcasting. DRMDTool is suitable for both interactive use through a web UI and headless automation in pipelines, supporting inotify or polling-based folder watching.\nHow .drmd Files Work A .drmd file is a structured JSON document that defines one or more encrypted media items to be processed by DRMDTool. It contains an Items array, with each item representing a specific media job. DRMDTool parses these entries to generate download commands for N_m3u8DL-RE.\nEach item includes:\nMPD: A DASH manifest, either a direct URL or a base64-encoded version. If base64-encoded, DRMDTool decodes and temporarily saves it before use. Keys: A comma-separated list of KID:key pairs (e.g., abcd1234ef567890:00112233445566778899aabbccddeeff). These are required for decrypting encrypted media streams and are passed directly to N_m3u8DL-RE using --key flags. Filename: The name to be used for the final output file. Subtitles: Comma-separated list of subtitle URLs in .vtt format. DRMDTool downloads and converts these to .srt, then muxes them into the final file. Metadata: A semicolon-separated string like Title;Type;Season (e.g., Example Show;serie;1) used to determine directory structure (Movies/Title or Series/Title/Season). Description and Poster: Optional fields used only for display in the web UI. Example .drmd Structure { \u0026#34;Items\u0026#34;: [ { \u0026#34;MPD\u0026#34;: \u0026#34;aHR0cHM6Ly9leGFtcGxlLmNvbS9zdHJlYW0ubXBk\u0026#34;, \u0026#34;Keys\u0026#34;: \u0026#34;abcd1234ef567890:00112233445566778899aabbccddeeff\u0026#34;, \u0026#34;Filename\u0026#34;: \u0026#34;ExampleShow.S01E01\u0026#34;, \u0026#34;Subtitles\u0026#34;: \u0026#34;https://example.com/sub1.vtt,https://example.com/sub2.vtt\u0026#34;, \u0026#34;Metadata\u0026#34;: \u0026#34;Example Show;serie;1\u0026#34;, \u0026#34;Description\u0026#34;: \u0026#34;Pilot episode\u0026#34;, \u0026#34;Poster\u0026#34;: \u0026#34;\u0026#34; } ] } Processing Steps Detection: DRMDTool either watches a folder or receives .drmd uploads through the web UI. Validation: It waits for the file to finish writing (based on file size stability), then parses its contents. MPD Handling: If base64-encoded, the MPD is decoded and written to a temp file; otherwise, the URL is fetched or passed as-is. Command Generation: Using the MPD, KID:key pairs, output paths, and subtitles, DRMDTool builds a command line for N_m3u8DL-RE. Execution: The download is launched with live progress tracking. Users can pause, resume, or abort jobs, and optionally stream console output via WebSocket. These files serve as portable job definitions. When DRMDTool detects or receives a .drmd file, it parses the items, decodes or downloads the MPD, applies the keys, and builds a download command using N_m3u8DL-RE. Files are saved in organized directories like Movies/Title or Series/Title/Season, and subtitles are embedded if available. Pausing, resuming, and aborting downloads is supported per file.\nArchitecture Overview The configuration is handled via config.toml, with environment variable overrides for containerized or dynamic deployments. Once started, the tool can either monitor a specified folder or allow file uploads through the UI. Each .drmd file is parsed, grouped by series and season (if applicable), and processed sequentially with support for job pausing and resuming.\nWeb UI \u0026amp; CLI To use:\n./drmdtool Visit http://localhost:8080 for the web interface, which supports drag-and-drop uploads, selection of episodes or movies, and real-time progress tracking. For headless operation:\n./drmdtool -f /path/to/file.drmd Jobs can be paused, resumed, or aborted through the web interface, which reflects the backend state via live updates.\nEnhanced Download Logic DRMDTool dynamically builds download commands using metadata from .drmd files and user preferences. It ensures that only the highest quality streams are kept, removing ad periods and duplicate segments from the MPD files. Subtitles are fetched and embedded automatically. Jobs are tracked with robust state management and logs for debugging and visibility.\nRepository Code and setup instructions are hosted here: https://git.directme.in/Joren/DRMDTool\nDRMDtool For advanced usage details, customization, and API structure, refer to the README.md in the repository.\nUI Previews Index Page Select Page Progress Page ","date":"May 21, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-1/","title":"DRMDTool Project"},{"categories":["cybersecurity","event recap"],"contents":"Cyber Defence on the Digital Frontline: A Mission with NATO On a Mission with NATO: Cyber Defence on the Frontline Howest’s ongoing commitment to world-class cybersecurity training took center stage again as six lecturers from the Cyber Security program joined forces with experts from Latvia, Luxembourg and Belgium in one of NATO\u0026rsquo;s most intensive simulations: the Locked Shields exercise, hosted by the Cooperative Cyber Defence Centre of Excellence (CCDCOE). Now in its fifth year of participation, the Howest team shared their firsthand experiences at a special evening talk at Howest Bruges.\nThe Exercise: Locked Shields Locked Shields is no ordinary simulation. It is a full-scale, live-fire cyber defence exercise involving more than 6,000 machines and a narrative scenario so detailed it includes geopolitics, disinformation and even fictional countries. This year, the Blue Team 03 (our team) defended a simulated nation’s critical infrastructure including power plants, satellites, 5G networks and banking systems, all while under constant attack from a coordinated Red Team using automated scripts and over 28,000 attacks across two days.\nAnd yes, every team (Red, Blue, Yellow, White) uses Ansible. For everything.\nHigh Stakes, Real Lessons What do you do when a rogue process might be malware, or maybe just a poorly named service? What happens when your teammate refuses to act unless something is “officially malicious”? The team faced cultural clashes, communication breakdowns and stress-testing of both systems and people.\nThe exercise required more than technical fixes. It demanded communication with simulated commanders, media and public stakeholders. Reporting became just as important as patching. It taught participants how to translate technical impact into real-world consequences. Not \u0026ldquo;port 8443 unreachable\u0026rdquo;, but \u0026ldquo;our air defence system is degraded, and we cannot fly planes\u0026rdquo;.\nThe Black Team: Rapid Response in Action A new but powerful presence in the simulation was the Black Team, a rapid-response unit deployed when problems became too complex for any single team. Acting like special forces, they jumped in when incidents crossed team boundaries or demanded unconventional solutions. Their mission was to find out what was happening, assess the impact and suggest fast, creative responses. Introduced just last year, this team quickly proved its value again in 2025. They even embraced the role with style — “you can wear sunglasses inside” became their unofficial motto.\nTheir presence underlined a critical lesson: not every problem fits neatly within a team’s silo. Real-world defence requires flexibility, speed and lateral thinking.\nHighlights and Blooper Reel There were plenty of mishaps. Misfired scripts, team mix-ups, and one case where a DNS setup from a previous year was reused by mistake. Someone tried renaming cut to shutdown, breaking essential operations until it was fixed. Systems rebooted into chaos, a manual was uploaded to public GitHub, and the team had to quickly learn the difference between symbolic links and real binaries.\nHuman Factors and Growth From detecting malware with Velociraptor and Q9, to encountering teammates who took orders literally, the learning was intense. One participant noted that while Belgian and Luxembourg teams prioritized knowledge sharing, others preferred strict protocol. This highlighted cultural differences and the importance of interpersonal skills.\nThe biggest lesson? You are never fully prepared. Every iteration of Locked Shields is different. But each one sharpens not only your skills, but also your ability to function as a team under extreme conditions.\nFrom the Battlefield to the Classroom This experience directly impacts the classroom. Inspired by the exercise, Howest is introducing new hands-on courses like “Glutamine” in semester five. Students will be dropped into realistic broken networks, with misconfigurations, fake firewalls and simulated threats. It is chaos, but controlled. And that is the point.\nAs one speaker said: “You don’t win Locked Shields. You just survive it better than the rest.”\nFinal Thoughts The exercise teaches more than just cybersecurity. It builds trust. It proves that knowing your teammates can be as important as knowing the tools. Whether that comes from a shared flight or a pre-exercise barbecue, it all matters when the pressure hits.\nWant to see how cyber defence works in real life? This is it.\n","date":"May 13, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog-2_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog-2_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-1/","title":"Cyber Defence on the Digital Frontline: A Mission with NATO"},{"categories":null,"contents":"DRMDTool is an automation-centric utility designed to streamline the processing of .drmd files by tightly integrating with the N_m3u8DL-RE downloader. The tool offers robust automation via a watch folder and an intuitive web-based interface, significantly reducing the friction for managing and processing DRM-protected streaming content.\nWhat’s New DRMDTool has evolved into a comprehensive platform for batch downloading with enhanced support for user interaction and background processing. It features granular job tracking, dynamic download control (pause, resume, abort), and a refined WebSocket-based console for real-time command output. Subtitle handling now includes automatic downloading and conversion from VTT to SRT, and the downloader adapts based on metadata, organizing content into categorized directories.\nGoals and Use Case The primary aim is to automate .drmd file processing with minimal manual input. Users can configure download formats, specify directories, and enable real-time command broadcasting. DRMDTool is suitable for both interactive use through a web UI and headless automation in pipelines, supporting inotify or polling-based folder watching.\nHow .drmd Files Work A .drmd file is a structured JSON document that defines one or more encrypted media items to be processed by DRMDTool. It contains an Items array, with each item representing a specific media job. DRMDTool parses these entries to generate download commands for N_m3u8DL-RE.\nEach item includes:\nMPD: A DASH manifest, either a direct URL or a base64-encoded version. If base64-encoded, DRMDTool decodes and temporarily saves it before use. Keys: A comma-separated list of KID:key pairs (e.g., abcd1234ef567890:00112233445566778899aabbccddeeff). These are required for decrypting encrypted media streams and are passed directly to N_m3u8DL-RE using --key flags. Filename: The name to be used for the final output file. Subtitles: Comma-separated list of subtitle URLs in .vtt format. DRMDTool downloads and converts these to .srt, then muxes them into the final file. Metadata: A semicolon-separated string like Title;Type;Season (e.g., Example Show;serie;1) used to determine directory structure (Movies/Title or Series/Title/Season). Description and Poster: Optional fields used only for display in the web UI. Example .drmd Structure { \u0026#34;Items\u0026#34;: [ { \u0026#34;MPD\u0026#34;: \u0026#34;aHR0cHM6Ly9leGFtcGxlLmNvbS9zdHJlYW0ubXBk\u0026#34;, \u0026#34;Keys\u0026#34;: \u0026#34;abcd1234ef567890:00112233445566778899aabbccddeeff\u0026#34;, \u0026#34;Filename\u0026#34;: \u0026#34;ExampleShow.S01E01\u0026#34;, \u0026#34;Subtitles\u0026#34;: \u0026#34;https://example.com/sub1.vtt,https://example.com/sub2.vtt\u0026#34;, \u0026#34;Metadata\u0026#34;: \u0026#34;Example Show;serie;1\u0026#34;, \u0026#34;Description\u0026#34;: \u0026#34;Pilot episode\u0026#34;, \u0026#34;Poster\u0026#34;: \u0026#34;\u0026#34; } ] } Processing Steps Detection: DRMDTool either watches a folder or receives .drmd uploads through the web UI. Validation: It waits for the file to finish writing (based on file size stability), then parses its contents. MPD Handling: If base64-encoded, the MPD is decoded and written to a temp file; otherwise, the URL is fetched or passed as-is. Command Generation: Using the MPD, KID:key pairs, output paths, and subtitles, DRMDTool builds a command line for N_m3u8DL-RE. Execution: The download is launched with live progress tracking. Users can pause, resume, or abort jobs, and optionally stream console output via WebSocket. These files serve as portable job definitions. When DRMDTool detects or receives a .drmd file, it parses the items, decodes or downloads the MPD, applies the keys, and builds a download command using N_m3u8DL-RE. Files are saved in organized directories like Movies/Title or Series/Title/Season, and subtitles are embedded if available. Pausing, resuming, and aborting downloads is supported per file.\nArchitecture Overview The configuration is handled via config.toml, with environment variable overrides for containerized or dynamic deployments. Once started, the tool can either monitor a specified folder or allow file uploads through the UI. Each .drmd file is parsed, grouped by series and season (if applicable), and processed sequentially with support for job pausing and resuming.\nWeb UI \u0026amp; CLI To use:\n./drmdtool Visit http://localhost:8080 for the web interface, which supports drag-and-drop uploads, selection of episodes or movies, and real-time progress tracking. For headless operation:\n./drmdtool -f /path/to/file.drmd Jobs can be paused, resumed, or aborted through the web interface, which reflects the backend state via live updates.\nEnhanced Download Logic DRMDTool dynamically builds download commands using metadata from .drmd files and user preferences. It ensures that only the highest quality streams are kept, removing ad periods and duplicate segments from the MPD files. Subtitles are fetched and embedded automatically. Jobs are tracked with robust state management and logs for debugging and visibility.\nRepository Code and setup instructions are hosted here: https://git.directme.in/Joren/DRMDTool\nDRMDtool For advanced usage details, customization, and API structure, refer to the README.md in the repository.\nUI Previews Index Page Select Page Progress Page ","date":"May 21, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-1/","title":"DRMDTool Project"},{"categories":["cybersecurity","event recap"],"contents":"Cyber Defence on the Digital Frontline: A Mission with NATO On a Mission with NATO: Cyber Defence on the Frontline Howest’s ongoing commitment to world-class cybersecurity training took center stage again as six lecturers from the Cyber Security program joined forces with experts from Latvia, Luxembourg and Belgium in one of NATO\u0026rsquo;s most intensive simulations: the Locked Shields exercise, hosted by the Cooperative Cyber Defence Centre of Excellence (CCDCOE). Now in its fifth year of participation, the Howest team shared their firsthand experiences at a special evening talk at Howest Bruges.\nThe Exercise: Locked Shields Locked Shields is no ordinary simulation. It is a full-scale, live-fire cyber defence exercise involving more than 6,000 machines and a narrative scenario so detailed it includes geopolitics, disinformation and even fictional countries. This year, the Blue Team 03 (our team) defended a simulated nation’s critical infrastructure including power plants, satellites, 5G networks and banking systems, all while under constant attack from a coordinated Red Team using automated scripts and over 28,000 attacks across two days.\nAnd yes, every team (Red, Blue, Yellow, White) uses Ansible. For everything.\nHigh Stakes, Real Lessons What do you do when a rogue process might be malware, or maybe just a poorly named service? What happens when your teammate refuses to act unless something is “officially malicious”? The team faced cultural clashes, communication breakdowns and stress-testing of both systems and people.\nThe exercise required more than technical fixes. It demanded communication with simulated commanders, media and public stakeholders. Reporting became just as important as patching. It taught participants how to translate technical impact into real-world consequences. Not \u0026ldquo;port 8443 unreachable\u0026rdquo;, but \u0026ldquo;our air defence system is degraded, and we cannot fly planes\u0026rdquo;.\nThe Black Team: Rapid Response in Action A new but powerful presence in the simulation was the Black Team, a rapid-response unit deployed when problems became too complex for any single team. Acting like special forces, they jumped in when incidents crossed team boundaries or demanded unconventional solutions. Their mission was to find out what was happening, assess the impact and suggest fast, creative responses. Introduced just last year, this team quickly proved its value again in 2025. They even embraced the role with style — “you can wear sunglasses inside” became their unofficial motto.\nTheir presence underlined a critical lesson: not every problem fits neatly within a team’s silo. Real-world defence requires flexibility, speed and lateral thinking.\nHighlights and Blooper Reel There were plenty of mishaps. Misfired scripts, team mix-ups, and one case where a DNS setup from a previous year was reused by mistake. Someone tried renaming cut to shutdown, breaking essential operations until it was fixed. Systems rebooted into chaos, a manual was uploaded to public GitHub, and the team had to quickly learn the difference between symbolic links and real binaries.\nHuman Factors and Growth From detecting malware with Velociraptor and Q9, to encountering teammates who took orders literally, the learning was intense. One participant noted that while Belgian and Luxembourg teams prioritized knowledge sharing, others preferred strict protocol. This highlighted cultural differences and the importance of interpersonal skills.\nThe biggest lesson? You are never fully prepared. Every iteration of Locked Shields is different. But each one sharpens not only your skills, but also your ability to function as a team under extreme conditions.\nFrom the Battlefield to the Classroom This experience directly impacts the classroom. Inspired by the exercise, Howest is introducing new hands-on courses like “Glutamine” in semester five. Students will be dropped into realistic broken networks, with misconfigurations, fake firewalls and simulated threats. It is chaos, but controlled. And that is the point.\nAs one speaker said: “You don’t win Locked Shields. You just survive it better than the rest.”\nFinal Thoughts The exercise teaches more than just cybersecurity. It builds trust. It proves that knowing your teammates can be as important as knowing the tools. Whether that comes from a shared flight or a pre-exercise barbecue, it all matters when the pressure hits.\nWant to see how cyber defence works in real life? This is it.\n","date":"May 13, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog-2_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog-2_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-1/","title":"Cyber Defence on the Digital Frontline: A Mission with NATO"},{"categories":null,"contents":"I built my personal blog using Hugo and deployed it on a lightweight Alpine Linux VPS. I chose this setup to have full control, keep things simple, and avoid bloated platforms or services. Here’s how the process went from site generation to live deployment.\nCreating the Hugo Site On my development machine, I created a new Hugo site:\nhugo new site howest-blog I used the professors-hugo theme and copied its exampleSite content into my project. I customized the layout, structure, and styling by editing content files, SCSS in assets/scss/custom.scss, and partial templates in the theme directory.\nAll content lives under content/, with separate folders for blog/ and project/, each containing .md files with front matter and Markdown content.\nCustomization I edited the config/_default/hugo.toml to configure site parameters like the base URL, theme, language, and menus. SCSS and image assets go in assets/, and are processed by Hugo\u0026rsquo;s pipeline. Static files like favicons are placed in static/.\nTo preview the site locally:\nhugo server To build the static site:\nhugo This generates everything in the public/ folder.\nVPS Deployment I rented a minimal Alpine Linux VPS and installed only what I needed. After setting up SSH and a basic nginx web server, I copied the public/ folder over using scp:\nscp -r public/* user@my-vps:/var/www/html On the VPS, I installed nginx:\napk add nginx And configured /etc/nginx/conf.d/default.conf to serve files from /var/www/html. Then I enabled and started nginx:\nrc-service nginx start rc-update add nginx Now my Hugo site is live and served directly as static files—no backend, no database, just HTML, CSS, and JS.\nWhy Alpine + Hugo? Alpine Linux is minimal and fast, perfect for serving static sites with low resource usage. Combined with Hugo’s speed and flexibility, I get a complete, performant setup that I fully control. It’s secure, lightweight, and easy to update—just rebuild and re-upload the public/ folder.\nThis setup is perfect if you want full control and minimal overhead for a personal blog or portfolio.\n","date":"May 29, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-2/","title":"Building My Hugo Website on a VPS"},{"categories":null,"contents":"DRMDTool is an automation-centric utility designed to streamline the processing of .drmd files by tightly integrating with the N_m3u8DL-RE downloader. The tool offers robust automation via a watch folder and an intuitive web-based interface, significantly reducing the friction for managing and processing DRM-protected streaming content.\nWhat’s New DRMDTool has evolved into a comprehensive platform for batch downloading with enhanced support for user interaction and background processing. It features granular job tracking, dynamic download control (pause, resume, abort), and a refined WebSocket-based console for real-time command output. Subtitle handling now includes automatic downloading and conversion from VTT to SRT, and the downloader adapts based on metadata, organizing content into categorized directories.\nGoals and Use Case The primary aim is to automate .drmd file processing with minimal manual input. Users can configure download formats, specify directories, and enable real-time command broadcasting. DRMDTool is suitable for both interactive use through a web UI and headless automation in pipelines, supporting inotify or polling-based folder watching.\nHow .drmd Files Work A .drmd file is a structured JSON document that defines one or more encrypted media items to be processed by DRMDTool. It contains an Items array, with each item representing a specific media job. DRMDTool parses these entries to generate download commands for N_m3u8DL-RE.\nEach item includes:\nMPD: A DASH manifest, either a direct URL or a base64-encoded version. If base64-encoded, DRMDTool decodes and temporarily saves it before use. Keys: A comma-separated list of KID:key pairs (e.g., abcd1234ef567890:00112233445566778899aabbccddeeff). These are required for decrypting encrypted media streams and are passed directly to N_m3u8DL-RE using --key flags. Filename: The name to be used for the final output file. Subtitles: Comma-separated list of subtitle URLs in .vtt format. DRMDTool downloads and converts these to .srt, then muxes them into the final file. Metadata: A semicolon-separated string like Title;Type;Season (e.g., Example Show;serie;1) used to determine directory structure (Movies/Title or Series/Title/Season). Description and Poster: Optional fields used only for display in the web UI. Example .drmd Structure { \u0026#34;Items\u0026#34;: [ { \u0026#34;MPD\u0026#34;: \u0026#34;aHR0cHM6Ly9leGFtcGxlLmNvbS9zdHJlYW0ubXBk\u0026#34;, \u0026#34;Keys\u0026#34;: \u0026#34;abcd1234ef567890:00112233445566778899aabbccddeeff\u0026#34;, \u0026#34;Filename\u0026#34;: \u0026#34;ExampleShow.S01E01\u0026#34;, \u0026#34;Subtitles\u0026#34;: \u0026#34;https://example.com/sub1.vtt,https://example.com/sub2.vtt\u0026#34;, \u0026#34;Metadata\u0026#34;: \u0026#34;Example Show;serie;1\u0026#34;, \u0026#34;Description\u0026#34;: \u0026#34;Pilot episode\u0026#34;, \u0026#34;Poster\u0026#34;: \u0026#34;\u0026#34; } ] } Processing Steps Detection: DRMDTool either watches a folder or receives .drmd uploads through the web UI. Validation: It waits for the file to finish writing (based on file size stability), then parses its contents. MPD Handling: If base64-encoded, the MPD is decoded and written to a temp file; otherwise, the URL is fetched or passed as-is. Command Generation: Using the MPD, KID:key pairs, output paths, and subtitles, DRMDTool builds a command line for N_m3u8DL-RE. Execution: The download is launched with live progress tracking. Users can pause, resume, or abort jobs, and optionally stream console output via WebSocket. These files serve as portable job definitions. When DRMDTool detects or receives a .drmd file, it parses the items, decodes or downloads the MPD, applies the keys, and builds a download command using N_m3u8DL-RE. Files are saved in organized directories like Movies/Title or Series/Title/Season, and subtitles are embedded if available. Pausing, resuming, and aborting downloads is supported per file.\nArchitecture Overview The configuration is handled via config.toml, with environment variable overrides for containerized or dynamic deployments. Once started, the tool can either monitor a specified folder or allow file uploads through the UI. Each .drmd file is parsed, grouped by series and season (if applicable), and processed sequentially with support for job pausing and resuming.\nWeb UI \u0026amp; CLI To use:\n./drmdtool Visit http://localhost:8080 for the web interface, which supports drag-and-drop uploads, selection of episodes or movies, and real-time progress tracking. For headless operation:\n./drmdtool -f /path/to/file.drmd Jobs can be paused, resumed, or aborted through the web interface, which reflects the backend state via live updates.\nEnhanced Download Logic DRMDTool dynamically builds download commands using metadata from .drmd files and user preferences. It ensures that only the highest quality streams are kept, removing ad periods and duplicate segments from the MPD files. Subtitles are fetched and embedded automatically. Jobs are tracked with robust state management and logs for debugging and visibility.\nRepository Code and setup instructions are hosted here: https://git.directme.in/Joren/DRMDTool\nDRMDtool For advanced usage details, customization, and API structure, refer to the README.md in the repository.\nUI Previews Index Page Select Page Progress Page ","date":"May 21, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-1/","title":"DRMDTool Project"},{"categories":["cybersecurity","event recap"],"contents":"Cyber Defence on the Digital Frontline: A Mission with NATO On a Mission with NATO: Cyber Defence on the Frontline Howest’s ongoing commitment to world-class cybersecurity training took center stage again as six lecturers from the Cyber Security program joined forces with experts from Latvia, Luxembourg and Belgium in one of NATO\u0026rsquo;s most intensive simulations: the Locked Shields exercise, hosted by the Cooperative Cyber Defence Centre of Excellence (CCDCOE). Now in its fifth year of participation, the Howest team shared their firsthand experiences at a special evening talk at Howest Bruges.\nThe Exercise: Locked Shields Locked Shields is no ordinary simulation. It is a full-scale, live-fire cyber defence exercise involving more than 6,000 machines and a narrative scenario so detailed it includes geopolitics, disinformation and even fictional countries. This year, the Blue Team 03 (our team) defended a simulated nation’s critical infrastructure including power plants, satellites, 5G networks and banking systems, all while under constant attack from a coordinated Red Team using automated scripts and over 28,000 attacks across two days.\nAnd yes, every team (Red, Blue, Yellow, White) uses Ansible. For everything.\nHigh Stakes, Real Lessons What do you do when a rogue process might be malware, or maybe just a poorly named service? What happens when your teammate refuses to act unless something is “officially malicious”? The team faced cultural clashes, communication breakdowns and stress-testing of both systems and people.\nThe exercise required more than technical fixes. It demanded communication with simulated commanders, media and public stakeholders. Reporting became just as important as patching. It taught participants how to translate technical impact into real-world consequences. Not \u0026ldquo;port 8443 unreachable\u0026rdquo;, but \u0026ldquo;our air defence system is degraded, and we cannot fly planes\u0026rdquo;.\nThe Black Team: Rapid Response in Action A new but powerful presence in the simulation was the Black Team, a rapid-response unit deployed when problems became too complex for any single team. Acting like special forces, they jumped in when incidents crossed team boundaries or demanded unconventional solutions. Their mission was to find out what was happening, assess the impact and suggest fast, creative responses. Introduced just last year, this team quickly proved its value again in 2025. They even embraced the role with style — “you can wear sunglasses inside” became their unofficial motto.\nTheir presence underlined a critical lesson: not every problem fits neatly within a team’s silo. Real-world defence requires flexibility, speed and lateral thinking.\nHighlights and Blooper Reel There were plenty of mishaps. Misfired scripts, team mix-ups, and one case where a DNS setup from a previous year was reused by mistake. Someone tried renaming cut to shutdown, breaking essential operations until it was fixed. Systems rebooted into chaos, a manual was uploaded to public GitHub, and the team had to quickly learn the difference between symbolic links and real binaries.\nHuman Factors and Growth From detecting malware with Velociraptor and Q9, to encountering teammates who took orders literally, the learning was intense. One participant noted that while Belgian and Luxembourg teams prioritized knowledge sharing, others preferred strict protocol. This highlighted cultural differences and the importance of interpersonal skills.\nThe biggest lesson? You are never fully prepared. Every iteration of Locked Shields is different. But each one sharpens not only your skills, but also your ability to function as a team under extreme conditions.\nFrom the Battlefield to the Classroom This experience directly impacts the classroom. Inspired by the exercise, Howest is introducing new hands-on courses like “Glutamine” in semester five. Students will be dropped into realistic broken networks, with misconfigurations, fake firewalls and simulated threats. It is chaos, but controlled. And that is the point.\nAs one speaker said: “You don’t win Locked Shields. You just survive it better than the rest.”\nFinal Thoughts The exercise teaches more than just cybersecurity. It builds trust. It proves that knowing your teammates can be as important as knowing the tools. Whether that comes from a shared flight or a pre-exercise barbecue, it all matters when the pressure hits.\nWant to see how cyber defence works in real life? This is it.\n","date":"May 13, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog-2_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog-2_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-1/","title":"Cyber Defence on the Digital Frontline: A Mission with NATO"},{"categories":null,"contents":"I built my personal blog using Hugo and deployed it on a lightweight Alpine Linux VPS. I chose this setup to have full control, keep things simple, and avoid bloated platforms or services. Here’s how the process went from site generation to live deployment.\nCreating the Hugo Site On my development machine, I created a new Hugo site:\nhugo new site howest-blog I used the professors-hugo theme and copied its exampleSite content into my project. I customized the layout, structure, and styling by editing content files, SCSS in assets/scss/custom.scss, and partial templates in the theme directory.\nAll content lives under content/, with separate folders for blog/ and project/, each containing .md files with front matter and Markdown content.\nCustomization I edited the config/_default/hugo.toml to configure site parameters like the base URL, theme, language, and menus. SCSS and image assets go in assets/, and are processed by Hugo\u0026rsquo;s pipeline. Static files like favicons are placed in static/.\nTo preview the site locally:\nhugo server To build the static site:\nhugo This generates everything in the public/ folder.\nVPS Deployment I rented a minimal Alpine Linux VPS and installed only what I needed. After setting up SSH and a basic nginx web server, I copied the public/ folder over using scp:\nscp -r public/* user@my-vps:/var/www/html On the VPS, I installed nginx:\napk add nginx And configured /etc/nginx/conf.d/default.conf to serve files from /var/www/html. Then I enabled and started nginx:\nrc-service nginx start rc-update add nginx Now my Hugo site is live and served directly as static files—no backend, no database, just HTML, CSS, and JS.\nWhy Alpine + Hugo? Alpine Linux is minimal and fast, perfect for serving static sites with low resource usage. Combined with Hugo’s speed and flexibility, I get a complete, performant setup that I fully control. It’s secure, lightweight, and easy to update—just rebuild and re-upload the public/ folder.\nThis setup is perfect if you want full control and minimal overhead for a personal blog or portfolio.\n","date":"May 29, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-2/","title":"Building My Hugo Website on a VPS"},{"categories":null,"contents":"DRMDTool is an automation-centric utility designed to streamline the processing of .drmd files by tightly integrating with the N_m3u8DL-RE downloader. The tool offers robust automation via a watch folder and an intuitive web-based interface, significantly reducing the friction for managing and processing DRM-protected streaming content.\nWhat’s New DRMDTool has evolved into a comprehensive platform for batch downloading with enhanced support for user interaction and background processing. It features granular job tracking, dynamic download control (pause, resume, abort), and a refined WebSocket-based console for real-time command output. Subtitle handling now includes automatic downloading and conversion from VTT to SRT, and the downloader adapts based on metadata, organizing content into categorized directories.\nGoals and Use Case The primary aim is to automate .drmd file processing with minimal manual input. Users can configure download formats, specify directories, and enable real-time command broadcasting. DRMDTool is suitable for both interactive use through a web UI and headless automation in pipelines, supporting inotify or polling-based folder watching.\nHow .drmd Files Work A .drmd file is a structured JSON document that defines one or more encrypted media items to be processed by DRMDTool. It contains an Items array, with each item representing a specific media job. DRMDTool parses these entries to generate download commands for N_m3u8DL-RE.\nEach item includes:\nMPD: A DASH manifest, either a direct URL or a base64-encoded version. If base64-encoded, DRMDTool decodes and temporarily saves it before use. Keys: A comma-separated list of KID:key pairs (e.g., abcd1234ef567890:00112233445566778899aabbccddeeff). These are required for decrypting encrypted media streams and are passed directly to N_m3u8DL-RE using --key flags. Filename: The name to be used for the final output file. Subtitles: Comma-separated list of subtitle URLs in .vtt format. DRMDTool downloads and converts these to .srt, then muxes them into the final file. Metadata: A semicolon-separated string like Title;Type;Season (e.g., Example Show;serie;1) used to determine directory structure (Movies/Title or Series/Title/Season). Description and Poster: Optional fields used only for display in the web UI. Example .drmd Structure { \u0026#34;Items\u0026#34;: [ { \u0026#34;MPD\u0026#34;: \u0026#34;aHR0cHM6Ly9leGFtcGxlLmNvbS9zdHJlYW0ubXBk\u0026#34;, \u0026#34;Keys\u0026#34;: \u0026#34;abcd1234ef567890:00112233445566778899aabbccddeeff\u0026#34;, \u0026#34;Filename\u0026#34;: \u0026#34;ExampleShow.S01E01\u0026#34;, \u0026#34;Subtitles\u0026#34;: \u0026#34;https://example.com/sub1.vtt,https://example.com/sub2.vtt\u0026#34;, \u0026#34;Metadata\u0026#34;: \u0026#34;Example Show;serie;1\u0026#34;, \u0026#34;Description\u0026#34;: \u0026#34;Pilot episode\u0026#34;, \u0026#34;Poster\u0026#34;: \u0026#34;\u0026#34; } ] } Processing Steps Detection: DRMDTool either watches a folder or receives .drmd uploads through the web UI. Validation: It waits for the file to finish writing (based on file size stability), then parses its contents. MPD Handling: If base64-encoded, the MPD is decoded and written to a temp file; otherwise, the URL is fetched or passed as-is. Command Generation: Using the MPD, KID:key pairs, output paths, and subtitles, DRMDTool builds a command line for N_m3u8DL-RE. Execution: The download is launched with live progress tracking. Users can pause, resume, or abort jobs, and optionally stream console output via WebSocket. These files serve as portable job definitions. When DRMDTool detects or receives a .drmd file, it parses the items, decodes or downloads the MPD, applies the keys, and builds a download command using N_m3u8DL-RE. Files are saved in organized directories like Movies/Title or Series/Title/Season, and subtitles are embedded if available. Pausing, resuming, and aborting downloads is supported per file.\nArchitecture Overview The configuration is handled via config.toml, with environment variable overrides for containerized or dynamic deployments. Once started, the tool can either monitor a specified folder or allow file uploads through the UI. Each .drmd file is parsed, grouped by series and season (if applicable), and processed sequentially with support for job pausing and resuming.\nWeb UI \u0026amp; CLI To use:\n./drmdtool Visit http://localhost:8080 for the web interface, which supports drag-and-drop uploads, selection of episodes or movies, and real-time progress tracking. For headless operation:\n./drmdtool -f /path/to/file.drmd Jobs can be paused, resumed, or aborted through the web interface, which reflects the backend state via live updates.\nEnhanced Download Logic DRMDTool dynamically builds download commands using metadata from .drmd files and user preferences. It ensures that only the highest quality streams are kept, removing ad periods and duplicate segments from the MPD files. Subtitles are fetched and embedded automatically. Jobs are tracked with robust state management and logs for debugging and visibility.\nRepository Code and setup instructions are hosted here: https://git.directme.in/Joren/DRMDTool\nDRMDtool For advanced usage details, customization, and API structure, refer to the README.md in the repository.\nUI Previews Index Page Select Page Progress Page ","date":"May 21, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-1/","title":"DRMDTool Project"},{"categories":["cybersecurity","event recap"],"contents":"Cyber Defence on the Digital Frontline: A Mission with NATO On a Mission with NATO: Cyber Defence on the Frontline Howest’s ongoing commitment to world-class cybersecurity training took center stage again as six lecturers from the Cyber Security program joined forces with experts from Latvia, Luxembourg and Belgium in one of NATO\u0026rsquo;s most intensive simulations: the Locked Shields exercise, hosted by the Cooperative Cyber Defence Centre of Excellence (CCDCOE). Now in its fifth year of participation, the Howest team shared their firsthand experiences at a special evening talk at Howest Bruges.\nThe Exercise: Locked Shields Locked Shields is no ordinary simulation. It is a full-scale, live-fire cyber defence exercise involving more than 6,000 machines and a narrative scenario so detailed it includes geopolitics, disinformation and even fictional countries. This year, the Blue Team 03 (our team) defended a simulated nation’s critical infrastructure including power plants, satellites, 5G networks and banking systems, all while under constant attack from a coordinated Red Team using automated scripts and over 28,000 attacks across two days.\nAnd yes, every team (Red, Blue, Yellow, White) uses Ansible. For everything.\nHigh Stakes, Real Lessons What do you do when a rogue process might be malware, or maybe just a poorly named service? What happens when your teammate refuses to act unless something is “officially malicious”? The team faced cultural clashes, communication breakdowns and stress-testing of both systems and people.\nThe exercise required more than technical fixes. It demanded communication with simulated commanders, media and public stakeholders. Reporting became just as important as patching. It taught participants how to translate technical impact into real-world consequences. Not \u0026ldquo;port 8443 unreachable\u0026rdquo;, but \u0026ldquo;our air defence system is degraded, and we cannot fly planes\u0026rdquo;.\nThe Black Team: Rapid Response in Action A new but powerful presence in the simulation was the Black Team, a rapid-response unit deployed when problems became too complex for any single team. Acting like special forces, they jumped in when incidents crossed team boundaries or demanded unconventional solutions. Their mission was to find out what was happening, assess the impact and suggest fast, creative responses. Introduced just last year, this team quickly proved its value again in 2025. They even embraced the role with style — “you can wear sunglasses inside” became their unofficial motto.\nTheir presence underlined a critical lesson: not every problem fits neatly within a team’s silo. Real-world defence requires flexibility, speed and lateral thinking.\nHighlights and Blooper Reel There were plenty of mishaps. Misfired scripts, team mix-ups, and one case where a DNS setup from a previous year was reused by mistake. Someone tried renaming cut to shutdown, breaking essential operations until it was fixed. Systems rebooted into chaos, a manual was uploaded to public GitHub, and the team had to quickly learn the difference between symbolic links and real binaries.\nHuman Factors and Growth From detecting malware with Velociraptor and Q9, to encountering teammates who took orders literally, the learning was intense. One participant noted that while Belgian and Luxembourg teams prioritized knowledge sharing, others preferred strict protocol. This highlighted cultural differences and the importance of interpersonal skills.\nThe biggest lesson? You are never fully prepared. Every iteration of Locked Shields is different. But each one sharpens not only your skills, but also your ability to function as a team under extreme conditions.\nFrom the Battlefield to the Classroom This experience directly impacts the classroom. Inspired by the exercise, Howest is introducing new hands-on courses like “Glutamine” in semester five. Students will be dropped into realistic broken networks, with misconfigurations, fake firewalls and simulated threats. It is chaos, but controlled. And that is the point.\nAs one speaker said: “You don’t win Locked Shields. You just survive it better than the rest.”\nFinal Thoughts The exercise teaches more than just cybersecurity. It builds trust. It proves that knowing your teammates can be as important as knowing the tools. Whether that comes from a shared flight or a pre-exercise barbecue, it all matters when the pressure hits.\nWant to see how cyber defence works in real life? This is it.\n","date":"May 13, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog-2_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog-2_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-1/","title":"Cyber Defence on the Digital Frontline: A Mission with NATO"},{"categories":null,"contents":"I built my personal blog using Hugo and deployed it on a lightweight Alpine Linux VPS. I chose this setup to have full control, keep things simple, and avoid bloated platforms or services. Here’s how the process went from site generation to live deployment.\nCreating the Hugo Site On my development machine, I created a new Hugo site:\nhugo new site howest-blog I used the professors-hugo theme and copied its exampleSite content into my project. I customized the layout, structure, and styling by editing content files, SCSS in assets/scss/custom.scss, and partial templates in the theme directory.\nAll content lives under content/, with separate folders for blog/ and project/, each containing .md files with front matter and Markdown content.\nCustomization I edited the config/_default/hugo.toml to configure site parameters like the base URL, theme, language, and menus. SCSS and image assets go in assets/, and are processed by Hugo\u0026rsquo;s pipeline. Static files like favicons are placed in static/.\nTo preview the site locally:\nhugo server To build the static site:\nhugo This generates everything in the public/ folder.\nVPS Deployment I rented a minimal Alpine Linux VPS and installed only what I needed. After setting up SSH and a basic nginx web server, I copied the public/ folder over using scp:\nscp -r public/* user@my-vps:/var/www/html On the VPS, I installed nginx:\napk add nginx And configured /etc/nginx/conf.d/default.conf to serve files from /var/www/html. Then I enabled and started nginx:\nrc-service nginx start rc-update add nginx Now my Hugo site is live and served directly as static files—no backend, no database, just HTML, CSS, and JS.\nWhy Alpine + Hugo? Alpine Linux is minimal and fast, perfect for serving static sites with low resource usage. Combined with Hugo’s speed and flexibility, I get a complete, performant setup that I fully control. It’s secure, lightweight, and easy to update—just rebuild and re-upload the public/ folder.\nThis setup is perfect if you want full control and minimal overhead for a personal blog or portfolio.\n","date":"May 29, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-2/","title":"Building My Hugo Website on a VPS"},{"categories":null,"contents":"DRMDTool is an automation-centric utility designed to streamline the processing of .drmd files by tightly integrating with the N_m3u8DL-RE downloader. The tool offers robust automation via a watch folder and an intuitive web-based interface, significantly reducing the friction for managing and processing DRM-protected streaming content.\nWhat’s New DRMDTool has evolved into a comprehensive platform for batch downloading with enhanced support for user interaction and background processing. It features granular job tracking, dynamic download control (pause, resume, abort), and a refined WebSocket-based console for real-time command output. Subtitle handling now includes automatic downloading and conversion from VTT to SRT, and the downloader adapts based on metadata, organizing content into categorized directories.\nGoals and Use Case The primary aim is to automate .drmd file processing with minimal manual input. Users can configure download formats, specify directories, and enable real-time command broadcasting. DRMDTool is suitable for both interactive use through a web UI and headless automation in pipelines, supporting inotify or polling-based folder watching.\nHow .drmd Files Work A .drmd file is a structured JSON document that defines one or more encrypted media items to be processed by DRMDTool. It contains an Items array, with each item representing a specific media job. DRMDTool parses these entries to generate download commands for N_m3u8DL-RE.\nEach item includes:\nMPD: A DASH manifest, either a direct URL or a base64-encoded version. If base64-encoded, DRMDTool decodes and temporarily saves it before use. Keys: A comma-separated list of KID:key pairs (e.g., abcd1234ef567890:00112233445566778899aabbccddeeff). These are required for decrypting encrypted media streams and are passed directly to N_m3u8DL-RE using --key flags. Filename: The name to be used for the final output file. Subtitles: Comma-separated list of subtitle URLs in .vtt format. DRMDTool downloads and converts these to .srt, then muxes them into the final file. Metadata: A semicolon-separated string like Title;Type;Season (e.g., Example Show;serie;1) used to determine directory structure (Movies/Title or Series/Title/Season). Description and Poster: Optional fields used only for display in the web UI. Example .drmd Structure { \u0026#34;Items\u0026#34;: [ { \u0026#34;MPD\u0026#34;: \u0026#34;aHR0cHM6Ly9leGFtcGxlLmNvbS9zdHJlYW0ubXBk\u0026#34;, \u0026#34;Keys\u0026#34;: \u0026#34;abcd1234ef567890:00112233445566778899aabbccddeeff\u0026#34;, \u0026#34;Filename\u0026#34;: \u0026#34;ExampleShow.S01E01\u0026#34;, \u0026#34;Subtitles\u0026#34;: \u0026#34;https://example.com/sub1.vtt,https://example.com/sub2.vtt\u0026#34;, \u0026#34;Metadata\u0026#34;: \u0026#34;Example Show;serie;1\u0026#34;, \u0026#34;Description\u0026#34;: \u0026#34;Pilot episode\u0026#34;, \u0026#34;Poster\u0026#34;: \u0026#34;\u0026#34; } ] } Processing Steps Detection: DRMDTool either watches a folder or receives .drmd uploads through the web UI. Validation: It waits for the file to finish writing (based on file size stability), then parses its contents. MPD Handling: If base64-encoded, the MPD is decoded and written to a temp file; otherwise, the URL is fetched or passed as-is. Command Generation: Using the MPD, KID:key pairs, output paths, and subtitles, DRMDTool builds a command line for N_m3u8DL-RE. Execution: The download is launched with live progress tracking. Users can pause, resume, or abort jobs, and optionally stream console output via WebSocket. These files serve as portable job definitions. When DRMDTool detects or receives a .drmd file, it parses the items, decodes or downloads the MPD, applies the keys, and builds a download command using N_m3u8DL-RE. Files are saved in organized directories like Movies/Title or Series/Title/Season, and subtitles are embedded if available. Pausing, resuming, and aborting downloads is supported per file.\nArchitecture Overview The configuration is handled via config.toml, with environment variable overrides for containerized or dynamic deployments. Once started, the tool can either monitor a specified folder or allow file uploads through the UI. Each .drmd file is parsed, grouped by series and season (if applicable), and processed sequentially with support for job pausing and resuming.\nWeb UI \u0026amp; CLI To use:\n./drmdtool Visit http://localhost:8080 for the web interface, which supports drag-and-drop uploads, selection of episodes or movies, and real-time progress tracking. For headless operation:\n./drmdtool -f /path/to/file.drmd Jobs can be paused, resumed, or aborted through the web interface, which reflects the backend state via live updates.\nEnhanced Download Logic DRMDTool dynamically builds download commands using metadata from .drmd files and user preferences. It ensures that only the highest quality streams are kept, removing ad periods and duplicate segments from the MPD files. Subtitles are fetched and embedded automatically. Jobs are tracked with robust state management and logs for debugging and visibility.\nRepository Code and setup instructions are hosted here: https://git.directme.in/Joren/DRMDTool\nDRMDtool For advanced usage details, customization, and API structure, refer to the README.md in the repository.\nUI Previews Index Page Select Page Progress Page ","date":"May 21, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-1/","title":"DRMDTool Project"},{"categories":["cybersecurity","event recap"],"contents":"Cyber Defence on the Digital Frontline: A Mission with NATO On a Mission with NATO: Cyber Defence on the Frontline Howest’s ongoing commitment to world-class cybersecurity training took center stage again as six lecturers from the Cyber Security program joined forces with experts from Latvia, Luxembourg and Belgium in one of NATO\u0026rsquo;s most intensive simulations: the Locked Shields exercise, hosted by the Cooperative Cyber Defence Centre of Excellence (CCDCOE). Now in its fifth year of participation, the Howest team shared their firsthand experiences at a special evening talk at Howest Bruges.\nThe Exercise: Locked Shields Locked Shields is no ordinary simulation. It is a full-scale, live-fire cyber defence exercise involving more than 6,000 machines and a narrative scenario so detailed it includes geopolitics, disinformation and even fictional countries. This year, the Blue Team 03 (our team) defended a simulated nation’s critical infrastructure including power plants, satellites, 5G networks and banking systems, all while under constant attack from a coordinated Red Team using automated scripts and over 28,000 attacks across two days.\nAnd yes, every team (Red, Blue, Yellow, White) uses Ansible. For everything.\nHigh Stakes, Real Lessons What do you do when a rogue process might be malware, or maybe just a poorly named service? What happens when your teammate refuses to act unless something is “officially malicious”? The team faced cultural clashes, communication breakdowns and stress-testing of both systems and people.\nThe exercise required more than technical fixes. It demanded communication with simulated commanders, media and public stakeholders. Reporting became just as important as patching. It taught participants how to translate technical impact into real-world consequences. Not \u0026ldquo;port 8443 unreachable\u0026rdquo;, but \u0026ldquo;our air defence system is degraded, and we cannot fly planes\u0026rdquo;.\nThe Black Team: Rapid Response in Action A new but powerful presence in the simulation was the Black Team, a rapid-response unit deployed when problems became too complex for any single team. Acting like special forces, they jumped in when incidents crossed team boundaries or demanded unconventional solutions. Their mission was to find out what was happening, assess the impact and suggest fast, creative responses. Introduced just last year, this team quickly proved its value again in 2025. They even embraced the role with style — “you can wear sunglasses inside” became their unofficial motto.\nTheir presence underlined a critical lesson: not every problem fits neatly within a team’s silo. Real-world defence requires flexibility, speed and lateral thinking.\nHighlights and Blooper Reel There were plenty of mishaps. Misfired scripts, team mix-ups, and one case where a DNS setup from a previous year was reused by mistake. Someone tried renaming cut to shutdown, breaking essential operations until it was fixed. Systems rebooted into chaos, a manual was uploaded to public GitHub, and the team had to quickly learn the difference between symbolic links and real binaries.\nHuman Factors and Growth From detecting malware with Velociraptor and Q9, to encountering teammates who took orders literally, the learning was intense. One participant noted that while Belgian and Luxembourg teams prioritized knowledge sharing, others preferred strict protocol. This highlighted cultural differences and the importance of interpersonal skills.\nThe biggest lesson? You are never fully prepared. Every iteration of Locked Shields is different. But each one sharpens not only your skills, but also your ability to function as a team under extreme conditions.\nFrom the Battlefield to the Classroom This experience directly impacts the classroom. Inspired by the exercise, Howest is introducing new hands-on courses like “Glutamine” in semester five. Students will be dropped into realistic broken networks, with misconfigurations, fake firewalls and simulated threats. It is chaos, but controlled. And that is the point.\nAs one speaker said: “You don’t win Locked Shields. You just survive it better than the rest.”\nFinal Thoughts The exercise teaches more than just cybersecurity. It builds trust. It proves that knowing your teammates can be as important as knowing the tools. Whether that comes from a shared flight or a pre-exercise barbecue, it all matters when the pressure hits.\nWant to see how cyber defence works in real life? This is it.\n","date":"May 13, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog-2_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog-2_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-1/","title":"Cyber Defence on the Digital Frontline: A Mission with NATO"},{"categories":["cybersecurity","event recap"],"contents":"Cyber Defence on the Digital Frontline: A Mission with NATO On a Mission with NATO: Cyber Defence on the Frontline Howest’s ongoing commitment to world-class cybersecurity training took center stage again as six lecturers from the Cyber Security program joined forces with experts from Latvia, Luxembourg and Belgium in one of NATO\u0026rsquo;s most intensive simulations: the Locked Shields exercise, hosted by the Cooperative Cyber Defence Centre of Excellence (CCDCOE). Now in its fifth year of participation, the Howest team shared their firsthand experiences at a special evening talk at Howest Bruges.\nThe Exercise: Locked Shields Locked Shields is no ordinary simulation. It is a full-scale, live-fire cyber defence exercise involving more than 6,000 machines and a narrative scenario so detailed it includes geopolitics, disinformation and even fictional countries. This year, the Blue Team 03 (our team) defended a simulated nation’s critical infrastructure including power plants, satellites, 5G networks and banking systems, all while under constant attack from a coordinated Red Team using automated scripts and over 28,000 attacks across two days.\nAnd yes, every team (Red, Blue, Yellow, White) uses Ansible. For everything.\nHigh Stakes, Real Lessons What do you do when a rogue process might be malware, or maybe just a poorly named service? What happens when your teammate refuses to act unless something is “officially malicious”? The team faced cultural clashes, communication breakdowns and stress-testing of both systems and people.\nThe exercise required more than technical fixes. It demanded communication with simulated commanders, media and public stakeholders. Reporting became just as important as patching. It taught participants how to translate technical impact into real-world consequences. Not \u0026ldquo;port 8443 unreachable\u0026rdquo;, but \u0026ldquo;our air defence system is degraded, and we cannot fly planes\u0026rdquo;.\nThe Black Team: Rapid Response in Action A new but powerful presence in the simulation was the Black Team, a rapid-response unit deployed when problems became too complex for any single team. Acting like special forces, they jumped in when incidents crossed team boundaries or demanded unconventional solutions. Their mission was to find out what was happening, assess the impact and suggest fast, creative responses. Introduced just last year, this team quickly proved its value again in 2025. They even embraced the role with style — “you can wear sunglasses inside” became their unofficial motto.\nTheir presence underlined a critical lesson: not every problem fits neatly within a team’s silo. Real-world defence requires flexibility, speed and lateral thinking.\nHighlights and Blooper Reel There were plenty of mishaps. Misfired scripts, team mix-ups, and one case where a DNS setup from a previous year was reused by mistake. Someone tried renaming cut to shutdown, breaking essential operations until it was fixed. Systems rebooted into chaos, a manual was uploaded to public GitHub, and the team had to quickly learn the difference between symbolic links and real binaries.\nHuman Factors and Growth From detecting malware with Velociraptor and Q9, to encountering teammates who took orders literally, the learning was intense. One participant noted that while Belgian and Luxembourg teams prioritized knowledge sharing, others preferred strict protocol. This highlighted cultural differences and the importance of interpersonal skills.\nThe biggest lesson? You are never fully prepared. Every iteration of Locked Shields is different. But each one sharpens not only your skills, but also your ability to function as a team under extreme conditions.\nFrom the Battlefield to the Classroom This experience directly impacts the classroom. Inspired by the exercise, Howest is introducing new hands-on courses like “Glutamine” in semester five. Students will be dropped into realistic broken networks, with misconfigurations, fake firewalls and simulated threats. It is chaos, but controlled. And that is the point.\nAs one speaker said: “You don’t win Locked Shields. You just survive it better than the rest.”\nFinal Thoughts The exercise teaches more than just cybersecurity. It builds trust. It proves that knowing your teammates can be as important as knowing the tools. Whether that comes from a shared flight or a pre-exercise barbecue, it all matters when the pressure hits.\nWant to see how cyber defence works in real life? This is it.\n","date":"May 13, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog-2_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog-2_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-2/","title":"Cyber Defence on the Digital Frontline: A Mission with NATO"},{"categories":null,"contents":"I built my personal blog using Hugo and deployed it on a lightweight Alpine Linux VPS. I chose this setup to have full control, keep things simple, and avoid bloated platforms or services. Here’s how the process went from site generation to live deployment.\nCreating the Hugo Site On my development machine, I created a new Hugo site:\nhugo new site howest-blog I used the professors-hugo theme and copied its exampleSite content into my project. I customized the layout, structure, and styling by editing content files, SCSS in assets/scss/custom.scss, and partial templates in the theme directory.\nAll content lives under content/, with separate folders for blog/ and project/, each containing .md files with front matter and Markdown content.\nCustomization I edited the config/_default/hugo.toml to configure site parameters like the base URL, theme, language, and menus. SCSS and image assets go in assets/, and are processed by Hugo\u0026rsquo;s pipeline. Static files like favicons are placed in static/.\nTo preview the site locally:\nhugo server To build the static site:\nhugo This generates everything in the public/ folder.\nVPS Deployment I rented a minimal Alpine Linux VPS and installed only what I needed. After setting up SSH and a basic nginx web server, I copied the public/ folder over using scp:\nscp -r public/* user@my-vps:/var/www/html On the VPS, I installed nginx:\napk add nginx And configured /etc/nginx/conf.d/default.conf to serve files from /var/www/html. Then I enabled and started nginx:\nrc-service nginx start rc-update add nginx Now my Hugo site is live and served directly as static files—no backend, no database, just HTML, CSS, and JS.\nWhy Alpine + Hugo? Alpine Linux is minimal and fast, perfect for serving static sites with low resource usage. Combined with Hugo’s speed and flexibility, I get a complete, performant setup that I fully control. It’s secure, lightweight, and easy to update—just rebuild and re-upload the public/ folder.\nThis setup is perfect if you want full control and minimal overhead for a personal blog or portfolio.\n","date":"May 29, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-2/","title":"Building My Hugo Website on a VPS"},{"categories":null,"contents":"DRMDTool is an automation-centric utility designed to streamline the processing of .drmd files by tightly integrating with the N_m3u8DL-RE downloader. The tool offers robust automation via a watch folder and an intuitive web-based interface, significantly reducing the friction for managing and processing DRM-protected streaming content.\nWhat’s New DRMDTool has evolved into a comprehensive platform for batch downloading with enhanced support for user interaction and background processing. It features granular job tracking, dynamic download control (pause, resume, abort), and a refined WebSocket-based console for real-time command output. Subtitle handling now includes automatic downloading and conversion from VTT to SRT, and the downloader adapts based on metadata, organizing content into categorized directories.\nGoals and Use Case The primary aim is to automate .drmd file processing with minimal manual input. Users can configure download formats, specify directories, and enable real-time command broadcasting. DRMDTool is suitable for both interactive use through a web UI and headless automation in pipelines, supporting inotify or polling-based folder watching.\nHow .drmd Files Work A .drmd file is a structured JSON document that defines one or more encrypted media items to be processed by DRMDTool. It contains an Items array, with each item representing a specific media job. DRMDTool parses these entries to generate download commands for N_m3u8DL-RE.\nEach item includes:\nMPD: A DASH manifest, either a direct URL or a base64-encoded version. If base64-encoded, DRMDTool decodes and temporarily saves it before use. Keys: A comma-separated list of KID:key pairs (e.g., abcd1234ef567890:00112233445566778899aabbccddeeff). These are required for decrypting encrypted media streams and are passed directly to N_m3u8DL-RE using --key flags. Filename: The name to be used for the final output file. Subtitles: Comma-separated list of subtitle URLs in .vtt format. DRMDTool downloads and converts these to .srt, then muxes them into the final file. Metadata: A semicolon-separated string like Title;Type;Season (e.g., Example Show;serie;1) used to determine directory structure (Movies/Title or Series/Title/Season). Description and Poster: Optional fields used only for display in the web UI. Example .drmd Structure { \u0026#34;Items\u0026#34;: [ { \u0026#34;MPD\u0026#34;: \u0026#34;aHR0cHM6Ly9leGFtcGxlLmNvbS9zdHJlYW0ubXBk\u0026#34;, \u0026#34;Keys\u0026#34;: \u0026#34;abcd1234ef567890:00112233445566778899aabbccddeeff\u0026#34;, \u0026#34;Filename\u0026#34;: \u0026#34;ExampleShow.S01E01\u0026#34;, \u0026#34;Subtitles\u0026#34;: \u0026#34;https://example.com/sub1.vtt,https://example.com/sub2.vtt\u0026#34;, \u0026#34;Metadata\u0026#34;: \u0026#34;Example Show;serie;1\u0026#34;, \u0026#34;Description\u0026#34;: \u0026#34;Pilot episode\u0026#34;, \u0026#34;Poster\u0026#34;: \u0026#34;\u0026#34; } ] } Processing Steps Detection: DRMDTool either watches a folder or receives .drmd uploads through the web UI. Validation: It waits for the file to finish writing (based on file size stability), then parses its contents. MPD Handling: If base64-encoded, the MPD is decoded and written to a temp file; otherwise, the URL is fetched or passed as-is. Command Generation: Using the MPD, KID:key pairs, output paths, and subtitles, DRMDTool builds a command line for N_m3u8DL-RE. Execution: The download is launched with live progress tracking. Users can pause, resume, or abort jobs, and optionally stream console output via WebSocket. These files serve as portable job definitions. When DRMDTool detects or receives a .drmd file, it parses the items, decodes or downloads the MPD, applies the keys, and builds a download command using N_m3u8DL-RE. Files are saved in organized directories like Movies/Title or Series/Title/Season, and subtitles are embedded if available. Pausing, resuming, and aborting downloads is supported per file.\nArchitecture Overview The configuration is handled via config.toml, with environment variable overrides for containerized or dynamic deployments. Once started, the tool can either monitor a specified folder or allow file uploads through the UI. Each .drmd file is parsed, grouped by series and season (if applicable), and processed sequentially with support for job pausing and resuming.\nWeb UI \u0026amp; CLI To use:\n./drmdtool Visit http://localhost:8080 for the web interface, which supports drag-and-drop uploads, selection of episodes or movies, and real-time progress tracking. For headless operation:\n./drmdtool -f /path/to/file.drmd Jobs can be paused, resumed, or aborted through the web interface, which reflects the backend state via live updates.\nEnhanced Download Logic DRMDTool dynamically builds download commands using metadata from .drmd files and user preferences. It ensures that only the highest quality streams are kept, removing ad periods and duplicate segments from the MPD files. Subtitles are fetched and embedded automatically. Jobs are tracked with robust state management and logs for debugging and visibility.\nRepository Code and setup instructions are hosted here: https://git.directme.in/Joren/DRMDTool\nDRMDtool For advanced usage details, customization, and API structure, refer to the README.md in the repository.\nUI Previews Index Page Select Page Progress Page ","date":"May 21, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-1/","title":"DRMDTool Project"},{"categories":["cybersecurity","event recap"],"contents":"Cyber Defence on the Digital Frontline: A Mission with NATO On a Mission with NATO: Cyber Defence on the Frontline Howest’s ongoing commitment to world-class cybersecurity training took center stage again as six lecturers from the Cyber Security program joined forces with experts from Latvia, Luxembourg and Belgium in one of NATO\u0026rsquo;s most intensive simulations: the Locked Shields exercise, hosted by the Cooperative Cyber Defence Centre of Excellence (CCDCOE). Now in its fifth year of participation, the Howest team shared their firsthand experiences at a special evening talk at Howest Bruges.\nThe Exercise: Locked Shields Locked Shields is no ordinary simulation. It is a full-scale, live-fire cyber defence exercise involving more than 6,000 machines and a narrative scenario so detailed it includes geopolitics, disinformation and even fictional countries. This year, the Blue Team 03 (our team) defended a simulated nation’s critical infrastructure including power plants, satellites, 5G networks and banking systems, all while under constant attack from a coordinated Red Team using automated scripts and over 28,000 attacks across two days.\nAnd yes, every team (Red, Blue, Yellow, White) uses Ansible. For everything.\nHigh Stakes, Real Lessons What do you do when a rogue process might be malware, or maybe just a poorly named service? What happens when your teammate refuses to act unless something is “officially malicious”? The team faced cultural clashes, communication breakdowns and stress-testing of both systems and people.\nThe exercise required more than technical fixes. It demanded communication with simulated commanders, media and public stakeholders. Reporting became just as important as patching. It taught participants how to translate technical impact into real-world consequences. Not \u0026ldquo;port 8443 unreachable\u0026rdquo;, but \u0026ldquo;our air defence system is degraded, and we cannot fly planes\u0026rdquo;.\nThe Black Team: Rapid Response in Action A new but powerful presence in the simulation was the Black Team, a rapid-response unit deployed when problems became too complex for any single team. Acting like special forces, they jumped in when incidents crossed team boundaries or demanded unconventional solutions. Their mission was to find out what was happening, assess the impact and suggest fast, creative responses. Introduced just last year, this team quickly proved its value again in 2025. They even embraced the role with style — “you can wear sunglasses inside” became their unofficial motto.\nTheir presence underlined a critical lesson: not every problem fits neatly within a team’s silo. Real-world defence requires flexibility, speed and lateral thinking.\nHighlights and Blooper Reel There were plenty of mishaps. Misfired scripts, team mix-ups, and one case where a DNS setup from a previous year was reused by mistake. Someone tried renaming cut to shutdown, breaking essential operations until it was fixed. Systems rebooted into chaos, a manual was uploaded to public GitHub, and the team had to quickly learn the difference between symbolic links and real binaries.\nHuman Factors and Growth From detecting malware with Velociraptor and Q9, to encountering teammates who took orders literally, the learning was intense. One participant noted that while Belgian and Luxembourg teams prioritized knowledge sharing, others preferred strict protocol. This highlighted cultural differences and the importance of interpersonal skills.\nThe biggest lesson? You are never fully prepared. Every iteration of Locked Shields is different. But each one sharpens not only your skills, but also your ability to function as a team under extreme conditions.\nFrom the Battlefield to the Classroom This experience directly impacts the classroom. Inspired by the exercise, Howest is introducing new hands-on courses like “Glutamine” in semester five. Students will be dropped into realistic broken networks, with misconfigurations, fake firewalls and simulated threats. It is chaos, but controlled. And that is the point.\nAs one speaker said: “You don’t win Locked Shields. You just survive it better than the rest.”\nFinal Thoughts The exercise teaches more than just cybersecurity. It builds trust. It proves that knowing your teammates can be as important as knowing the tools. Whether that comes from a shared flight or a pre-exercise barbecue, it all matters when the pressure hits.\nWant to see how cyber defence works in real life? This is it.\n","date":"May 13, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog-2_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog-2_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-1/","title":"Cyber Defence on the Digital Frontline: A Mission with NATO"},{"categories":["cybersecurity","CTF","education"],"contents":"From Android Reversing to Broken TLS: My Experience at the Cyber Security Challenge Belgium Qualifiers On March 14 and 15, I participated in the qualifiers of the 2025 Cyber Security Challenge Belgium. Together with three friends, we formed a team and spent two days on the CTF platform solving as many challenges as we could. This post sums up the problems I personally worked on—some I solved, some I didn’t, all of them worth the effort.\nBinary Exploitation: Finding the Overflow One of the first challenges I tackled was a buffer overflow. I loaded up the binary, found a vulnerable input (classic stack overflow), and started identifying the offset to control the return address. After a few crashes and tweaks, I was able to craft a working payload that redirected execution as intended. Simple in theory, stressful under time pressure—but extremely satisfying when it worked.\nAndroid Reversing with FRIDA and JADX I also spent a lot of time on Android challenges. I decompiled APKs using JADX to inspect the smali and Java code, and used FRIDA to patch logic at runtime. In one challenge, the app had some kind of license check buried in native code. I hooked into the relevant functions and bypassed it dynamically to get access to a hidden section of the app. It was a good exercise in runtime instrumentation and understanding how apps obfuscate key logic.\nCryptography: Guessing Seeds There was one crypto challenge where the output was based on a seeded ASCII art banner. The idea was to identify the seed that matched a known banner fragment. I brute-forced the space with a simple script that regenerated outputs and matched the result:\nfor seed in range(1000000): if extract_letters(generate_banner(seed)) == target: print(\u0026#34;Found seed:\u0026#34;, seed) This one worked—after a few minutes of searching, I found the right seed and submitted the flag.\nThe Go Server That Didn’t Budge One of the most frustrating challenges I tried involved a Go server that seemed to accept TLS connections only from clients with a very specific fingerprint. I tried replicating the behavior by configuring the cipher suite, ALPN, and HTTP/2 settings using Go’s tls.Config:\ntls.Config{ MinVersion: tls.VersionTLS13, CipherSuites: []uint16{ tls.TLS_AES_128_GCM_SHA256, // ... }, NextProtos: []string{\u0026#34;h2\u0026#34;}, } No matter what I tried, the server kept rejecting my connections. I suspect it was checking something deeper—maybe something like JA4, where even the order of extensions or handshake details mattered. It’s one of the challenges that stuck with me afterward, mainly because I still don’t know exactly what I missed.\nWorking as a Team Even though this post focuses on the challenges I worked on, we didn’t compete alone. Evarist, Nathan, and Waut were part of the team too. We each picked categories we were comfortable with and helped each other when someone got stuck. Most of the time, we split up and regrouped when we needed a fresh look or second opinion.\nFinal Thoughts We only did the qualifiers this year, but it was worth it. Every challenge—whether it involved RE, crypto, or failed TLS experiments—taught me something. If you like breaking stuff, debugging weird behavior, and learning under pressure, you should definitely try this competition.\nI’m already looking forward to the next one.\nInfo\nWant to try it next year? You don’t need to solve everything—just pick a challenge, dive in, and learn as much as you can.\n","date":"March 15, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog-2_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog-2_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-2/","title":"From Android Reversing to Broken TLS: My Experience at the Cyber Security Challenge Belgium Qualifiers"},{"categories":null,"contents":"I built my personal blog using Hugo and deployed it on a lightweight Alpine Linux VPS. I chose this setup to have full control, keep things simple, and avoid bloated platforms or services. Here’s how the process went from site generation to live deployment.\nCreating the Hugo Site On my development machine, I created a new Hugo site:\nhugo new site howest-blog I used the professors-hugo theme and copied its exampleSite content into my project. I customized the layout, structure, and styling by editing content files, SCSS in assets/scss/custom.scss, and partial templates in the theme directory.\nAll content lives under content/, with separate folders for blog/ and project/, each containing .md files with front matter and Markdown content.\nCustomization I edited the config/_default/hugo.toml to configure site parameters like the base URL, theme, language, and menus. SCSS and image assets go in assets/, and are processed by Hugo\u0026rsquo;s pipeline. Static files like favicons are placed in static/.\nTo preview the site locally:\nhugo server To build the static site:\nhugo This generates everything in the public/ folder.\nVPS Deployment I rented a minimal Alpine Linux VPS and installed only what I needed. After setting up SSH and a basic nginx web server, I copied the public/ folder over using scp:\nscp -r public/* user@my-vps:/var/www/html On the VPS, I installed nginx:\napk add nginx And configured /etc/nginx/conf.d/default.conf to serve files from /var/www/html. Then I enabled and started nginx:\nrc-service nginx start rc-update add nginx Now my Hugo site is live and served directly as static files—no backend, no database, just HTML, CSS, and JS.\nWhy Alpine + Hugo? Alpine Linux is minimal and fast, perfect for serving static sites with low resource usage. Combined with Hugo’s speed and flexibility, I get a complete, performant setup that I fully control. It’s secure, lightweight, and easy to update—just rebuild and re-upload the public/ folder.\nThis setup is perfect if you want full control and minimal overhead for a personal blog or portfolio.\n","date":"May 29, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-2/","title":"Building My Hugo Website on a VPS"},{"categories":null,"contents":"DRMDTool is an automation-centric utility designed to streamline the processing of .drmd files by tightly integrating with the N_m3u8DL-RE downloader. The tool offers robust automation via a watch folder and an intuitive web-based interface, significantly reducing the friction for managing and processing DRM-protected streaming content.\nWhat’s New DRMDTool has evolved into a comprehensive platform for batch downloading with enhanced support for user interaction and background processing. It features granular job tracking, dynamic download control (pause, resume, abort), and a refined WebSocket-based console for real-time command output. Subtitle handling now includes automatic downloading and conversion from VTT to SRT, and the downloader adapts based on metadata, organizing content into categorized directories.\nGoals and Use Case The primary aim is to automate .drmd file processing with minimal manual input. Users can configure download formats, specify directories, and enable real-time command broadcasting. DRMDTool is suitable for both interactive use through a web UI and headless automation in pipelines, supporting inotify or polling-based folder watching.\nHow .drmd Files Work A .drmd file is a structured JSON document that defines one or more encrypted media items to be processed by DRMDTool. It contains an Items array, with each item representing a specific media job. DRMDTool parses these entries to generate download commands for N_m3u8DL-RE.\nEach item includes:\nMPD: A DASH manifest, either a direct URL or a base64-encoded version. If base64-encoded, DRMDTool decodes and temporarily saves it before use. Keys: A comma-separated list of KID:key pairs (e.g., abcd1234ef567890:00112233445566778899aabbccddeeff). These are required for decrypting encrypted media streams and are passed directly to N_m3u8DL-RE using --key flags. Filename: The name to be used for the final output file. Subtitles: Comma-separated list of subtitle URLs in .vtt format. DRMDTool downloads and converts these to .srt, then muxes them into the final file. Metadata: A semicolon-separated string like Title;Type;Season (e.g., Example Show;serie;1) used to determine directory structure (Movies/Title or Series/Title/Season). Description and Poster: Optional fields used only for display in the web UI. Example .drmd Structure { \u0026#34;Items\u0026#34;: [ { \u0026#34;MPD\u0026#34;: \u0026#34;aHR0cHM6Ly9leGFtcGxlLmNvbS9zdHJlYW0ubXBk\u0026#34;, \u0026#34;Keys\u0026#34;: \u0026#34;abcd1234ef567890:00112233445566778899aabbccddeeff\u0026#34;, \u0026#34;Filename\u0026#34;: \u0026#34;ExampleShow.S01E01\u0026#34;, \u0026#34;Subtitles\u0026#34;: \u0026#34;https://example.com/sub1.vtt,https://example.com/sub2.vtt\u0026#34;, \u0026#34;Metadata\u0026#34;: \u0026#34;Example Show;serie;1\u0026#34;, \u0026#34;Description\u0026#34;: \u0026#34;Pilot episode\u0026#34;, \u0026#34;Poster\u0026#34;: \u0026#34;\u0026#34; } ] } Processing Steps Detection: DRMDTool either watches a folder or receives .drmd uploads through the web UI. Validation: It waits for the file to finish writing (based on file size stability), then parses its contents. MPD Handling: If base64-encoded, the MPD is decoded and written to a temp file; otherwise, the URL is fetched or passed as-is. Command Generation: Using the MPD, KID:key pairs, output paths, and subtitles, DRMDTool builds a command line for N_m3u8DL-RE. Execution: The download is launched with live progress tracking. Users can pause, resume, or abort jobs, and optionally stream console output via WebSocket. These files serve as portable job definitions. When DRMDTool detects or receives a .drmd file, it parses the items, decodes or downloads the MPD, applies the keys, and builds a download command using N_m3u8DL-RE. Files are saved in organized directories like Movies/Title or Series/Title/Season, and subtitles are embedded if available. Pausing, resuming, and aborting downloads is supported per file.\nArchitecture Overview The configuration is handled via config.toml, with environment variable overrides for containerized or dynamic deployments. Once started, the tool can either monitor a specified folder or allow file uploads through the UI. Each .drmd file is parsed, grouped by series and season (if applicable), and processed sequentially with support for job pausing and resuming.\nWeb UI \u0026amp; CLI To use:\n./drmdtool Visit http://localhost:8080 for the web interface, which supports drag-and-drop uploads, selection of episodes or movies, and real-time progress tracking. For headless operation:\n./drmdtool -f /path/to/file.drmd Jobs can be paused, resumed, or aborted through the web interface, which reflects the backend state via live updates.\nEnhanced Download Logic DRMDTool dynamically builds download commands using metadata from .drmd files and user preferences. It ensures that only the highest quality streams are kept, removing ad periods and duplicate segments from the MPD files. Subtitles are fetched and embedded automatically. Jobs are tracked with robust state management and logs for debugging and visibility.\nRepository Code and setup instructions are hosted here: https://git.directme.in/Joren/DRMDTool\nDRMDtool For advanced usage details, customization, and API structure, refer to the README.md in the repository.\nUI Previews Index Page Select Page Progress Page ","date":"May 21, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-1/","title":"DRMDTool Project"},{"categories":["cybersecurity","event recap"],"contents":"Cyber Defence on the Digital Frontline: A Mission with NATO On a Mission with NATO: Cyber Defence on the Frontline Howest’s ongoing commitment to world-class cybersecurity training took center stage again as six lecturers from the Cyber Security program joined forces with experts from Latvia, Luxembourg and Belgium in one of NATO\u0026rsquo;s most intensive simulations: the Locked Shields exercise, hosted by the Cooperative Cyber Defence Centre of Excellence (CCDCOE). Now in its fifth year of participation, the Howest team shared their firsthand experiences at a special evening talk at Howest Bruges.\nThe Exercise: Locked Shields Locked Shields is no ordinary simulation. It is a full-scale, live-fire cyber defence exercise involving more than 6,000 machines and a narrative scenario so detailed it includes geopolitics, disinformation and even fictional countries. This year, the Blue Team 03 (our team) defended a simulated nation’s critical infrastructure including power plants, satellites, 5G networks and banking systems, all while under constant attack from a coordinated Red Team using automated scripts and over 28,000 attacks across two days.\nAnd yes, every team (Red, Blue, Yellow, White) uses Ansible. For everything.\nHigh Stakes, Real Lessons What do you do when a rogue process might be malware, or maybe just a poorly named service? What happens when your teammate refuses to act unless something is “officially malicious”? The team faced cultural clashes, communication breakdowns and stress-testing of both systems and people.\nThe exercise required more than technical fixes. It demanded communication with simulated commanders, media and public stakeholders. Reporting became just as important as patching. It taught participants how to translate technical impact into real-world consequences. Not \u0026ldquo;port 8443 unreachable\u0026rdquo;, but \u0026ldquo;our air defence system is degraded, and we cannot fly planes\u0026rdquo;.\nThe Black Team: Rapid Response in Action A new but powerful presence in the simulation was the Black Team, a rapid-response unit deployed when problems became too complex for any single team. Acting like special forces, they jumped in when incidents crossed team boundaries or demanded unconventional solutions. Their mission was to find out what was happening, assess the impact and suggest fast, creative responses. Introduced just last year, this team quickly proved its value again in 2025. They even embraced the role with style — “you can wear sunglasses inside” became their unofficial motto.\nTheir presence underlined a critical lesson: not every problem fits neatly within a team’s silo. Real-world defence requires flexibility, speed and lateral thinking.\nHighlights and Blooper Reel There were plenty of mishaps. Misfired scripts, team mix-ups, and one case where a DNS setup from a previous year was reused by mistake. Someone tried renaming cut to shutdown, breaking essential operations until it was fixed. Systems rebooted into chaos, a manual was uploaded to public GitHub, and the team had to quickly learn the difference between symbolic links and real binaries.\nHuman Factors and Growth From detecting malware with Velociraptor and Q9, to encountering teammates who took orders literally, the learning was intense. One participant noted that while Belgian and Luxembourg teams prioritized knowledge sharing, others preferred strict protocol. This highlighted cultural differences and the importance of interpersonal skills.\nThe biggest lesson? You are never fully prepared. Every iteration of Locked Shields is different. But each one sharpens not only your skills, but also your ability to function as a team under extreme conditions.\nFrom the Battlefield to the Classroom This experience directly impacts the classroom. Inspired by the exercise, Howest is introducing new hands-on courses like “Glutamine” in semester five. Students will be dropped into realistic broken networks, with misconfigurations, fake firewalls and simulated threats. It is chaos, but controlled. And that is the point.\nAs one speaker said: “You don’t win Locked Shields. You just survive it better than the rest.”\nFinal Thoughts The exercise teaches more than just cybersecurity. It builds trust. It proves that knowing your teammates can be as important as knowing the tools. Whether that comes from a shared flight or a pre-exercise barbecue, it all matters when the pressure hits.\nWant to see how cyber defence works in real life? This is it.\n","date":"May 13, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog-2_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog-2_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-1/","title":"Cyber Defence on the Digital Frontline: A Mission with NATO"},{"categories":["cybersecurity","CTF","education"],"contents":"From Android Reversing to Broken TLS: My Experience at the Cyber Security Challenge Belgium Qualifiers On March 14 and 15, I participated in the qualifiers of the 2025 Cyber Security Challenge Belgium. Together with three friends, we formed a team and spent two days on the CTF platform solving as many challenges as we could. This post sums up the problems I personally worked on—some I solved, some I didn’t, all of them worth the effort.\nBinary Exploitation: Finding the Overflow One of the first challenges I tackled was a buffer overflow. I loaded up the binary, found a vulnerable input (classic stack overflow), and started identifying the offset to control the return address. After a few crashes and tweaks, I was able to craft a working payload that redirected execution as intended. Simple in theory, stressful under time pressure—but extremely satisfying when it worked.\nAndroid Reversing with FRIDA and JADX I also spent a lot of time on Android challenges. I decompiled APKs using JADX to inspect the smali and Java code, and used FRIDA to patch logic at runtime. In one challenge, the app had some kind of license check buried in native code. I hooked into the relevant functions and bypassed it dynamically to get access to a hidden section of the app. It was a good exercise in runtime instrumentation and understanding how apps obfuscate key logic.\nCryptography: Guessing Seeds There was one crypto challenge where the output was based on a seeded ASCII art banner. The idea was to identify the seed that matched a known banner fragment. I brute-forced the space with a simple script that regenerated outputs and matched the result:\nfor seed in range(1000000): if extract_letters(generate_banner(seed)) == target: print(\u0026#34;Found seed:\u0026#34;, seed) This one worked—after a few minutes of searching, I found the right seed and submitted the flag.\nThe Go Server That Didn’t Budge One of the most frustrating challenges I tried involved a Go server that seemed to accept TLS connections only from clients with a very specific fingerprint. I tried replicating the behavior by configuring the cipher suite, ALPN, and HTTP/2 settings using Go’s tls.Config:\ntls.Config{ MinVersion: tls.VersionTLS13, CipherSuites: []uint16{ tls.TLS_AES_128_GCM_SHA256, // ... }, NextProtos: []string{\u0026#34;h2\u0026#34;}, } No matter what I tried, the server kept rejecting my connections. I suspect it was checking something deeper—maybe something like JA4, where even the order of extensions or handshake details mattered. It’s one of the challenges that stuck with me afterward, mainly because I still don’t know exactly what I missed.\nWorking as a Team Even though this post focuses on the challenges I worked on, we didn’t compete alone. Evarist, Nathan, and Waut were part of the team too. We each picked categories we were comfortable with and helped each other when someone got stuck. Most of the time, we split up and regrouped when we needed a fresh look or second opinion.\nFinal Thoughts We only did the qualifiers this year, but it was worth it. Every challenge—whether it involved RE, crypto, or failed TLS experiments—taught me something. If you like breaking stuff, debugging weird behavior, and learning under pressure, you should definitely try this competition.\nI’m already looking forward to the next one.\nInfo\nWant to try it next year? You don’t need to solve everything—just pick a challenge, dive in, and learn as much as you can.\n","date":"March 15, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog-2_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog-2_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-2/","title":"From Android Reversing to Broken TLS: My Experience at the Cyber Security Challenge Belgium Qualifiers"},{"categories":null,"contents":"I built my personal blog using Hugo and deployed it on a lightweight Alpine Linux VPS. I chose this setup to have full control, keep things simple, and avoid bloated platforms or services. Here’s how the process went from site generation to live deployment.\nCreating the Hugo Site On my development machine, I created a new Hugo site:\nhugo new site howest-blog I used the professors-hugo theme and copied its exampleSite content into my project. I customized the layout, structure, and styling by editing content files, SCSS in assets/scss/custom.scss, and partial templates in the theme directory.\nAll content lives under content/, with separate folders for blog/ and project/, each containing .md files with front matter and Markdown content.\nCustomization I edited the config/_default/hugo.toml to configure site parameters like the base URL, theme, language, and menus. SCSS and image assets go in assets/, and are processed by Hugo\u0026rsquo;s pipeline. Static files like favicons are placed in static/.\nTo preview the site locally:\nhugo server To build the static site:\nhugo This generates everything in the public/ folder.\nVPS Deployment I rented a minimal Alpine Linux VPS and installed only what I needed. After setting up SSH and a basic nginx web server, I copied the public/ folder over using scp:\nscp -r public/* user@my-vps:/var/www/html On the VPS, I installed nginx:\napk add nginx And configured /etc/nginx/conf.d/default.conf to serve files from /var/www/html. Then I enabled and started nginx:\nrc-service nginx start rc-update add nginx Now my Hugo site is live and served directly as static files—no backend, no database, just HTML, CSS, and JS.\nWhy Alpine + Hugo? Alpine Linux is minimal and fast, perfect for serving static sites with low resource usage. Combined with Hugo’s speed and flexibility, I get a complete, performant setup that I fully control. It’s secure, lightweight, and easy to update—just rebuild and re-upload the public/ folder.\nThis setup is perfect if you want full control and minimal overhead for a personal blog or portfolio.\n","date":"May 29, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-2/","title":"Building My Hugo Website on a VPS"},{"categories":null,"contents":"DRMDTool is an automation-centric utility designed to streamline the processing of .drmd files by tightly integrating with the N_m3u8DL-RE downloader. The tool offers robust automation via a watch folder and an intuitive web-based interface, significantly reducing the friction for managing and processing DRM-protected streaming content.\nWhat’s New DRMDTool has evolved into a comprehensive platform for batch downloading with enhanced support for user interaction and background processing. It features granular job tracking, dynamic download control (pause, resume, abort), and a refined WebSocket-based console for real-time command output. Subtitle handling now includes automatic downloading and conversion from VTT to SRT, and the downloader adapts based on metadata, organizing content into categorized directories.\nGoals and Use Case The primary aim is to automate .drmd file processing with minimal manual input. Users can configure download formats, specify directories, and enable real-time command broadcasting. DRMDTool is suitable for both interactive use through a web UI and headless automation in pipelines, supporting inotify or polling-based folder watching.\nHow .drmd Files Work A .drmd file is a structured JSON document that defines one or more encrypted media items to be processed by DRMDTool. It contains an Items array, with each item representing a specific media job. DRMDTool parses these entries to generate download commands for N_m3u8DL-RE.\nEach item includes:\nMPD: A DASH manifest, either a direct URL or a base64-encoded version. If base64-encoded, DRMDTool decodes and temporarily saves it before use. Keys: A comma-separated list of KID:key pairs (e.g., abcd1234ef567890:00112233445566778899aabbccddeeff). These are required for decrypting encrypted media streams and are passed directly to N_m3u8DL-RE using --key flags. Filename: The name to be used for the final output file. Subtitles: Comma-separated list of subtitle URLs in .vtt format. DRMDTool downloads and converts these to .srt, then muxes them into the final file. Metadata: A semicolon-separated string like Title;Type;Season (e.g., Example Show;serie;1) used to determine directory structure (Movies/Title or Series/Title/Season). Description and Poster: Optional fields used only for display in the web UI. Example .drmd Structure { \u0026#34;Items\u0026#34;: [ { \u0026#34;MPD\u0026#34;: \u0026#34;aHR0cHM6Ly9leGFtcGxlLmNvbS9zdHJlYW0ubXBk\u0026#34;, \u0026#34;Keys\u0026#34;: \u0026#34;abcd1234ef567890:00112233445566778899aabbccddeeff\u0026#34;, \u0026#34;Filename\u0026#34;: \u0026#34;ExampleShow.S01E01\u0026#34;, \u0026#34;Subtitles\u0026#34;: \u0026#34;https://example.com/sub1.vtt,https://example.com/sub2.vtt\u0026#34;, \u0026#34;Metadata\u0026#34;: \u0026#34;Example Show;serie;1\u0026#34;, \u0026#34;Description\u0026#34;: \u0026#34;Pilot episode\u0026#34;, \u0026#34;Poster\u0026#34;: \u0026#34;\u0026#34; } ] } Processing Steps Detection: DRMDTool either watches a folder or receives .drmd uploads through the web UI. Validation: It waits for the file to finish writing (based on file size stability), then parses its contents. MPD Handling: If base64-encoded, the MPD is decoded and written to a temp file; otherwise, the URL is fetched or passed as-is. Command Generation: Using the MPD, KID:key pairs, output paths, and subtitles, DRMDTool builds a command line for N_m3u8DL-RE. Execution: The download is launched with live progress tracking. Users can pause, resume, or abort jobs, and optionally stream console output via WebSocket. These files serve as portable job definitions. When DRMDTool detects or receives a .drmd file, it parses the items, decodes or downloads the MPD, applies the keys, and builds a download command using N_m3u8DL-RE. Files are saved in organized directories like Movies/Title or Series/Title/Season, and subtitles are embedded if available. Pausing, resuming, and aborting downloads is supported per file.\nArchitecture Overview The configuration is handled via config.toml, with environment variable overrides for containerized or dynamic deployments. Once started, the tool can either monitor a specified folder or allow file uploads through the UI. Each .drmd file is parsed, grouped by series and season (if applicable), and processed sequentially with support for job pausing and resuming.\nWeb UI \u0026amp; CLI To use:\n./drmdtool Visit http://localhost:8080 for the web interface, which supports drag-and-drop uploads, selection of episodes or movies, and real-time progress tracking. For headless operation:\n./drmdtool -f /path/to/file.drmd Jobs can be paused, resumed, or aborted through the web interface, which reflects the backend state via live updates.\nEnhanced Download Logic DRMDTool dynamically builds download commands using metadata from .drmd files and user preferences. It ensures that only the highest quality streams are kept, removing ad periods and duplicate segments from the MPD files. Subtitles are fetched and embedded automatically. Jobs are tracked with robust state management and logs for debugging and visibility.\nRepository Code and setup instructions are hosted here: https://git.directme.in/Joren/DRMDTool\nDRMDtool For advanced usage details, customization, and API structure, refer to the README.md in the repository.\nUI Previews Index Page Select Page Progress Page ","date":"May 21, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-1/","title":"DRMDTool Project"},{"categories":["cybersecurity","event recap"],"contents":"Cyber Defence on the Digital Frontline: A Mission with NATO On a Mission with NATO: Cyber Defence on the Frontline Howest’s ongoing commitment to world-class cybersecurity training took center stage again as six lecturers from the Cyber Security program joined forces with experts from Latvia, Luxembourg and Belgium in one of NATO\u0026rsquo;s most intensive simulations: the Locked Shields exercise, hosted by the Cooperative Cyber Defence Centre of Excellence (CCDCOE). Now in its fifth year of participation, the Howest team shared their firsthand experiences at a special evening talk at Howest Bruges.\nThe Exercise: Locked Shields Locked Shields is no ordinary simulation. It is a full-scale, live-fire cyber defence exercise involving more than 6,000 machines and a narrative scenario so detailed it includes geopolitics, disinformation and even fictional countries. This year, the Blue Team 03 (our team) defended a simulated nation’s critical infrastructure including power plants, satellites, 5G networks and banking systems, all while under constant attack from a coordinated Red Team using automated scripts and over 28,000 attacks across two days.\nAnd yes, every team (Red, Blue, Yellow, White) uses Ansible. For everything.\nHigh Stakes, Real Lessons What do you do when a rogue process might be malware, or maybe just a poorly named service? What happens when your teammate refuses to act unless something is “officially malicious”? The team faced cultural clashes, communication breakdowns and stress-testing of both systems and people.\nThe exercise required more than technical fixes. It demanded communication with simulated commanders, media and public stakeholders. Reporting became just as important as patching. It taught participants how to translate technical impact into real-world consequences. Not \u0026ldquo;port 8443 unreachable\u0026rdquo;, but \u0026ldquo;our air defence system is degraded, and we cannot fly planes\u0026rdquo;.\nThe Black Team: Rapid Response in Action A new but powerful presence in the simulation was the Black Team, a rapid-response unit deployed when problems became too complex for any single team. Acting like special forces, they jumped in when incidents crossed team boundaries or demanded unconventional solutions. Their mission was to find out what was happening, assess the impact and suggest fast, creative responses. Introduced just last year, this team quickly proved its value again in 2025. They even embraced the role with style — “you can wear sunglasses inside” became their unofficial motto.\nTheir presence underlined a critical lesson: not every problem fits neatly within a team’s silo. Real-world defence requires flexibility, speed and lateral thinking.\nHighlights and Blooper Reel There were plenty of mishaps. Misfired scripts, team mix-ups, and one case where a DNS setup from a previous year was reused by mistake. Someone tried renaming cut to shutdown, breaking essential operations until it was fixed. Systems rebooted into chaos, a manual was uploaded to public GitHub, and the team had to quickly learn the difference between symbolic links and real binaries.\nHuman Factors and Growth From detecting malware with Velociraptor and Q9, to encountering teammates who took orders literally, the learning was intense. One participant noted that while Belgian and Luxembourg teams prioritized knowledge sharing, others preferred strict protocol. This highlighted cultural differences and the importance of interpersonal skills.\nThe biggest lesson? You are never fully prepared. Every iteration of Locked Shields is different. But each one sharpens not only your skills, but also your ability to function as a team under extreme conditions.\nFrom the Battlefield to the Classroom This experience directly impacts the classroom. Inspired by the exercise, Howest is introducing new hands-on courses like “Glutamine” in semester five. Students will be dropped into realistic broken networks, with misconfigurations, fake firewalls and simulated threats. It is chaos, but controlled. And that is the point.\nAs one speaker said: “You don’t win Locked Shields. You just survive it better than the rest.”\nFinal Thoughts The exercise teaches more than just cybersecurity. It builds trust. It proves that knowing your teammates can be as important as knowing the tools. Whether that comes from a shared flight or a pre-exercise barbecue, it all matters when the pressure hits.\nWant to see how cyber defence works in real life? This is it.\n","date":"May 13, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog-2_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog-2_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-1/","title":"Cyber Defence on the Digital Frontline: A Mission with NATO"},{"categories":["cybersecurity","CTF","education"],"contents":"From Android Reversing to Broken TLS: My Experience at the Cyber Security Challenge Belgium Qualifiers On March 14 and 15, I participated in the qualifiers of the 2025 Cyber Security Challenge Belgium. Together with three friends, we formed a team and spent two days on the CTF platform solving as many challenges as we could. This post sums up the problems I personally worked on—some I solved, some I didn’t, all of them worth the effort.\nBinary Exploitation: Finding the Overflow One of the first challenges I tackled was a buffer overflow. I loaded up the binary, found a vulnerable input (classic stack overflow), and started identifying the offset to control the return address. After a few crashes and tweaks, I was able to craft a working payload that redirected execution as intended. Simple in theory, stressful under time pressure—but extremely satisfying when it worked.\nAndroid Reversing with FRIDA and JADX I also spent a lot of time on Android challenges. I decompiled APKs using JADX to inspect the smali and Java code, and used FRIDA to patch logic at runtime. In one challenge, the app had some kind of license check buried in native code. I hooked into the relevant functions and bypassed it dynamically to get access to a hidden section of the app. It was a good exercise in runtime instrumentation and understanding how apps obfuscate key logic.\nCryptography: Guessing Seeds There was one crypto challenge where the output was based on a seeded ASCII art banner. The idea was to identify the seed that matched a known banner fragment. I brute-forced the space with a simple script that regenerated outputs and matched the result:\nfor seed in range(1000000): if extract_letters(generate_banner(seed)) == target: print(\u0026#34;Found seed:\u0026#34;, seed) This one worked—after a few minutes of searching, I found the right seed and submitted the flag.\nThe Go Server That Didn’t Budge One of the most frustrating challenges I tried involved a Go server that seemed to accept TLS connections only from clients with a very specific fingerprint. I tried replicating the behavior by configuring the cipher suite, ALPN, and HTTP/2 settings using Go’s tls.Config:\ntls.Config{ MinVersion: tls.VersionTLS13, CipherSuites: []uint16{ tls.TLS_AES_128_GCM_SHA256, // ... }, NextProtos: []string{\u0026#34;h2\u0026#34;}, } No matter what I tried, the server kept rejecting my connections. I suspect it was checking something deeper—maybe something like JA4, where even the order of extensions or handshake details mattered. It’s one of the challenges that stuck with me afterward, mainly because I still don’t know exactly what I missed.\nWorking as a Team Even though this post focuses on the challenges I worked on, we didn’t compete alone. Evarist, Nathan, and Waut were part of the team too. We each picked categories we were comfortable with and helped each other when someone got stuck. Most of the time, we split up and regrouped when we needed a fresh look or second opinion.\nFinal Thoughts We only did the qualifiers this year, but it was worth it. Every challenge—whether it involved RE, crypto, or failed TLS experiments—taught me something. If you like breaking stuff, debugging weird behavior, and learning under pressure, you should definitely try this competition.\nI’m already looking forward to the next one.\n","date":"March 15, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog-2_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog-2_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-2/","title":"From Android Reversing to Broken TLS: My Experience at the Cyber Security Challenge Belgium Qualifiers"},{"categories":null,"contents":"I built my personal blog using Hugo and deployed it on a lightweight Alpine Linux VPS. I chose this setup to have full control, keep things simple, and avoid bloated platforms or services. Here’s how the process went from site generation to live deployment.\nCreating the Hugo Site On my development machine, I created a new Hugo site:\nhugo new site howest-blog I used the professors-hugo theme and copied its exampleSite content into my project. I customized the layout, structure, and styling by editing content files, SCSS in assets/scss/custom.scss, and partial templates in the theme directory.\nAll content lives under content/, with separate folders for blog/ and project/, each containing .md files with front matter and Markdown content.\nCustomization I edited the config/_default/hugo.toml to configure site parameters like the base URL, theme, language, and menus. SCSS and image assets go in assets/, and are processed by Hugo\u0026rsquo;s pipeline. Static files like favicons are placed in static/.\nTo preview the site locally:\nhugo server To build the static site:\nhugo This generates everything in the public/ folder.\nVPS Deployment I rented a minimal Alpine Linux VPS and installed only what I needed. After setting up SSH and a basic nginx web server, I copied the public/ folder over using scp:\nscp -r public/* user@my-vps:/var/www/html On the VPS, I installed nginx:\napk add nginx And configured /etc/nginx/conf.d/default.conf to serve files from /var/www/html. Then I enabled and started nginx:\nrc-service nginx start rc-update add nginx Now my Hugo site is live and served directly as static files—no backend, no database, just HTML, CSS, and JS.\nWhy Alpine + Hugo? Alpine Linux is minimal and fast, perfect for serving static sites with low resource usage. Combined with Hugo’s speed and flexibility, I get a complete, performant setup that I fully control. It’s secure, lightweight, and easy to update—just rebuild and re-upload the public/ folder.\nThis setup is perfect if you want full control and minimal overhead for a personal blog or portfolio.\n","date":"May 29, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-2/","title":"Building My Hugo Website on a VPS"},{"categories":null,"contents":"DRMDTool is an automation-centric utility designed to streamline the processing of .drmd files by tightly integrating with the N_m3u8DL-RE downloader. The tool offers robust automation via a watch folder and an intuitive web-based interface, significantly reducing the friction for managing and processing DRM-protected streaming content.\nWhat’s New DRMDTool has evolved into a comprehensive platform for batch downloading with enhanced support for user interaction and background processing. It features granular job tracking, dynamic download control (pause, resume, abort), and a refined WebSocket-based console for real-time command output. Subtitle handling now includes automatic downloading and conversion from VTT to SRT, and the downloader adapts based on metadata, organizing content into categorized directories.\nGoals and Use Case The primary aim is to automate .drmd file processing with minimal manual input. Users can configure download formats, specify directories, and enable real-time command broadcasting. DRMDTool is suitable for both interactive use through a web UI and headless automation in pipelines, supporting inotify or polling-based folder watching.\nHow .drmd Files Work A .drmd file is a structured JSON document that defines one or more encrypted media items to be processed by DRMDTool. It contains an Items array, with each item representing a specific media job. DRMDTool parses these entries to generate download commands for N_m3u8DL-RE.\nEach item includes:\nMPD: A DASH manifest, either a direct URL or a base64-encoded version. If base64-encoded, DRMDTool decodes and temporarily saves it before use. Keys: A comma-separated list of KID:key pairs (e.g., abcd1234ef567890:00112233445566778899aabbccddeeff). These are required for decrypting encrypted media streams and are passed directly to N_m3u8DL-RE using --key flags. Filename: The name to be used for the final output file. Subtitles: Comma-separated list of subtitle URLs in .vtt format. DRMDTool downloads and converts these to .srt, then muxes them into the final file. Metadata: A semicolon-separated string like Title;Type;Season (e.g., Example Show;serie;1) used to determine directory structure (Movies/Title or Series/Title/Season). Description and Poster: Optional fields used only for display in the web UI. Example .drmd Structure { \u0026#34;Items\u0026#34;: [ { \u0026#34;MPD\u0026#34;: \u0026#34;aHR0cHM6Ly9leGFtcGxlLmNvbS9zdHJlYW0ubXBk\u0026#34;, \u0026#34;Keys\u0026#34;: \u0026#34;abcd1234ef567890:00112233445566778899aabbccddeeff\u0026#34;, \u0026#34;Filename\u0026#34;: \u0026#34;ExampleShow.S01E01\u0026#34;, \u0026#34;Subtitles\u0026#34;: \u0026#34;https://example.com/sub1.vtt,https://example.com/sub2.vtt\u0026#34;, \u0026#34;Metadata\u0026#34;: \u0026#34;Example Show;serie;1\u0026#34;, \u0026#34;Description\u0026#34;: \u0026#34;Pilot episode\u0026#34;, \u0026#34;Poster\u0026#34;: \u0026#34;\u0026#34; } ] } Processing Steps Detection: DRMDTool either watches a folder or receives .drmd uploads through the web UI. Validation: It waits for the file to finish writing (based on file size stability), then parses its contents. MPD Handling: If base64-encoded, the MPD is decoded and written to a temp file; otherwise, the URL is fetched or passed as-is. Command Generation: Using the MPD, KID:key pairs, output paths, and subtitles, DRMDTool builds a command line for N_m3u8DL-RE. Execution: The download is launched with live progress tracking. Users can pause, resume, or abort jobs, and optionally stream console output via WebSocket. These files serve as portable job definitions. When DRMDTool detects or receives a .drmd file, it parses the items, decodes or downloads the MPD, applies the keys, and builds a download command using N_m3u8DL-RE. Files are saved in organized directories like Movies/Title or Series/Title/Season, and subtitles are embedded if available. Pausing, resuming, and aborting downloads is supported per file.\nArchitecture Overview The configuration is handled via config.toml, with environment variable overrides for containerized or dynamic deployments. Once started, the tool can either monitor a specified folder or allow file uploads through the UI. Each .drmd file is parsed, grouped by series and season (if applicable), and processed sequentially with support for job pausing and resuming.\nWeb UI \u0026amp; CLI To use:\n./drmdtool Visit http://localhost:8080 for the web interface, which supports drag-and-drop uploads, selection of episodes or movies, and real-time progress tracking. For headless operation:\n./drmdtool -f /path/to/file.drmd Jobs can be paused, resumed, or aborted through the web interface, which reflects the backend state via live updates.\nEnhanced Download Logic DRMDTool dynamically builds download commands using metadata from .drmd files and user preferences. It ensures that only the highest quality streams are kept, removing ad periods and duplicate segments from the MPD files. Subtitles are fetched and embedded automatically. Jobs are tracked with robust state management and logs for debugging and visibility.\nRepository Code and setup instructions are hosted here: https://git.directme.in/Joren/DRMDTool\nDRMDtool For advanced usage details, customization, and API structure, refer to the README.md in the repository.\nUI Previews Index Page Select Page Progress Page ","date":"May 21, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-1/","title":"DRMDTool Project"},{"categories":["cybersecurity","event recap"],"contents":"Cyber Defence on the Digital Frontline: A Mission with NATO On a Mission with NATO: Cyber Defence on the Frontline Howest’s ongoing commitment to world-class cybersecurity training took center stage again as six lecturers from the Cyber Security program joined forces with experts from Latvia, Luxembourg and Belgium in one of NATO\u0026rsquo;s most intensive simulations: the Locked Shields exercise, hosted by the Cooperative Cyber Defence Centre of Excellence (CCDCOE). Now in its fifth year of participation, the Howest team shared their firsthand experiences at a special evening talk at Howest Bruges.\nThe Exercise: Locked Shields Locked Shields is no ordinary simulation. It is a full-scale, live-fire cyber defence exercise involving more than 6,000 machines and a narrative scenario so detailed it includes geopolitics, disinformation and even fictional countries. This year, the Blue Team 03 (our team) defended a simulated nation’s critical infrastructure including power plants, satellites, 5G networks and banking systems, all while under constant attack from a coordinated Red Team using automated scripts and over 28,000 attacks across two days.\nAnd yes, every team (Red, Blue, Yellow, White) uses Ansible. For everything.\nHigh Stakes, Real Lessons What do you do when a rogue process might be malware, or maybe just a poorly named service? What happens when your teammate refuses to act unless something is “officially malicious”? The team faced cultural clashes, communication breakdowns and stress-testing of both systems and people.\nThe exercise required more than technical fixes. It demanded communication with simulated commanders, media and public stakeholders. Reporting became just as important as patching. It taught participants how to translate technical impact into real-world consequences. Not \u0026ldquo;port 8443 unreachable\u0026rdquo;, but \u0026ldquo;our air defence system is degraded, and we cannot fly planes\u0026rdquo;.\nThe Black Team: Rapid Response in Action A new but powerful presence in the simulation was the Black Team, a rapid-response unit deployed when problems became too complex for any single team. Acting like special forces, they jumped in when incidents crossed team boundaries or demanded unconventional solutions. Their mission was to find out what was happening, assess the impact and suggest fast, creative responses. Introduced just last year, this team quickly proved its value again in 2025. They even embraced the role with style — “you can wear sunglasses inside” became their unofficial motto.\nTheir presence underlined a critical lesson: not every problem fits neatly within a team’s silo. Real-world defence requires flexibility, speed and lateral thinking.\nHighlights and Blooper Reel There were plenty of mishaps. Misfired scripts, team mix-ups, and one case where a DNS setup from a previous year was reused by mistake. Someone tried renaming cut to shutdown, breaking essential operations until it was fixed. Systems rebooted into chaos, a manual was uploaded to public GitHub, and the team had to quickly learn the difference between symbolic links and real binaries.\nHuman Factors and Growth From detecting malware with Velociraptor and Q9, to encountering teammates who took orders literally, the learning was intense. One participant noted that while Belgian and Luxembourg teams prioritized knowledge sharing, others preferred strict protocol. This highlighted cultural differences and the importance of interpersonal skills.\nThe biggest lesson? You are never fully prepared. Every iteration of Locked Shields is different. But each one sharpens not only your skills, but also your ability to function as a team under extreme conditions.\nFrom the Battlefield to the Classroom This experience directly impacts the classroom. Inspired by the exercise, Howest is introducing new hands-on courses like “Glutamine” in semester five. Students will be dropped into realistic broken networks, with misconfigurations, fake firewalls and simulated threats. It is chaos, but controlled. And that is the point.\nAs one speaker said: “You don’t win Locked Shields. You just survive it better than the rest.”\nFinal Thoughts The exercise teaches more than just cybersecurity. It builds trust. It proves that knowing your teammates can be as important as knowing the tools. Whether that comes from a shared flight or a pre-exercise barbecue, it all matters when the pressure hits.\nWant to see how cyber defence works in real life? This is it.\n","date":"May 13, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog-2_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog-2_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-1/","title":"Cyber Defence on the Digital Frontline: A Mission with NATO"},{"categories":["cybersecurity","CTF","education"],"contents":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience On March 14 and 15, I joined the Cyber Security Challenge Belgium qualifiers with three teammates. For two days, we threw ourselves at CTF challenges covering binary exploitation, Android reversing, cryptography, and more.\nWhat follows is a short recap of the challenges I worked on—some I solved, some I didn’t—but all of them were worth the hours spent.\nA Buffer Overflow to Warm Up One of the first challenges I picked involved a binary with a basic stack overflow. I used standard techniques—finding the offset, hijacking the return address, and injecting shellcode. Tools like pwntools helped automate the payload crafting. It was a good warm-up, and it reminded me how subtle some bugs can be when you\u0026rsquo;re rushed.\nCryptography and Pattern Matching There was a crypto puzzle where I had to find a seed that reproduced a specific ASCII art banner. Once I understood how the banner was generated, I brute-forced possible seeds until one matched. It was a quick but fun exercise in spotting structure and automating search.\nAndroid Reversing: FRIDA and JADX Several APKs were part of the qualifier set. I used JADX to decompile them and FRIDA to patch logic at runtime. In one challenge, I had to bypass some form of license validation. By hooking into the relevant method and forcing it to always return true, I could reveal hidden sections of the app.\nBut one Android challenge stood out more than any other.\nThe Challenge That Stuck with Me: Rebuilding a Split DEX This one was different.\nThe app presented a 4×8 button grid. Each button, when pressed, recorded an index. After pressing several buttons and hitting \u0026ldquo;GO,\u0026rdquo; the app would try to assemble something in memory and load it as a class.\nLooking deeper, I found this in the decompiled code:\nInputStream open = assets.open(String.format(\u0026#34;block%02d\u0026#34;, it.next())); ... Class loadClass = new InMemoryDexClassLoader(ByteBuffer.wrap(byteArrayOutputStream.toByteArray()), getClassLoader()) .loadClass(\u0026#34;be.dauntless.flag.Flag\u0026#34;); Each index corresponded to an asset file named blockXX, and the app was stitching these binary chunks into a single byte stream. It then tried to load the result as a DEX file containing a Flag class.\nThe hard part? There were 31 blocks and no obvious way to know the correct order. The buttons reset after each attempt, making brute-force infeasible. My job was to reverse-engineer the right sequence.\nI tried analyzing the individual blocks to extract string constants, method fragments, and bytecode patterns. I wrote a script to group fragments and infer relative positions, like solving a jigsaw puzzle blindfolded. I made progress, but I never completed it. That puzzle stuck with me because it combined static analysis, runtime loading, and logical reconstruction in a way that no other challenge did.\nThe One That Got Away: TLS Fingerprinting I also spent time on a Go-based TLS server that rejected all my attempts to connect unless my client fingerprint was exactly right. I tried adjusting everything in the tls.Config—cipher suite order, ALPN, even protocol version:\ntls.Config{ MinVersion: tls.VersionTLS13, CipherSuites: []uint16{ tls.TLS_AES_128_GCM_SHA256, // ... }, NextProtos: []string{\u0026#34;h2\u0026#34;}, } But nothing worked. I suspect the server checked deep JA4-style fingerprinting, and I just couldn’t replicate the original client behavior. It was frustrating—but also a good reminder of how messy and detailed real-world protocol handling can be.\nFinal Thoughts I didn’t solve everything. Far from it. But that’s not really the point. Each challenge taught me something—whether it was about Android’s InMemoryDexClassLoader, raw memory reconstruction, or TLS quirks. Working as a team with Evarist, Nathan, and Waut also made it fun, even when we were all stuck.\nIf you\u0026rsquo;re even a little curious about cybersecurity, I can’t recommend this kind of event enough. It’s hands-on, intense, and full of problems that make you think in ways formal education often doesn\u0026rsquo;t.\n","date":"March 15, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog-2_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog-2_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-2/","title":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience"},{"categories":null,"contents":"I built my personal blog using Hugo and deployed it on a lightweight Alpine Linux VPS. I chose this setup to have full control, keep things simple, and avoid bloated platforms or services. Here’s how the process went from site generation to live deployment.\nCreating the Hugo Site On my development machine, I created a new Hugo site:\nhugo new site howest-blog I used the professors-hugo theme and copied its exampleSite content into my project. I customized the layout, structure, and styling by editing content files, SCSS in assets/scss/custom.scss, and partial templates in the theme directory.\nAll content lives under content/, with separate folders for blog/ and project/, each containing .md files with front matter and Markdown content.\nCustomization I edited the config/_default/hugo.toml to configure site parameters like the base URL, theme, language, and menus. SCSS and image assets go in assets/, and are processed by Hugo\u0026rsquo;s pipeline. Static files like favicons are placed in static/.\nTo preview the site locally:\nhugo server To build the static site:\nhugo This generates everything in the public/ folder.\nVPS Deployment I rented a minimal Alpine Linux VPS and installed only what I needed. After setting up SSH and a basic nginx web server, I copied the public/ folder over using scp:\nscp -r public/* user@my-vps:/var/www/html On the VPS, I installed nginx:\napk add nginx And configured /etc/nginx/conf.d/default.conf to serve files from /var/www/html. Then I enabled and started nginx:\nrc-service nginx start rc-update add nginx Now my Hugo site is live and served directly as static files—no backend, no database, just HTML, CSS, and JS.\nWhy Alpine + Hugo? Alpine Linux is minimal and fast, perfect for serving static sites with low resource usage. Combined with Hugo’s speed and flexibility, I get a complete, performant setup that I fully control. It’s secure, lightweight, and easy to update—just rebuild and re-upload the public/ folder.\nThis setup is perfect if you want full control and minimal overhead for a personal blog or portfolio.\n","date":"May 29, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-2/","title":"Building My Hugo Website on a VPS"},{"categories":null,"contents":"DRMDTool is an automation-centric utility designed to streamline the processing of .drmd files by tightly integrating with the N_m3u8DL-RE downloader. The tool offers robust automation via a watch folder and an intuitive web-based interface, significantly reducing the friction for managing and processing DRM-protected streaming content.\nWhat’s New DRMDTool has evolved into a comprehensive platform for batch downloading with enhanced support for user interaction and background processing. It features granular job tracking, dynamic download control (pause, resume, abort), and a refined WebSocket-based console for real-time command output. Subtitle handling now includes automatic downloading and conversion from VTT to SRT, and the downloader adapts based on metadata, organizing content into categorized directories.\nGoals and Use Case The primary aim is to automate .drmd file processing with minimal manual input. Users can configure download formats, specify directories, and enable real-time command broadcasting. DRMDTool is suitable for both interactive use through a web UI and headless automation in pipelines, supporting inotify or polling-based folder watching.\nHow .drmd Files Work A .drmd file is a structured JSON document that defines one or more encrypted media items to be processed by DRMDTool. It contains an Items array, with each item representing a specific media job. DRMDTool parses these entries to generate download commands for N_m3u8DL-RE.\nEach item includes:\nMPD: A DASH manifest, either a direct URL or a base64-encoded version. If base64-encoded, DRMDTool decodes and temporarily saves it before use. Keys: A comma-separated list of KID:key pairs (e.g., abcd1234ef567890:00112233445566778899aabbccddeeff). These are required for decrypting encrypted media streams and are passed directly to N_m3u8DL-RE using --key flags. Filename: The name to be used for the final output file. Subtitles: Comma-separated list of subtitle URLs in .vtt format. DRMDTool downloads and converts these to .srt, then muxes them into the final file. Metadata: A semicolon-separated string like Title;Type;Season (e.g., Example Show;serie;1) used to determine directory structure (Movies/Title or Series/Title/Season). Description and Poster: Optional fields used only for display in the web UI. Example .drmd Structure { \u0026#34;Items\u0026#34;: [ { \u0026#34;MPD\u0026#34;: \u0026#34;aHR0cHM6Ly9leGFtcGxlLmNvbS9zdHJlYW0ubXBk\u0026#34;, \u0026#34;Keys\u0026#34;: \u0026#34;abcd1234ef567890:00112233445566778899aabbccddeeff\u0026#34;, \u0026#34;Filename\u0026#34;: \u0026#34;ExampleShow.S01E01\u0026#34;, \u0026#34;Subtitles\u0026#34;: \u0026#34;https://example.com/sub1.vtt,https://example.com/sub2.vtt\u0026#34;, \u0026#34;Metadata\u0026#34;: \u0026#34;Example Show;serie;1\u0026#34;, \u0026#34;Description\u0026#34;: \u0026#34;Pilot episode\u0026#34;, \u0026#34;Poster\u0026#34;: \u0026#34;\u0026#34; } ] } Processing Steps Detection: DRMDTool either watches a folder or receives .drmd uploads through the web UI. Validation: It waits for the file to finish writing (based on file size stability), then parses its contents. MPD Handling: If base64-encoded, the MPD is decoded and written to a temp file; otherwise, the URL is fetched or passed as-is. Command Generation: Using the MPD, KID:key pairs, output paths, and subtitles, DRMDTool builds a command line for N_m3u8DL-RE. Execution: The download is launched with live progress tracking. Users can pause, resume, or abort jobs, and optionally stream console output via WebSocket. These files serve as portable job definitions. When DRMDTool detects or receives a .drmd file, it parses the items, decodes or downloads the MPD, applies the keys, and builds a download command using N_m3u8DL-RE. Files are saved in organized directories like Movies/Title or Series/Title/Season, and subtitles are embedded if available. Pausing, resuming, and aborting downloads is supported per file.\nArchitecture Overview The configuration is handled via config.toml, with environment variable overrides for containerized or dynamic deployments. Once started, the tool can either monitor a specified folder or allow file uploads through the UI. Each .drmd file is parsed, grouped by series and season (if applicable), and processed sequentially with support for job pausing and resuming.\nWeb UI \u0026amp; CLI To use:\n./drmdtool Visit http://localhost:8080 for the web interface, which supports drag-and-drop uploads, selection of episodes or movies, and real-time progress tracking. For headless operation:\n./drmdtool -f /path/to/file.drmd Jobs can be paused, resumed, or aborted through the web interface, which reflects the backend state via live updates.\nEnhanced Download Logic DRMDTool dynamically builds download commands using metadata from .drmd files and user preferences. It ensures that only the highest quality streams are kept, removing ad periods and duplicate segments from the MPD files. Subtitles are fetched and embedded automatically. Jobs are tracked with robust state management and logs for debugging and visibility.\nRepository Code and setup instructions are hosted here: https://git.directme.in/Joren/DRMDTool\nDRMDtool For advanced usage details, customization, and API structure, refer to the README.md in the repository.\nUI Previews Index Page Select Page Progress Page ","date":"May 21, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-1/","title":"DRMDTool Project"},{"categories":["cybersecurity","event recap"],"contents":"Cyber Defence on the Digital Frontline: A Mission with NATO On a Mission with NATO: Cyber Defence on the Frontline Howest’s ongoing commitment to world-class cybersecurity training took center stage again as six lecturers from the Cyber Security program joined forces with experts from Latvia, Luxembourg and Belgium in one of NATO\u0026rsquo;s most intensive simulations: the Locked Shields exercise, hosted by the Cooperative Cyber Defence Centre of Excellence (CCDCOE). Now in its fifth year of participation, the Howest team shared their firsthand experiences at a special evening talk at Howest Bruges.\nThe Exercise: Locked Shields Locked Shields is no ordinary simulation. It is a full-scale, live-fire cyber defence exercise involving more than 6,000 machines and a narrative scenario so detailed it includes geopolitics, disinformation and even fictional countries. This year, the Blue Team 03 (our team) defended a simulated nation’s critical infrastructure including power plants, satellites, 5G networks and banking systems, all while under constant attack from a coordinated Red Team using automated scripts and over 28,000 attacks across two days.\nAnd yes, every team (Red, Blue, Yellow, White) uses Ansible. For everything.\nHigh Stakes, Real Lessons What do you do when a rogue process might be malware, or maybe just a poorly named service? What happens when your teammate refuses to act unless something is “officially malicious”? The team faced cultural clashes, communication breakdowns and stress-testing of both systems and people.\nThe exercise required more than technical fixes. It demanded communication with simulated commanders, media and public stakeholders. Reporting became just as important as patching. It taught participants how to translate technical impact into real-world consequences. Not \u0026ldquo;port 8443 unreachable\u0026rdquo;, but \u0026ldquo;our air defence system is degraded, and we cannot fly planes\u0026rdquo;.\nThe Black Team: Rapid Response in Action A new but powerful presence in the simulation was the Black Team, a rapid-response unit deployed when problems became too complex for any single team. Acting like special forces, they jumped in when incidents crossed team boundaries or demanded unconventional solutions. Their mission was to find out what was happening, assess the impact and suggest fast, creative responses. Introduced just last year, this team quickly proved its value again in 2025. They even embraced the role with style — “you can wear sunglasses inside” became their unofficial motto.\nTheir presence underlined a critical lesson: not every problem fits neatly within a team’s silo. Real-world defence requires flexibility, speed and lateral thinking.\nHighlights and Blooper Reel There were plenty of mishaps. Misfired scripts, team mix-ups, and one case where a DNS setup from a previous year was reused by mistake. Someone tried renaming cut to shutdown, breaking essential operations until it was fixed. Systems rebooted into chaos, a manual was uploaded to public GitHub, and the team had to quickly learn the difference between symbolic links and real binaries.\nHuman Factors and Growth From detecting malware with Velociraptor and Q9, to encountering teammates who took orders literally, the learning was intense. One participant noted that while Belgian and Luxembourg teams prioritized knowledge sharing, others preferred strict protocol. This highlighted cultural differences and the importance of interpersonal skills.\nThe biggest lesson? You are never fully prepared. Every iteration of Locked Shields is different. But each one sharpens not only your skills, but also your ability to function as a team under extreme conditions.\nFrom the Battlefield to the Classroom This experience directly impacts the classroom. Inspired by the exercise, Howest is introducing new hands-on courses like “Glutamine” in semester five. Students will be dropped into realistic broken networks, with misconfigurations, fake firewalls and simulated threats. It is chaos, but controlled. And that is the point.\nAs one speaker said: “You don’t win Locked Shields. You just survive it better than the rest.”\nFinal Thoughts The exercise teaches more than just cybersecurity. It builds trust. It proves that knowing your teammates can be as important as knowing the tools. Whether that comes from a shared flight or a pre-exercise barbecue, it all matters when the pressure hits.\nWant to see how cyber defence works in real life? This is it.\n","date":"May 13, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog-2_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog-2_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-1/","title":"Cyber Defence on the Digital Frontline: A Mission with NATO"},{"categories":["cybersecurity","CTF","education"],"contents":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience On March 14 and 15, I joined the Cyber Security Challenge Belgium qualifiers with three teammates. For two days, we threw ourselves at CTF challenges covering binary exploitation, Android reversing, cryptography, and more.\nWhat follows is a short recap of the challenges I worked on—some I solved, some I didn’t—but all of them were worth the hours spent.\nA Buffer Overflow to Warm Up One of the first challenges I picked involved a binary with a basic stack overflow. I used standard techniques—finding the offset, hijacking the return address, and injecting shellcode. Tools like pwntools helped automate the payload crafting. It was a good warm-up, and it reminded me how subtle some bugs can be when you\u0026rsquo;re rushed.\nCryptography and Pattern Matching There was a crypto puzzle where I had to find a seed that reproduced a specific ASCII art banner. Once I understood how the banner was generated, I brute-forced possible seeds until one matched. It was a quick but fun exercise in spotting structure and automating search.\nAndroid Reversing: FRIDA and JADX Several APKs were part of the qualifier set. I used JADX to decompile them and FRIDA to patch logic at runtime. In one challenge, I had to bypass some form of license validation. By hooking into the relevant method and forcing it to always return true, I could reveal hidden sections of the app.\nBut one Android challenge stood out more than any other.\nThe Challenge That Stuck with Me: Rebuilding a Split DEX This one was different.\nThe app presented a 4×8 button grid. Each button, when pressed, recorded an index. After pressing several buttons and hitting \u0026ldquo;GO,\u0026rdquo; the app would try to assemble something in memory and load it as a class.\nLooking deeper, I found this in the decompiled code:\nInputStream open = assets.open(String.format(\u0026#34;block%02d\u0026#34;, it.next())); ... Class loadClass = new InMemoryDexClassLoader(ByteBuffer.wrap(byteArrayOutputStream.toByteArray()), getClassLoader()) .loadClass(\u0026#34;be.dauntless.flag.Flag\u0026#34;); Each index corresponded to an asset file named blockXX, and the app was stitching these binary chunks into a single byte stream. It then tried to load the result as a DEX file containing a Flag class.\nThe hard part? There were 31 blocks and no obvious way to know the correct order. The buttons reset after each attempt, making brute-force infeasible. My job was to reverse-engineer the right sequence.\nI tried analyzing the individual blocks to extract string constants, method fragments, and bytecode patterns. I wrote a script to group fragments and infer relative positions, like solving a jigsaw puzzle blindfolded. I made progress, but I never completed it. That puzzle stuck with me because it combined static analysis, runtime loading, and logical reconstruction in a way that no other challenge did.\nThe One That Got Away: TLS Fingerprinting I also spent time on a Go-based TLS server that rejected all my attempts to connect unless my client fingerprint was exactly right. I tried adjusting everything in the tls.Config—cipher suite order, ALPN, even protocol version:\ntls.Config{ MinVersion: tls.VersionTLS13, CipherSuites: []uint16{ tls.TLS_AES_128_GCM_SHA256, // ... }, NextProtos: []string{\u0026#34;h2\u0026#34;}, } But nothing worked. I suspect the server checked deep JA4-style fingerprinting, and I just couldn’t replicate the original client behavior. It was frustrating—but also a good reminder of how messy and detailed real-world protocol handling can be.\nFinal Thoughts I didn’t solve everything. Far from it. But that’s not really the point. Each challenge taught me something—whether it was about Android’s InMemoryDexClassLoader, raw memory reconstruction, or TLS quirks. Working as a team with Evarist, Nathan, and Waut also made it fun, even when we were all stuck.\nIf you\u0026rsquo;re even a little curious about cybersecurity, I can’t recommend this kind of event enough. It’s hands-on, intense, and full of problems that make you think in ways formal education often doesn\u0026rsquo;t.\n","date":"March 15, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog-2_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog-2_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-2/","title":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience"},{"categories":null,"contents":"I built my personal blog using Hugo and deployed it on a lightweight Alpine Linux VPS. I chose this setup to have full control, keep things simple, and avoid bloated platforms or services. Here’s how the process went from site generation to live deployment.\nCreating the Hugo Site On my development machine, I created a new Hugo site:\nhugo new site howest-blog I used the professors-hugo theme and copied its exampleSite content into my project. I customized the layout, structure, and styling by editing content files, SCSS in assets/scss/custom.scss, and partial templates in the theme directory.\nAll content lives under content/, with separate folders for blog/ and project/, each containing .md files with front matter and Markdown content.\nCustomization I edited the config/_default/hugo.toml to configure site parameters like the base URL, theme, language, and menus. SCSS and image assets go in assets/, and are processed by Hugo\u0026rsquo;s pipeline. Static files like favicons are placed in static/.\nTo preview the site locally:\nhugo server To build the static site:\nhugo This generates everything in the public/ folder.\nVPS Deployment I rented a minimal Alpine Linux VPS and installed only what I needed. After setting up SSH and a basic nginx web server, I copied the public/ folder over using scp:\nscp -r public/* user@my-vps:/var/www/html On the VPS, I installed nginx:\napk add nginx And configured /etc/nginx/conf.d/default.conf to serve files from /var/www/html. Then I enabled and started nginx:\nrc-service nginx start rc-update add nginx Now my Hugo site is live and served directly as static files—no backend, no database, just HTML, CSS, and JS.\nWhy Alpine + Hugo? Alpine Linux is minimal and fast, perfect for serving static sites with low resource usage. Combined with Hugo’s speed and flexibility, I get a complete, performant setup that I fully control. It’s secure, lightweight, and easy to update—just rebuild and re-upload the public/ folder.\nThis setup is perfect if you want full control and minimal overhead for a personal blog or portfolio.\n","date":"May 29, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-2/","title":"Building My Hugo Website on a VPS"},{"categories":null,"contents":"DRMDTool is an automation-centric utility designed to streamline the processing of .drmd files by tightly integrating with the N_m3u8DL-RE downloader. The tool offers robust automation via a watch folder and an intuitive web-based interface, significantly reducing the friction for managing and processing DRM-protected streaming content.\nWhat’s New DRMDTool has evolved into a comprehensive platform for batch downloading with enhanced support for user interaction and background processing. It features granular job tracking, dynamic download control (pause, resume, abort), and a refined WebSocket-based console for real-time command output. Subtitle handling now includes automatic downloading and conversion from VTT to SRT, and the downloader adapts based on metadata, organizing content into categorized directories.\nGoals and Use Case The primary aim is to automate .drmd file processing with minimal manual input. Users can configure download formats, specify directories, and enable real-time command broadcasting. DRMDTool is suitable for both interactive use through a web UI and headless automation in pipelines, supporting inotify or polling-based folder watching.\nHow .drmd Files Work A .drmd file is a structured JSON document that defines one or more encrypted media items to be processed by DRMDTool. It contains an Items array, with each item representing a specific media job. DRMDTool parses these entries to generate download commands for N_m3u8DL-RE.\nEach item includes:\nMPD: A DASH manifest, either a direct URL or a base64-encoded version. If base64-encoded, DRMDTool decodes and temporarily saves it before use. Keys: A comma-separated list of KID:key pairs (e.g., abcd1234ef567890:00112233445566778899aabbccddeeff). These are required for decrypting encrypted media streams and are passed directly to N_m3u8DL-RE using --key flags. Filename: The name to be used for the final output file. Subtitles: Comma-separated list of subtitle URLs in .vtt format. DRMDTool downloads and converts these to .srt, then muxes them into the final file. Metadata: A semicolon-separated string like Title;Type;Season (e.g., Example Show;serie;1) used to determine directory structure (Movies/Title or Series/Title/Season). Description and Poster: Optional fields used only for display in the web UI. Example .drmd Structure { \u0026#34;Items\u0026#34;: [ { \u0026#34;MPD\u0026#34;: \u0026#34;aHR0cHM6Ly9leGFtcGxlLmNvbS9zdHJlYW0ubXBk\u0026#34;, \u0026#34;Keys\u0026#34;: \u0026#34;abcd1234ef567890:00112233445566778899aabbccddeeff\u0026#34;, \u0026#34;Filename\u0026#34;: \u0026#34;ExampleShow.S01E01\u0026#34;, \u0026#34;Subtitles\u0026#34;: \u0026#34;https://example.com/sub1.vtt,https://example.com/sub2.vtt\u0026#34;, \u0026#34;Metadata\u0026#34;: \u0026#34;Example Show;serie;1\u0026#34;, \u0026#34;Description\u0026#34;: \u0026#34;Pilot episode\u0026#34;, \u0026#34;Poster\u0026#34;: \u0026#34;\u0026#34; } ] } Processing Steps Detection: DRMDTool either watches a folder or receives .drmd uploads through the web UI. Validation: It waits for the file to finish writing (based on file size stability), then parses its contents. MPD Handling: If base64-encoded, the MPD is decoded and written to a temp file; otherwise, the URL is fetched or passed as-is. Command Generation: Using the MPD, KID:key pairs, output paths, and subtitles, DRMDTool builds a command line for N_m3u8DL-RE. Execution: The download is launched with live progress tracking. Users can pause, resume, or abort jobs, and optionally stream console output via WebSocket. These files serve as portable job definitions. When DRMDTool detects or receives a .drmd file, it parses the items, decodes or downloads the MPD, applies the keys, and builds a download command using N_m3u8DL-RE. Files are saved in organized directories like Movies/Title or Series/Title/Season, and subtitles are embedded if available. Pausing, resuming, and aborting downloads is supported per file.\nArchitecture Overview The configuration is handled via config.toml, with environment variable overrides for containerized or dynamic deployments. Once started, the tool can either monitor a specified folder or allow file uploads through the UI. Each .drmd file is parsed, grouped by series and season (if applicable), and processed sequentially with support for job pausing and resuming.\nWeb UI \u0026amp; CLI To use:\n./drmdtool Visit http://localhost:8080 for the web interface, which supports drag-and-drop uploads, selection of episodes or movies, and real-time progress tracking. For headless operation:\n./drmdtool -f /path/to/file.drmd Jobs can be paused, resumed, or aborted through the web interface, which reflects the backend state via live updates.\nEnhanced Download Logic DRMDTool dynamically builds download commands using metadata from .drmd files and user preferences. It ensures that only the highest quality streams are kept, removing ad periods and duplicate segments from the MPD files. Subtitles are fetched and embedded automatically. Jobs are tracked with robust state management and logs for debugging and visibility.\nRepository Code and setup instructions are hosted here: https://git.directme.in/Joren/DRMDTool\nDRMDtool For advanced usage details, customization, and API structure, refer to the README.md in the repository.\nUI Previews Index Page Select Page Progress Page ","date":"May 21, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-1/","title":"DRMDTool Project"},{"categories":["cybersecurity","event recap"],"contents":"Cyber Defence on the Digital Frontline: A Mission with NATO On a Mission with NATO: Cyber Defence on the Frontline Howest’s ongoing commitment to world-class cybersecurity training took center stage again as six lecturers from the Cyber Security program joined forces with experts from Latvia, Luxembourg and Belgium in one of NATO\u0026rsquo;s most intensive simulations: the Locked Shields exercise, hosted by the Cooperative Cyber Defence Centre of Excellence (CCDCOE). Now in its fifth year of participation, the Howest team shared their firsthand experiences at a special evening talk at Howest Bruges.\nThe Exercise: Locked Shields Locked Shields is no ordinary simulation. It is a full-scale, live-fire cyber defence exercise involving more than 6,000 machines and a narrative scenario so detailed it includes geopolitics, disinformation and even fictional countries. This year, the Blue Team 03 (our team) defended a simulated nation’s critical infrastructure including power plants, satellites, 5G networks and banking systems, all while under constant attack from a coordinated Red Team using automated scripts and over 28,000 attacks across two days.\nAnd yes, every team (Red, Blue, Yellow, White) uses Ansible. For everything.\nHigh Stakes, Real Lessons What do you do when a rogue process might be malware, or maybe just a poorly named service? What happens when your teammate refuses to act unless something is “officially malicious”? The team faced cultural clashes, communication breakdowns and stress-testing of both systems and people.\nThe exercise required more than technical fixes. It demanded communication with simulated commanders, media and public stakeholders. Reporting became just as important as patching. It taught participants how to translate technical impact into real-world consequences. Not \u0026ldquo;port 8443 unreachable\u0026rdquo;, but \u0026ldquo;our air defence system is degraded, and we cannot fly planes\u0026rdquo;.\nThe Black Team: Rapid Response in Action A new but powerful presence in the simulation was the Black Team, a rapid-response unit deployed when problems became too complex for any single team. Acting like special forces, they jumped in when incidents crossed team boundaries or demanded unconventional solutions. Their mission was to find out what was happening, assess the impact and suggest fast, creative responses. Introduced just last year, this team quickly proved its value again in 2025. They even embraced the role with style — “you can wear sunglasses inside” became their unofficial motto.\nTheir presence underlined a critical lesson: not every problem fits neatly within a team’s silo. Real-world defence requires flexibility, speed and lateral thinking.\nHighlights and Blooper Reel There were plenty of mishaps. Misfired scripts, team mix-ups, and one case where a DNS setup from a previous year was reused by mistake. Someone tried renaming cut to shutdown, breaking essential operations until it was fixed. Systems rebooted into chaos, a manual was uploaded to public GitHub, and the team had to quickly learn the difference between symbolic links and real binaries.\nHuman Factors and Growth From detecting malware with Velociraptor and Q9, to encountering teammates who took orders literally, the learning was intense. One participant noted that while Belgian and Luxembourg teams prioritized knowledge sharing, others preferred strict protocol. This highlighted cultural differences and the importance of interpersonal skills.\nThe biggest lesson? You are never fully prepared. Every iteration of Locked Shields is different. But each one sharpens not only your skills, but also your ability to function as a team under extreme conditions.\nFrom the Battlefield to the Classroom This experience directly impacts the classroom. Inspired by the exercise, Howest is introducing new hands-on courses like “Glutamine” in semester five. Students will be dropped into realistic broken networks, with misconfigurations, fake firewalls and simulated threats. It is chaos, but controlled. And that is the point.\nAs one speaker said: “You don’t win Locked Shields. You just survive it better than the rest.”\nFinal Thoughts The exercise teaches more than just cybersecurity. It builds trust. It proves that knowing your teammates can be as important as knowing the tools. Whether that comes from a shared flight or a pre-exercise barbecue, it all matters when the pressure hits.\nWant to see how cyber defence works in real life? This is it.\n","date":"May 13, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog-2_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog-2_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-1/","title":"Cyber Defence on the Digital Frontline: A Mission with NATO"},{"categories":["cybersecurity","CTF","education"],"contents":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience On March 14 and 15, I joined the Cyber Security Challenge Belgium qualifiers with three teammates. For two days, we threw ourselves at CTF challenges covering binary exploitation, Android reversing, cryptography, and more.\nWhat follows is a short recap of the challenges I worked on—some I solved, some I didn’t—but all of them were worth the hours spent.\nA Buffer Overflow to Warm Up One of the first challenges I picked involved a binary with a basic stack overflow. I used standard techniques—finding the offset, hijacking the return address, and injecting shellcode. Tools like pwntools helped automate the payload crafting. It was a good warm-up, and it reminded me how subtle some bugs can be when you\u0026rsquo;re rushed.\nCryptography and Pattern Matching There was a crypto puzzle where I had to find a seed that reproduced a specific ASCII art banner. Once I understood how the banner was generated, I brute-forced possible seeds until one matched. It was a quick but fun exercise in spotting structure and automating search.\nAndroid Reversing: FRIDA and JADX Several APKs were part of the qualifier set. I used JADX to decompile them and FRIDA to patch logic at runtime. In one challenge, I had to bypass some form of license validation. By hooking into the relevant method and forcing it to always return true, I could reveal hidden sections of the app.\nBut one Android challenge stood out more than any other.\nThe Challenge That Stuck with Me: Rebuilding a Split DEX This one was different.\nThe app presented a 4×8 button grid. Each button, when pressed, recorded an index. After pressing several buttons and hitting \u0026ldquo;GO,\u0026rdquo; the app would try to assemble something in memory and load it as a class.\nLooking deeper, I found this in the decompiled code:\nInputStream open = assets.open(String.format(\u0026#34;block%02d\u0026#34;, it.next())); ... Class loadClass = new InMemoryDexClassLoader(ByteBuffer.wrap(byteArrayOutputStream.toByteArray()), getClassLoader()) .loadClass(\u0026#34;be.dauntless.flag.Flag\u0026#34;); Each index corresponded to an asset file named blockXX, and the app was stitching these binary chunks into a single byte stream. It then tried to load the result as a DEX file containing a Flag class.\nThe hard part? There were 31 blocks and no obvious way to know the correct order. The buttons reset after each attempt, making brute-force infeasible. My job was to reverse-engineer the right sequence.\nI tried analyzing the individual blocks to extract string constants, method fragments, and bytecode patterns. I wrote a script to group fragments and infer relative positions, like solving a jigsaw puzzle blindfolded. I made progress, but I never completed it. That puzzle stuck with me because it combined static analysis, runtime loading, and logical reconstruction in a way that no other challenge did.\nThe One That Got Away: TLS Fingerprinting I also spent time on a Go-based TLS server that rejected all my attempts to connect unless my client fingerprint was exactly right. I tried adjusting everything in the tls.Config—cipher suite order, ALPN, even protocol version:\ntls.Config{ MinVersion: tls.VersionTLS13, CipherSuites: []uint16{ tls.TLS_AES_128_GCM_SHA256, // ... }, NextProtos: []string{\u0026#34;h2\u0026#34;}, } But nothing worked. I suspect the server checked deep JA4-style fingerprinting, and I just couldn’t replicate the original client behavior. It was frustrating—but also a good reminder of how messy and detailed real-world protocol handling can be.\nFinal Thoughts I didn’t solve everything. Far from it. But that’s not really the point. Each challenge taught me something—whether it was about Android’s InMemoryDexClassLoader, raw memory reconstruction, or TLS quirks. Working as a team with Evarist, Nathan, and Waut also made it fun, even when we were all stuck.\nIf you\u0026rsquo;re even a little curious about cybersecurity, I can’t recommend this kind of event enough. It’s hands-on, intense, and full of problems that make you think in ways formal education often doesn\u0026rsquo;t.\n","date":"March 15, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog-2_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog-2_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-2/","title":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience"},{"categories":null,"contents":"I built my personal blog using Hugo and deployed it on a lightweight Alpine Linux VPS. I chose this setup to have full control, keep things simple, and avoid bloated platforms or services. Here’s how the process went from site generation to live deployment.\nCreating the Hugo Site On my development machine, I created a new Hugo site:\nhugo new site howest-blog I used the professors-hugo theme and copied its exampleSite content into my project. I customized the layout, structure, and styling by editing content files, SCSS in assets/scss/custom.scss, and partial templates in the theme directory.\nAll content lives under content/, with separate folders for blog/ and project/, each containing .md files with front matter and Markdown content.\nCustomization I edited the config/_default/hugo.toml to configure site parameters like the base URL, theme, language, and menus. SCSS and image assets go in assets/, and are processed by Hugo\u0026rsquo;s pipeline. Static files like favicons are placed in static/.\nTo preview the site locally:\nhugo server To build the static site:\nhugo This generates everything in the public/ folder.\nVPS Deployment I rented a minimal Alpine Linux VPS and installed only what I needed. After setting up SSH and a basic nginx web server, I copied the public/ folder over using scp:\nscp -r public/* user@my-vps:/var/www/html On the VPS, I installed nginx:\napk add nginx And configured /etc/nginx/conf.d/default.conf to serve files from /var/www/html. Then I enabled and started nginx:\nrc-service nginx start rc-update add nginx Now my Hugo site is live and served directly as static files—no backend, no database, just HTML, CSS, and JS.\nWhy Alpine + Hugo? Alpine Linux is minimal and fast, perfect for serving static sites with low resource usage. Combined with Hugo’s speed and flexibility, I get a complete, performant setup that I fully control. It’s secure, lightweight, and easy to update—just rebuild and re-upload the public/ folder.\nThis setup is perfect if you want full control and minimal overhead for a personal blog or portfolio.\n","date":"May 29, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-2/","title":"Building My Hugo Website on a VPS"},{"categories":null,"contents":"DRMDTool is an automation-centric utility designed to streamline the processing of .drmd files by tightly integrating with the N_m3u8DL-RE downloader. The tool offers robust automation via a watch folder and an intuitive web-based interface, significantly reducing the friction for managing and processing DRM-protected streaming content.\nWhat’s New DRMDTool has evolved into a comprehensive platform for batch downloading with enhanced support for user interaction and background processing. It features granular job tracking, dynamic download control (pause, resume, abort), and a refined WebSocket-based console for real-time command output. Subtitle handling now includes automatic downloading and conversion from VTT to SRT, and the downloader adapts based on metadata, organizing content into categorized directories.\nGoals and Use Case The primary aim is to automate .drmd file processing with minimal manual input. Users can configure download formats, specify directories, and enable real-time command broadcasting. DRMDTool is suitable for both interactive use through a web UI and headless automation in pipelines, supporting inotify or polling-based folder watching.\nHow .drmd Files Work A .drmd file is a structured JSON document that defines one or more encrypted media items to be processed by DRMDTool. It contains an Items array, with each item representing a specific media job. DRMDTool parses these entries to generate download commands for N_m3u8DL-RE.\nEach item includes:\nMPD: A DASH manifest, either a direct URL or a base64-encoded version. If base64-encoded, DRMDTool decodes and temporarily saves it before use. Keys: A comma-separated list of KID:key pairs (e.g., abcd1234ef567890:00112233445566778899aabbccddeeff). These are required for decrypting encrypted media streams and are passed directly to N_m3u8DL-RE using --key flags. Filename: The name to be used for the final output file. Subtitles: Comma-separated list of subtitle URLs in .vtt format. DRMDTool downloads and converts these to .srt, then muxes them into the final file. Metadata: A semicolon-separated string like Title;Type;Season (e.g., Example Show;serie;1) used to determine directory structure (Movies/Title or Series/Title/Season). Description and Poster: Optional fields used only for display in the web UI. Example .drmd Structure { \u0026#34;Items\u0026#34;: [ { \u0026#34;MPD\u0026#34;: \u0026#34;aHR0cHM6Ly9leGFtcGxlLmNvbS9zdHJlYW0ubXBk\u0026#34;, \u0026#34;Keys\u0026#34;: \u0026#34;abcd1234ef567890:00112233445566778899aabbccddeeff\u0026#34;, \u0026#34;Filename\u0026#34;: \u0026#34;ExampleShow.S01E01\u0026#34;, \u0026#34;Subtitles\u0026#34;: \u0026#34;https://example.com/sub1.vtt,https://example.com/sub2.vtt\u0026#34;, \u0026#34;Metadata\u0026#34;: \u0026#34;Example Show;serie;1\u0026#34;, \u0026#34;Description\u0026#34;: \u0026#34;Pilot episode\u0026#34;, \u0026#34;Poster\u0026#34;: \u0026#34;\u0026#34; } ] } Processing Steps Detection: DRMDTool either watches a folder or receives .drmd uploads through the web UI. Validation: It waits for the file to finish writing (based on file size stability), then parses its contents. MPD Handling: If base64-encoded, the MPD is decoded and written to a temp file; otherwise, the URL is fetched or passed as-is. Command Generation: Using the MPD, KID:key pairs, output paths, and subtitles, DRMDTool builds a command line for N_m3u8DL-RE. Execution: The download is launched with live progress tracking. Users can pause, resume, or abort jobs, and optionally stream console output via WebSocket. These files serve as portable job definitions. When DRMDTool detects or receives a .drmd file, it parses the items, decodes or downloads the MPD, applies the keys, and builds a download command using N_m3u8DL-RE. Files are saved in organized directories like Movies/Title or Series/Title/Season, and subtitles are embedded if available. Pausing, resuming, and aborting downloads is supported per file.\nArchitecture Overview The configuration is handled via config.toml, with environment variable overrides for containerized or dynamic deployments. Once started, the tool can either monitor a specified folder or allow file uploads through the UI. Each .drmd file is parsed, grouped by series and season (if applicable), and processed sequentially with support for job pausing and resuming.\nWeb UI \u0026amp; CLI To use:\n./drmdtool Visit http://localhost:8080 for the web interface, which supports drag-and-drop uploads, selection of episodes or movies, and real-time progress tracking. For headless operation:\n./drmdtool -f /path/to/file.drmd Jobs can be paused, resumed, or aborted through the web interface, which reflects the backend state via live updates.\nEnhanced Download Logic DRMDTool dynamically builds download commands using metadata from .drmd files and user preferences. It ensures that only the highest quality streams are kept, removing ad periods and duplicate segments from the MPD files. Subtitles are fetched and embedded automatically. Jobs are tracked with robust state management and logs for debugging and visibility.\nRepository Code and setup instructions are hosted here: https://git.directme.in/Joren/DRMDTool\nDRMDtool For advanced usage details, customization, and API structure, refer to the README.md in the repository.\nUI Previews Index Page Select Page Progress Page ","date":"May 21, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-1/","title":"DRMDTool Project"},{"categories":["cybersecurity","event recap"],"contents":"Cyber Defence on the Digital Frontline: A Mission with NATO On a Mission with NATO: Cyber Defence on the Frontline Howest’s ongoing commitment to world-class cybersecurity training took center stage again as six lecturers from the Cyber Security program joined forces with experts from Latvia, Luxembourg and Belgium in one of NATO\u0026rsquo;s most intensive simulations: the Locked Shields exercise, hosted by the Cooperative Cyber Defence Centre of Excellence (CCDCOE). Now in its fifth year of participation, the Howest team shared their firsthand experiences at a special evening talk at Howest Bruges.\nThe Exercise: Locked Shields Locked Shields is no ordinary simulation. It is a full-scale, live-fire cyber defence exercise involving more than 6,000 machines and a narrative scenario so detailed it includes geopolitics, disinformation and even fictional countries. This year, the Blue Team 03 (our team) defended a simulated nation’s critical infrastructure including power plants, satellites, 5G networks and banking systems, all while under constant attack from a coordinated Red Team using automated scripts and over 28,000 attacks across two days.\nAnd yes, every team (Red, Blue, Yellow, White) uses Ansible. For everything.\nHigh Stakes, Real Lessons What do you do when a rogue process might be malware, or maybe just a poorly named service? What happens when your teammate refuses to act unless something is “officially malicious”? The team faced cultural clashes, communication breakdowns and stress-testing of both systems and people.\nThe exercise required more than technical fixes. It demanded communication with simulated commanders, media and public stakeholders. Reporting became just as important as patching. It taught participants how to translate technical impact into real-world consequences. Not \u0026ldquo;port 8443 unreachable\u0026rdquo;, but \u0026ldquo;our air defence system is degraded, and we cannot fly planes\u0026rdquo;.\nThe Black Team: Rapid Response in Action A new but powerful presence in the simulation was the Black Team, a rapid-response unit deployed when problems became too complex for any single team. Acting like special forces, they jumped in when incidents crossed team boundaries or demanded unconventional solutions. Their mission was to find out what was happening, assess the impact and suggest fast, creative responses. Introduced just last year, this team quickly proved its value again in 2025. They even embraced the role with style — “you can wear sunglasses inside” became their unofficial motto.\nTheir presence underlined a critical lesson: not every problem fits neatly within a team’s silo. Real-world defence requires flexibility, speed and lateral thinking.\nHighlights and Blooper Reel There were plenty of mishaps. Misfired scripts, team mix-ups, and one case where a DNS setup from a previous year was reused by mistake. Someone tried renaming cut to shutdown, breaking essential operations until it was fixed. Systems rebooted into chaos, a manual was uploaded to public GitHub, and the team had to quickly learn the difference between symbolic links and real binaries.\nHuman Factors and Growth From detecting malware with Velociraptor and Q9, to encountering teammates who took orders literally, the learning was intense. One participant noted that while Belgian and Luxembourg teams prioritized knowledge sharing, others preferred strict protocol. This highlighted cultural differences and the importance of interpersonal skills.\nThe biggest lesson? You are never fully prepared. Every iteration of Locked Shields is different. But each one sharpens not only your skills, but also your ability to function as a team under extreme conditions.\nFrom the Battlefield to the Classroom This experience directly impacts the classroom. Inspired by the exercise, Howest is introducing new hands-on courses like “Glutamine” in semester five. Students will be dropped into realistic broken networks, with misconfigurations, fake firewalls and simulated threats. It is chaos, but controlled. And that is the point.\nAs one speaker said: “You don’t win Locked Shields. You just survive it better than the rest.”\nFinal Thoughts The exercise teaches more than just cybersecurity. It builds trust. It proves that knowing your teammates can be as important as knowing the tools. Whether that comes from a shared flight or a pre-exercise barbecue, it all matters when the pressure hits.\nWant to see how cyber defence works in real life? This is it.\n","date":"May 13, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog-2_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog-2_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-1/","title":"Cyber Defence on the Digital Frontline: A Mission with NATO"},{"categories":["cybersecurity","CTF","education"],"contents":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience On March 14 and 15, I joined the Cyber Security Challenge Belgium qualifiers with three teammates. For two days, we threw ourselves at CTF challenges covering binary exploitation, Android reversing, cryptography, and more.\nWhat follows is a short recap of the challenges I worked on—some I solved, some I didn’t—but all of them were worth the hours spent.\nA Buffer Overflow to Warm Up One of the first challenges I picked involved a binary with a basic stack overflow. I used standard techniques—finding the offset, hijacking the return address, and injecting shellcode. Tools like pwntools helped automate the payload crafting. It was a good warm-up, and it reminded me how subtle some bugs can be when you\u0026rsquo;re rushed.\nCryptography and Pattern Matching There was a crypto puzzle where I had to find a seed that reproduced a specific ASCII art banner. Once I understood how the banner was generated, I brute-forced possible seeds until one matched. It was a quick but fun exercise in spotting structure and automating search.\nAndroid Reversing: FRIDA and JADX Several APKs were part of the qualifier set. I used JADX to decompile them and FRIDA to patch logic at runtime. In one challenge, I had to bypass some form of license validation. By hooking into the relevant method and forcing it to always return true, I could reveal hidden sections of the app.\nBut one Android challenge stood out more than any other.\nThe Challenge That Stuck with Me: Rebuilding a Split DEX This one was different.\nThe app presented a 4×8 button grid. Each button, when pressed, recorded an index. After pressing several buttons and hitting \u0026ldquo;GO,\u0026rdquo; the app would try to assemble something in memory and load it as a class.\nLooking deeper, I found this in the decompiled code:\nInputStream open = assets.open(String.format(\u0026#34;block%02d\u0026#34;, it.next())); ... Class loadClass = new InMemoryDexClassLoader(ByteBuffer.wrap(byteArrayOutputStream.toByteArray()), getClassLoader()) .loadClass(\u0026#34;be.dauntless.flag.Flag\u0026#34;); Each index corresponded to an asset file named blockXX, and the app was stitching these binary chunks into a single byte stream. It then tried to load the result as a DEX file containing a Flag class.\nThe hard part? There were 31 blocks and no obvious way to know the correct order. The buttons reset after each attempt, making brute-force infeasible. My job was to reverse-engineer the right sequence.\nI tried analyzing the individual blocks to extract string constants, method fragments, and bytecode patterns. I wrote a script to group fragments and infer relative positions, like solving a jigsaw puzzle blindfolded. I made progress, but I never completed it. That puzzle stuck with me because it combined static analysis, runtime loading, and logical reconstruction in a way that no other challenge did.\nThe One That Got Away: TLS Fingerprinting I also spent time on a Go-based TLS server that rejected all my attempts to connect unless my client fingerprint was exactly right. I tried adjusting everything in the tls.Config—cipher suite order, ALPN, even protocol version:\ntls.Config{ MinVersion: tls.VersionTLS13, CipherSuites: []uint16{ tls.TLS_AES_128_GCM_SHA256, // ... }, NextProtos: []string{\u0026#34;h2\u0026#34;}, } But nothing worked. I suspect the server checked deep JA4-style fingerprinting, and I just couldn’t replicate the original client behavior. It was frustrating—but also a good reminder of how messy and detailed real-world protocol handling can be.\nFinal Thoughts I didn’t solve everything. Far from it. But that’s not really the point. Each challenge taught me something—whether it was about Android’s InMemoryDexClassLoader, raw memory reconstruction, or TLS quirks. Working as a team with Evarist, Nathan, and Waut also made it fun, even when we were all stuck.\nIf you\u0026rsquo;re even a little curious about cybersecurity, I can’t recommend this kind of event enough. It’s hands-on, intense, and full of problems that make you think in ways formal education often doesn\u0026rsquo;t.\n","date":"March 15, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog-2_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog-2_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-2/","title":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience"},{"categories":null,"contents":"I built my personal blog using Hugo and deployed it on a lightweight Alpine Linux VPS. I chose this setup to have full control, keep things simple, and avoid bloated platforms or services. Here’s how the process went from site generation to live deployment.\nCreating the Hugo Site On my development machine, I created a new Hugo site:\nhugo new site howest-blog I used the professors-hugo theme and copied its exampleSite content into my project. I customized the layout, structure, and styling by editing content files, SCSS in assets/scss/custom.scss, and partial templates in the theme directory.\nAll content lives under content/, with separate folders for blog/ and project/, each containing .md files with front matter and Markdown content.\nCustomization I edited the config/_default/hugo.toml to configure site parameters like the base URL, theme, language, and menus. SCSS and image assets go in assets/, and are processed by Hugo\u0026rsquo;s pipeline. Static files like favicons are placed in static/.\nTo preview the site locally:\nhugo server To build the static site:\nhugo This generates everything in the public/ folder.\nVPS Deployment I rented a minimal Alpine Linux VPS and installed only what I needed. After setting up SSH and a basic nginx web server, I copied the public/ folder over using scp:\nscp -r public/* user@my-vps:/var/www/html On the VPS, I installed nginx:\napk add nginx And configured /etc/nginx/conf.d/default.conf to serve files from /var/www/html. Then I enabled and started nginx:\nrc-service nginx start rc-update add nginx Now my Hugo site is live and served directly as static files—no backend, no database, just HTML, CSS, and JS.\nWhy Alpine + Hugo? Alpine Linux is minimal and fast, perfect for serving static sites with low resource usage. Combined with Hugo’s speed and flexibility, I get a complete, performant setup that I fully control. It’s secure, lightweight, and easy to update—just rebuild and re-upload the public/ folder.\nThis setup is perfect if you want full control and minimal overhead for a personal blog or portfolio.\n","date":"May 29, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-2/","title":"Building My Hugo Website on a VPS"},{"categories":null,"contents":"DRMDTool is an automation-centric utility designed to streamline the processing of .drmd files by tightly integrating with the N_m3u8DL-RE downloader. The tool offers robust automation via a watch folder and an intuitive web-based interface, significantly reducing the friction for managing and processing DRM-protected streaming content.\nWhat’s New DRMDTool has evolved into a comprehensive platform for batch downloading with enhanced support for user interaction and background processing. It features granular job tracking, dynamic download control (pause, resume, abort), and a refined WebSocket-based console for real-time command output. Subtitle handling now includes automatic downloading and conversion from VTT to SRT, and the downloader adapts based on metadata, organizing content into categorized directories.\nGoals and Use Case The primary aim is to automate .drmd file processing with minimal manual input. Users can configure download formats, specify directories, and enable real-time command broadcasting. DRMDTool is suitable for both interactive use through a web UI and headless automation in pipelines, supporting inotify or polling-based folder watching.\nHow .drmd Files Work A .drmd file is a structured JSON document that defines one or more encrypted media items to be processed by DRMDTool. It contains an Items array, with each item representing a specific media job. DRMDTool parses these entries to generate download commands for N_m3u8DL-RE.\nEach item includes:\nMPD: A DASH manifest, either a direct URL or a base64-encoded version. If base64-encoded, DRMDTool decodes and temporarily saves it before use. Keys: A comma-separated list of KID:key pairs (e.g., abcd1234ef567890:00112233445566778899aabbccddeeff). These are required for decrypting encrypted media streams and are passed directly to N_m3u8DL-RE using --key flags. Filename: The name to be used for the final output file. Subtitles: Comma-separated list of subtitle URLs in .vtt format. DRMDTool downloads and converts these to .srt, then muxes them into the final file. Metadata: A semicolon-separated string like Title;Type;Season (e.g., Example Show;serie;1) used to determine directory structure (Movies/Title or Series/Title/Season). Description and Poster: Optional fields used only for display in the web UI. Example .drmd Structure { \u0026#34;Items\u0026#34;: [ { \u0026#34;MPD\u0026#34;: \u0026#34;aHR0cHM6Ly9leGFtcGxlLmNvbS9zdHJlYW0ubXBk\u0026#34;, \u0026#34;Keys\u0026#34;: \u0026#34;abcd1234ef567890:00112233445566778899aabbccddeeff\u0026#34;, \u0026#34;Filename\u0026#34;: \u0026#34;ExampleShow.S01E01\u0026#34;, \u0026#34;Subtitles\u0026#34;: \u0026#34;https://example.com/sub1.vtt,https://example.com/sub2.vtt\u0026#34;, \u0026#34;Metadata\u0026#34;: \u0026#34;Example Show;serie;1\u0026#34;, \u0026#34;Description\u0026#34;: \u0026#34;Pilot episode\u0026#34;, \u0026#34;Poster\u0026#34;: \u0026#34;\u0026#34; } ] } Processing Steps Detection: DRMDTool either watches a folder or receives .drmd uploads through the web UI. Validation: It waits for the file to finish writing (based on file size stability), then parses its contents. MPD Handling: If base64-encoded, the MPD is decoded and written to a temp file; otherwise, the URL is fetched or passed as-is. Command Generation: Using the MPD, KID:key pairs, output paths, and subtitles, DRMDTool builds a command line for N_m3u8DL-RE. Execution: The download is launched with live progress tracking. Users can pause, resume, or abort jobs, and optionally stream console output via WebSocket. These files serve as portable job definitions. When DRMDTool detects or receives a .drmd file, it parses the items, decodes or downloads the MPD, applies the keys, and builds a download command using N_m3u8DL-RE. Files are saved in organized directories like Movies/Title or Series/Title/Season, and subtitles are embedded if available. Pausing, resuming, and aborting downloads is supported per file.\nArchitecture Overview The configuration is handled via config.toml, with environment variable overrides for containerized or dynamic deployments. Once started, the tool can either monitor a specified folder or allow file uploads through the UI. Each .drmd file is parsed, grouped by series and season (if applicable), and processed sequentially with support for job pausing and resuming.\nWeb UI \u0026amp; CLI To use:\n./drmdtool Visit http://localhost:8080 for the web interface, which supports drag-and-drop uploads, selection of episodes or movies, and real-time progress tracking. For headless operation:\n./drmdtool -f /path/to/file.drmd Jobs can be paused, resumed, or aborted through the web interface, which reflects the backend state via live updates.\nEnhanced Download Logic DRMDTool dynamically builds download commands using metadata from .drmd files and user preferences. It ensures that only the highest quality streams are kept, removing ad periods and duplicate segments from the MPD files. Subtitles are fetched and embedded automatically. Jobs are tracked with robust state management and logs for debugging and visibility.\nRepository Code and setup instructions are hosted here: https://git.directme.in/Joren/DRMDTool\nDRMDtool For advanced usage details, customization, and API structure, refer to the README.md in the repository.\nUI Previews Index Page Select Page Progress Page ","date":"May 21, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-1/","title":"DRMDTool Project"},{"categories":["cybersecurity","event recap"],"contents":"Cyber Defence on the Digital Frontline: A Mission with NATO On a Mission with NATO: Cyber Defence on the Frontline Howest’s ongoing commitment to world-class cybersecurity training took center stage again as six lecturers from the Cyber Security program joined forces with experts from Latvia, Luxembourg and Belgium in one of NATO\u0026rsquo;s most intensive simulations: the Locked Shields exercise, hosted by the Cooperative Cyber Defence Centre of Excellence (CCDCOE). Now in its fifth year of participation, the Howest team shared their firsthand experiences at a special evening talk at Howest Bruges.\nThe Exercise: Locked Shields Locked Shields is no ordinary simulation. It is a full-scale, live-fire cyber defence exercise involving more than 6,000 machines and a narrative scenario so detailed it includes geopolitics, disinformation and even fictional countries. This year, the Blue Team 03 (our team) defended a simulated nation’s critical infrastructure including power plants, satellites, 5G networks and banking systems, all while under constant attack from a coordinated Red Team using automated scripts and over 28,000 attacks across two days.\nAnd yes, every team (Red, Blue, Yellow, White) uses Ansible. For everything.\nHigh Stakes, Real Lessons What do you do when a rogue process might be malware, or maybe just a poorly named service? What happens when your teammate refuses to act unless something is “officially malicious”? The team faced cultural clashes, communication breakdowns and stress-testing of both systems and people.\nThe exercise required more than technical fixes. It demanded communication with simulated commanders, media and public stakeholders. Reporting became just as important as patching. It taught participants how to translate technical impact into real-world consequences. Not \u0026ldquo;port 8443 unreachable\u0026rdquo;, but \u0026ldquo;our air defence system is degraded, and we cannot fly planes\u0026rdquo;.\nThe Black Team: Rapid Response in Action A new but powerful presence in the simulation was the Black Team, a rapid-response unit deployed when problems became too complex for any single team. Acting like special forces, they jumped in when incidents crossed team boundaries or demanded unconventional solutions. Their mission was to find out what was happening, assess the impact and suggest fast, creative responses. Introduced just last year, this team quickly proved its value again in 2025. They even embraced the role with style — “you can wear sunglasses inside” became their unofficial motto.\nTheir presence underlined a critical lesson: not every problem fits neatly within a team’s silo. Real-world defence requires flexibility, speed and lateral thinking.\nHighlights and Blooper Reel There were plenty of mishaps. Misfired scripts, team mix-ups, and one case where a DNS setup from a previous year was reused by mistake. Someone tried renaming cut to shutdown, breaking essential operations until it was fixed. Systems rebooted into chaos, a manual was uploaded to public GitHub, and the team had to quickly learn the difference between symbolic links and real binaries.\nHuman Factors and Growth From detecting malware with Velociraptor and Q9, to encountering teammates who took orders literally, the learning was intense. One participant noted that while Belgian and Luxembourg teams prioritized knowledge sharing, others preferred strict protocol. This highlighted cultural differences and the importance of interpersonal skills.\nThe biggest lesson? You are never fully prepared. Every iteration of Locked Shields is different. But each one sharpens not only your skills, but also your ability to function as a team under extreme conditions.\nFrom the Battlefield to the Classroom This experience directly impacts the classroom. Inspired by the exercise, Howest is introducing new hands-on courses like “Glutamine” in semester five. Students will be dropped into realistic broken networks, with misconfigurations, fake firewalls and simulated threats. It is chaos, but controlled. And that is the point.\nAs one speaker said: “You don’t win Locked Shields. You just survive it better than the rest.”\nFinal Thoughts The exercise teaches more than just cybersecurity. It builds trust. It proves that knowing your teammates can be as important as knowing the tools. Whether that comes from a shared flight or a pre-exercise barbecue, it all matters when the pressure hits.\nWant to see how cyber defence works in real life? This is it.\n","date":"May 13, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog-2_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog-2_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-1/","title":"Cyber Defence on the Digital Frontline: A Mission with NATO"},{"categories":["cybersecurity","CTF","education"],"contents":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience On March 14 and 15, I joined the Cyber Security Challenge Belgium qualifiers with three teammates. For two days, we threw ourselves at CTF challenges covering binary exploitation, Android reversing, cryptography, and more.\nWhat follows is a short recap of the challenges I worked on—some I solved, some I didn’t—but all of them were worth the hours spent.\nA Buffer Overflow to Warm Up One of the first challenges I picked involved a binary with a basic stack overflow. I used standard techniques—finding the offset, hijacking the return address, and injecting shellcode. Tools like pwntools helped automate the payload crafting. It was a good warm-up, and it reminded me how subtle some bugs can be when you\u0026rsquo;re rushed.\nCryptography and Pattern Matching There was a crypto puzzle where I had to find a seed that reproduced a specific ASCII art banner. Once I understood how the banner was generated, I brute-forced possible seeds until one matched. It was a quick but fun exercise in spotting structure and automating search.\nAndroid Reversing: FRIDA and JADX Several APKs were part of the qualifier set. I used JADX to decompile them and FRIDA to patch logic at runtime. In one challenge, I had to bypass some form of license validation. By hooking into the relevant method and forcing it to always return true, I could reveal hidden sections of the app.\nBut one Android challenge stood out more than any other.\nThe Challenge That Stuck with Me: Rebuilding a Split DEX This one was different.\nThe app presented a 4×8 button grid. Each button, when pressed, recorded an index. After pressing several buttons and hitting \u0026ldquo;GO,\u0026rdquo; the app would try to assemble something in memory and load it as a class.\nLooking deeper, I found this in the decompiled code:\nInputStream open = assets.open(String.format(\u0026#34;block%02d\u0026#34;, it.next())); ... Class loadClass = new InMemoryDexClassLoader(ByteBuffer.wrap(byteArrayOutputStream.toByteArray()), getClassLoader()) .loadClass(\u0026#34;be.dauntless.flag.Flag\u0026#34;); Each index corresponded to an asset file named blockXX, and the app was stitching these binary chunks into a single byte stream. It then tried to load the result as a DEX file containing a Flag class.\nThe hard part? There were 31 blocks and no obvious way to know the correct order. The buttons reset after each attempt, making brute-force infeasible. My job was to reverse-engineer the right sequence.\nI tried analyzing the individual blocks to extract string constants, method fragments, and bytecode patterns. I wrote a script to group fragments and infer relative positions, like solving a jigsaw puzzle blindfolded. I made progress, but I never completed it. That puzzle stuck with me because it combined static analysis, runtime loading, and logical reconstruction in a way that no other challenge did.\nThe One That Got Away: TLS Fingerprinting I also spent time on a Go-based TLS server that rejected all my attempts to connect unless my client fingerprint was exactly right. I tried adjusting everything in the tls.Config—cipher suite order, ALPN, even protocol version:\ntls.Config{ MinVersion: tls.VersionTLS13, CipherSuites: []uint16{ tls.TLS_AES_128_GCM_SHA256, // ... }, NextProtos: []string{\u0026#34;h2\u0026#34;}, } But nothing worked. I suspect the server checked deep JA4-style fingerprinting, and I just couldn’t replicate the original client behavior. It was frustrating—but also a good reminder of how messy and detailed real-world protocol handling can be.\nFinal Thoughts I didn’t solve everything. Far from it. But that’s not really the point. Each challenge taught me something—whether it was about Android’s InMemoryDexClassLoader, raw memory reconstruction, or TLS quirks. Working as a team with Evarist, Nathan, and Waut also made it fun, even when we were all stuck.\nIf you\u0026rsquo;re even a little curious about cybersecurity, I can’t recommend this kind of event enough. It’s hands-on, intense, and full of problems that make you think in ways formal education often doesn\u0026rsquo;t.\n","date":"March 15, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog-2_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog-2_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-2/","title":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience"},{"categories":null,"contents":"I built my personal blog using Hugo and deployed it on a lightweight Alpine Linux VPS. I chose this setup to have full control, keep things simple, and avoid bloated platforms or services. Here’s how the process went from site generation to live deployment.\nCreating the Hugo Site On my development machine, I created a new Hugo site:\nhugo new site howest-blog I used the professors-hugo theme and copied its exampleSite content into my project. I customized the layout, structure, and styling by editing content files, SCSS in assets/scss/custom.scss, and partial templates in the theme directory.\nAll content lives under content/, with separate folders for blog/ and project/, each containing .md files with front matter and Markdown content.\nCustomization I edited the config/_default/hugo.toml to configure site parameters like the base URL, theme, language, and menus. SCSS and image assets go in assets/, and are processed by Hugo\u0026rsquo;s pipeline. Static files like favicons are placed in static/.\nTo preview the site locally:\nhugo server To build the static site:\nhugo This generates everything in the public/ folder.\nVPS Deployment I rented a minimal Alpine Linux VPS and installed only what I needed. After setting up SSH and a basic nginx web server, I copied the public/ folder over using scp:\nscp -r public/* user@my-vps:/var/www/html On the VPS, I installed nginx:\napk add nginx And configured /etc/nginx/conf.d/default.conf to serve files from /var/www/html. Then I enabled and started nginx:\nrc-service nginx start rc-update add nginx Now my Hugo site is live and served directly as static files—no backend, no database, just HTML, CSS, and JS.\nWhy Alpine + Hugo? Alpine Linux is minimal and fast, perfect for serving static sites with low resource usage. Combined with Hugo’s speed and flexibility, I get a complete, performant setup that I fully control. It’s secure, lightweight, and easy to update—just rebuild and re-upload the public/ folder.\nThis setup is perfect if you want full control and minimal overhead for a personal blog or portfolio.\n","date":"May 29, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-2/","title":"Building My Hugo Website on a VPS"},{"categories":null,"contents":"DRMDTool is an automation-centric utility designed to streamline the processing of .drmd files by tightly integrating with the N_m3u8DL-RE downloader. The tool offers robust automation via a watch folder and an intuitive web-based interface, significantly reducing the friction for managing and processing DRM-protected streaming content.\nWhat’s New DRMDTool has evolved into a comprehensive platform for batch downloading with enhanced support for user interaction and background processing. It features granular job tracking, dynamic download control (pause, resume, abort), and a refined WebSocket-based console for real-time command output. Subtitle handling now includes automatic downloading and conversion from VTT to SRT, and the downloader adapts based on metadata, organizing content into categorized directories.\nGoals and Use Case The primary aim is to automate .drmd file processing with minimal manual input. Users can configure download formats, specify directories, and enable real-time command broadcasting. DRMDTool is suitable for both interactive use through a web UI and headless automation in pipelines, supporting inotify or polling-based folder watching.\nHow .drmd Files Work A .drmd file is a structured JSON document that defines one or more encrypted media items to be processed by DRMDTool. It contains an Items array, with each item representing a specific media job. DRMDTool parses these entries to generate download commands for N_m3u8DL-RE.\nEach item includes:\nMPD: A DASH manifest, either a direct URL or a base64-encoded version. If base64-encoded, DRMDTool decodes and temporarily saves it before use. Keys: A comma-separated list of KID:key pairs (e.g., abcd1234ef567890:00112233445566778899aabbccddeeff). These are required for decrypting encrypted media streams and are passed directly to N_m3u8DL-RE using --key flags. Filename: The name to be used for the final output file. Subtitles: Comma-separated list of subtitle URLs in .vtt format. DRMDTool downloads and converts these to .srt, then muxes them into the final file. Metadata: A semicolon-separated string like Title;Type;Season (e.g., Example Show;serie;1) used to determine directory structure (Movies/Title or Series/Title/Season). Description and Poster: Optional fields used only for display in the web UI. Example .drmd Structure { \u0026#34;Items\u0026#34;: [ { \u0026#34;MPD\u0026#34;: \u0026#34;aHR0cHM6Ly9leGFtcGxlLmNvbS9zdHJlYW0ubXBk\u0026#34;, \u0026#34;Keys\u0026#34;: \u0026#34;abcd1234ef567890:00112233445566778899aabbccddeeff\u0026#34;, \u0026#34;Filename\u0026#34;: \u0026#34;ExampleShow.S01E01\u0026#34;, \u0026#34;Subtitles\u0026#34;: \u0026#34;https://example.com/sub1.vtt,https://example.com/sub2.vtt\u0026#34;, \u0026#34;Metadata\u0026#34;: \u0026#34;Example Show;serie;1\u0026#34;, \u0026#34;Description\u0026#34;: \u0026#34;Pilot episode\u0026#34;, \u0026#34;Poster\u0026#34;: \u0026#34;\u0026#34; } ] } Processing Steps Detection: DRMDTool either watches a folder or receives .drmd uploads through the web UI. Validation: It waits for the file to finish writing (based on file size stability), then parses its contents. MPD Handling: If base64-encoded, the MPD is decoded and written to a temp file; otherwise, the URL is fetched or passed as-is. Command Generation: Using the MPD, KID:key pairs, output paths, and subtitles, DRMDTool builds a command line for N_m3u8DL-RE. Execution: The download is launched with live progress tracking. Users can pause, resume, or abort jobs, and optionally stream console output via WebSocket. These files serve as portable job definitions. When DRMDTool detects or receives a .drmd file, it parses the items, decodes or downloads the MPD, applies the keys, and builds a download command using N_m3u8DL-RE. Files are saved in organized directories like Movies/Title or Series/Title/Season, and subtitles are embedded if available. Pausing, resuming, and aborting downloads is supported per file.\nArchitecture Overview The configuration is handled via config.toml, with environment variable overrides for containerized or dynamic deployments. Once started, the tool can either monitor a specified folder or allow file uploads through the UI. Each .drmd file is parsed, grouped by series and season (if applicable), and processed sequentially with support for job pausing and resuming.\nWeb UI \u0026amp; CLI To use:\n./drmdtool Visit http://localhost:8080 for the web interface, which supports drag-and-drop uploads, selection of episodes or movies, and real-time progress tracking. For headless operation:\n./drmdtool -f /path/to/file.drmd Jobs can be paused, resumed, or aborted through the web interface, which reflects the backend state via live updates.\nEnhanced Download Logic DRMDTool dynamically builds download commands using metadata from .drmd files and user preferences. It ensures that only the highest quality streams are kept, removing ad periods and duplicate segments from the MPD files. Subtitles are fetched and embedded automatically. Jobs are tracked with robust state management and logs for debugging and visibility.\nRepository Code and setup instructions are hosted here: https://git.directme.in/Joren/DRMDTool\nDRMDtool For advanced usage details, customization, and API structure, refer to the README.md in the repository.\nUI Previews Index Page Select Page Progress Page ","date":"May 21, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-1/","title":"DRMDTool Project"},{"categories":["cybersecurity","event recap"],"contents":"Cyber Defence on the Digital Frontline: A Mission with NATO On a Mission with NATO: Cyber Defence on the Frontline Howest’s ongoing commitment to world-class cybersecurity training took center stage again as six lecturers from the Cyber Security program joined forces with experts from Latvia, Luxembourg and Belgium in one of NATO\u0026rsquo;s most intensive simulations: the Locked Shields exercise, hosted by the Cooperative Cyber Defence Centre of Excellence (CCDCOE). Now in its fifth year of participation, the Howest team shared their firsthand experiences at a special evening talk at Howest Bruges.\nThe Exercise: Locked Shields Locked Shields is no ordinary simulation. It is a full-scale, live-fire cyber defence exercise involving more than 6,000 machines and a narrative scenario so detailed it includes geopolitics, disinformation and even fictional countries. This year, the Blue Team 03 (our team) defended a simulated nation’s critical infrastructure including power plants, satellites, 5G networks and banking systems, all while under constant attack from a coordinated Red Team using automated scripts and over 28,000 attacks across two days.\nAnd yes, every team (Red, Blue, Yellow, White) uses Ansible. For everything.\nHigh Stakes, Real Lessons What do you do when a rogue process might be malware, or maybe just a poorly named service? What happens when your teammate refuses to act unless something is “officially malicious”? The team faced cultural clashes, communication breakdowns and stress-testing of both systems and people.\nThe exercise required more than technical fixes. It demanded communication with simulated commanders, media and public stakeholders. Reporting became just as important as patching. It taught participants how to translate technical impact into real-world consequences. Not \u0026ldquo;port 8443 unreachable\u0026rdquo;, but \u0026ldquo;our air defence system is degraded, and we cannot fly planes\u0026rdquo;.\nThe Black Team: Rapid Response in Action A new but powerful presence in the simulation was the Black Team, a rapid-response unit deployed when problems became too complex for any single team. Acting like special forces, they jumped in when incidents crossed team boundaries or demanded unconventional solutions. Their mission was to find out what was happening, assess the impact and suggest fast, creative responses. Introduced just last year, this team quickly proved its value again in 2025. They even embraced the role with style — “you can wear sunglasses inside” became their unofficial motto.\nTheir presence underlined a critical lesson: not every problem fits neatly within a team’s silo. Real-world defence requires flexibility, speed and lateral thinking.\nHighlights and Blooper Reel There were plenty of mishaps. Misfired scripts, team mix-ups, and one case where a DNS setup from a previous year was reused by mistake. Someone tried renaming cut to shutdown, breaking essential operations until it was fixed. Systems rebooted into chaos, a manual was uploaded to public GitHub, and the team had to quickly learn the difference between symbolic links and real binaries.\nHuman Factors and Growth From detecting malware with Velociraptor and Q9, to encountering teammates who took orders literally, the learning was intense. One participant noted that while Belgian and Luxembourg teams prioritized knowledge sharing, others preferred strict protocol. This highlighted cultural differences and the importance of interpersonal skills.\nThe biggest lesson? You are never fully prepared. Every iteration of Locked Shields is different. But each one sharpens not only your skills, but also your ability to function as a team under extreme conditions.\nFrom the Battlefield to the Classroom This experience directly impacts the classroom. Inspired by the exercise, Howest is introducing new hands-on courses like “Glutamine” in semester five. Students will be dropped into realistic broken networks, with misconfigurations, fake firewalls and simulated threats. It is chaos, but controlled. And that is the point.\nAs one speaker said: “You don’t win Locked Shields. You just survive it better than the rest.”\nFinal Thoughts The exercise teaches more than just cybersecurity. It builds trust. It proves that knowing your teammates can be as important as knowing the tools. Whether that comes from a shared flight or a pre-exercise barbecue, it all matters when the pressure hits.\nWant to see how cyber defence works in real life? This is it.\n","date":"May 13, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n \n \n\n\n \n\n","permalink":"/blog/post-1/","title":"Cyber Defence on the Digital Frontline: A Mission with NATO"},{"categories":["cybersecurity","CTF","education"],"contents":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience On March 14 and 15, I joined the Cyber Security Challenge Belgium qualifiers with three teammates. For two days, we threw ourselves at CTF challenges covering binary exploitation, Android reversing, cryptography, and more.\nWhat follows is a short recap of the challenges I worked on—some I solved, some I didn’t—but all of them were worth the hours spent.\nA Buffer Overflow to Warm Up One of the first challenges I picked involved a binary with a basic stack overflow. I used standard techniques—finding the offset, hijacking the return address, and injecting shellcode. Tools like pwntools helped automate the payload crafting. It was a good warm-up, and it reminded me how subtle some bugs can be when you\u0026rsquo;re rushed.\nCryptography and Pattern Matching There was a crypto puzzle where I had to find a seed that reproduced a specific ASCII art banner. Once I understood how the banner was generated, I brute-forced possible seeds until one matched. It was a quick but fun exercise in spotting structure and automating search.\nAndroid Reversing: FRIDA and JADX Several APKs were part of the qualifier set. I used JADX to decompile them and FRIDA to patch logic at runtime. In one challenge, I had to bypass some form of license validation. By hooking into the relevant method and forcing it to always return true, I could reveal hidden sections of the app.\nBut one Android challenge stood out more than any other.\nThe Challenge That Stuck with Me: Rebuilding a Split DEX This one was different.\nThe app presented a 4×8 button grid. Each button, when pressed, recorded an index. After pressing several buttons and hitting \u0026ldquo;GO,\u0026rdquo; the app would try to assemble something in memory and load it as a class.\nLooking deeper, I found this in the decompiled code:\nInputStream open = assets.open(String.format(\u0026#34;block%02d\u0026#34;, it.next())); ... Class loadClass = new InMemoryDexClassLoader(ByteBuffer.wrap(byteArrayOutputStream.toByteArray()), getClassLoader()) .loadClass(\u0026#34;be.dauntless.flag.Flag\u0026#34;); Each index corresponded to an asset file named blockXX, and the app was stitching these binary chunks into a single byte stream. It then tried to load the result as a DEX file containing a Flag class.\nThe hard part? There were 31 blocks and no obvious way to know the correct order. The buttons reset after each attempt, making brute-force infeasible. My job was to reverse-engineer the right sequence.\nI tried analyzing the individual blocks to extract string constants, method fragments, and bytecode patterns. I wrote a script to group fragments and infer relative positions, like solving a jigsaw puzzle blindfolded. I made progress, but I never completed it. That puzzle stuck with me because it combined static analysis, runtime loading, and logical reconstruction in a way that no other challenge did.\nThe One That Got Away: TLS Fingerprinting I also spent time on a Go-based TLS server that rejected all my attempts to connect unless my client fingerprint was exactly right. I tried adjusting everything in the tls.Config—cipher suite order, ALPN, even protocol version:\ntls.Config{ MinVersion: tls.VersionTLS13, CipherSuites: []uint16{ tls.TLS_AES_128_GCM_SHA256, // ... }, NextProtos: []string{\u0026#34;h2\u0026#34;}, } But nothing worked. I suspect the server checked deep JA4-style fingerprinting, and I just couldn’t replicate the original client behavior. It was frustrating—but also a good reminder of how messy and detailed real-world protocol handling can be.\nFinal Thoughts I didn’t solve everything. Far from it. But that’s not really the point. Each challenge taught me something—whether it was about Android’s InMemoryDexClassLoader, raw memory reconstruction, or TLS quirks. Working as a team with Evarist, Nathan, and Waut also made it fun, even when we were all stuck.\nIf you\u0026rsquo;re even a little curious about cybersecurity, I can’t recommend this kind of event enough. It’s hands-on, intense, and full of problems that make you think in ways formal education often doesn\u0026rsquo;t.\n","date":"March 15, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n \n \n\n\n \n\n","permalink":"/blog/post-2/","title":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience"},{"categories":null,"contents":"I built my personal blog using Hugo and deployed it on a lightweight Alpine Linux VPS. I chose this setup to have full control, keep things simple, and avoid bloated platforms or services. Here’s how the process went from site generation to live deployment.\nCreating the Hugo Site On my development machine, I created a new Hugo site:\nhugo new site howest-blog I used the professors-hugo theme and copied its exampleSite content into my project. I customized the layout, structure, and styling by editing content files, SCSS in assets/scss/custom.scss, and partial templates in the theme directory.\nAll content lives under content/, with separate folders for blog/ and project/, each containing .md files with front matter and Markdown content.\nCustomization I edited the config/_default/hugo.toml to configure site parameters like the base URL, theme, language, and menus. SCSS and image assets go in assets/, and are processed by Hugo\u0026rsquo;s pipeline. Static files like favicons are placed in static/.\nTo preview the site locally:\nhugo server To build the static site:\nhugo This generates everything in the public/ folder.\nVPS Deployment I rented a minimal Alpine Linux VPS and installed only what I needed. After setting up SSH and a basic nginx web server, I copied the public/ folder over using scp:\nscp -r public/* user@my-vps:/var/www/html On the VPS, I installed nginx:\napk add nginx And configured /etc/nginx/conf.d/default.conf to serve files from /var/www/html. Then I enabled and started nginx:\nrc-service nginx start rc-update add nginx Now my Hugo site is live and served directly as static files—no backend, no database, just HTML, CSS, and JS.\nWhy Alpine + Hugo? Alpine Linux is minimal and fast, perfect for serving static sites with low resource usage. Combined with Hugo’s speed and flexibility, I get a complete, performant setup that I fully control. It’s secure, lightweight, and easy to update—just rebuild and re-upload the public/ folder.\nThis setup is perfect if you want full control and minimal overhead for a personal blog or portfolio.\n","date":"May 29, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-2/","title":"Building My Hugo Website on a VPS"},{"categories":null,"contents":"DRMDTool is an automation-centric utility designed to streamline the processing of .drmd files by tightly integrating with the N_m3u8DL-RE downloader. The tool offers robust automation via a watch folder and an intuitive web-based interface, significantly reducing the friction for managing and processing DRM-protected streaming content.\nWhat’s New DRMDTool has evolved into a comprehensive platform for batch downloading with enhanced support for user interaction and background processing. It features granular job tracking, dynamic download control (pause, resume, abort), and a refined WebSocket-based console for real-time command output. Subtitle handling now includes automatic downloading and conversion from VTT to SRT, and the downloader adapts based on metadata, organizing content into categorized directories.\nGoals and Use Case The primary aim is to automate .drmd file processing with minimal manual input. Users can configure download formats, specify directories, and enable real-time command broadcasting. DRMDTool is suitable for both interactive use through a web UI and headless automation in pipelines, supporting inotify or polling-based folder watching.\nHow .drmd Files Work A .drmd file is a structured JSON document that defines one or more encrypted media items to be processed by DRMDTool. It contains an Items array, with each item representing a specific media job. DRMDTool parses these entries to generate download commands for N_m3u8DL-RE.\nEach item includes:\nMPD: A DASH manifest, either a direct URL or a base64-encoded version. If base64-encoded, DRMDTool decodes and temporarily saves it before use. Keys: A comma-separated list of KID:key pairs (e.g., abcd1234ef567890:00112233445566778899aabbccddeeff). These are required for decrypting encrypted media streams and are passed directly to N_m3u8DL-RE using --key flags. Filename: The name to be used for the final output file. Subtitles: Comma-separated list of subtitle URLs in .vtt format. DRMDTool downloads and converts these to .srt, then muxes them into the final file. Metadata: A semicolon-separated string like Title;Type;Season (e.g., Example Show;serie;1) used to determine directory structure (Movies/Title or Series/Title/Season). Description and Poster: Optional fields used only for display in the web UI. Example .drmd Structure { \u0026#34;Items\u0026#34;: [ { \u0026#34;MPD\u0026#34;: \u0026#34;aHR0cHM6Ly9leGFtcGxlLmNvbS9zdHJlYW0ubXBk\u0026#34;, \u0026#34;Keys\u0026#34;: \u0026#34;abcd1234ef567890:00112233445566778899aabbccddeeff\u0026#34;, \u0026#34;Filename\u0026#34;: \u0026#34;ExampleShow.S01E01\u0026#34;, \u0026#34;Subtitles\u0026#34;: \u0026#34;https://example.com/sub1.vtt,https://example.com/sub2.vtt\u0026#34;, \u0026#34;Metadata\u0026#34;: \u0026#34;Example Show;serie;1\u0026#34;, \u0026#34;Description\u0026#34;: \u0026#34;Pilot episode\u0026#34;, \u0026#34;Poster\u0026#34;: \u0026#34;\u0026#34; } ] } Processing Steps Detection: DRMDTool either watches a folder or receives .drmd uploads through the web UI. Validation: It waits for the file to finish writing (based on file size stability), then parses its contents. MPD Handling: If base64-encoded, the MPD is decoded and written to a temp file; otherwise, the URL is fetched or passed as-is. Command Generation: Using the MPD, KID:key pairs, output paths, and subtitles, DRMDTool builds a command line for N_m3u8DL-RE. Execution: The download is launched with live progress tracking. Users can pause, resume, or abort jobs, and optionally stream console output via WebSocket. These files serve as portable job definitions. When DRMDTool detects or receives a .drmd file, it parses the items, decodes or downloads the MPD, applies the keys, and builds a download command using N_m3u8DL-RE. Files are saved in organized directories like Movies/Title or Series/Title/Season, and subtitles are embedded if available. Pausing, resuming, and aborting downloads is supported per file.\nArchitecture Overview The configuration is handled via config.toml, with environment variable overrides for containerized or dynamic deployments. Once started, the tool can either monitor a specified folder or allow file uploads through the UI. Each .drmd file is parsed, grouped by series and season (if applicable), and processed sequentially with support for job pausing and resuming.\nWeb UI \u0026amp; CLI To use:\n./drmdtool Visit http://localhost:8080 for the web interface, which supports drag-and-drop uploads, selection of episodes or movies, and real-time progress tracking. For headless operation:\n./drmdtool -f /path/to/file.drmd Jobs can be paused, resumed, or aborted through the web interface, which reflects the backend state via live updates.\nEnhanced Download Logic DRMDTool dynamically builds download commands using metadata from .drmd files and user preferences. It ensures that only the highest quality streams are kept, removing ad periods and duplicate segments from the MPD files. Subtitles are fetched and embedded automatically. Jobs are tracked with robust state management and logs for debugging and visibility.\nRepository Code and setup instructions are hosted here: https://git.directme.in/Joren/DRMDTool\nDRMDtool For advanced usage details, customization, and API structure, refer to the README.md in the repository.\nUI Previews Index Page Select Page Progress Page ","date":"May 21, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-1/","title":"DRMDTool Project"},{"categories":["cybersecurity","event recap"],"contents":"Cyber Defence on the Digital Frontline: A Mission with NATO On a Mission with NATO: Cyber Defence on the Frontline Howest’s ongoing commitment to world-class cybersecurity training took center stage again as six lecturers from the Cyber Security program joined forces with experts from Latvia, Luxembourg and Belgium in one of NATO\u0026rsquo;s most intensive simulations: the Locked Shields exercise, hosted by the Cooperative Cyber Defence Centre of Excellence (CCDCOE). Now in its fifth year of participation, the Howest team shared their firsthand experiences at a special evening talk at Howest Bruges.\nThe Exercise: Locked Shields Locked Shields is no ordinary simulation. It is a full-scale, live-fire cyber defence exercise involving more than 6,000 machines and a narrative scenario so detailed it includes geopolitics, disinformation and even fictional countries. This year, the Blue Team 03 (our team) defended a simulated nation’s critical infrastructure including power plants, satellites, 5G networks and banking systems, all while under constant attack from a coordinated Red Team using automated scripts and over 28,000 attacks across two days.\nAnd yes, every team (Red, Blue, Yellow, White) uses Ansible. For everything.\nHigh Stakes, Real Lessons What do you do when a rogue process might be malware, or maybe just a poorly named service? What happens when your teammate refuses to act unless something is “officially malicious”? The team faced cultural clashes, communication breakdowns and stress-testing of both systems and people.\nThe exercise required more than technical fixes. It demanded communication with simulated commanders, media and public stakeholders. Reporting became just as important as patching. It taught participants how to translate technical impact into real-world consequences. Not \u0026ldquo;port 8443 unreachable\u0026rdquo;, but \u0026ldquo;our air defence system is degraded, and we cannot fly planes\u0026rdquo;.\nThe Black Team: Rapid Response in Action A new but powerful presence in the simulation was the Black Team, a rapid-response unit deployed when problems became too complex for any single team. Acting like special forces, they jumped in when incidents crossed team boundaries or demanded unconventional solutions. Their mission was to find out what was happening, assess the impact and suggest fast, creative responses. Introduced just last year, this team quickly proved its value again in 2025. They even embraced the role with style — “you can wear sunglasses inside” became their unofficial motto.\nTheir presence underlined a critical lesson: not every problem fits neatly within a team’s silo. Real-world defence requires flexibility, speed and lateral thinking.\nHighlights and Blooper Reel There were plenty of mishaps. Misfired scripts, team mix-ups, and one case where a DNS setup from a previous year was reused by mistake. Someone tried renaming cut to shutdown, breaking essential operations until it was fixed. Systems rebooted into chaos, a manual was uploaded to public GitHub, and the team had to quickly learn the difference between symbolic links and real binaries.\nHuman Factors and Growth From detecting malware with Velociraptor and Q9, to encountering teammates who took orders literally, the learning was intense. One participant noted that while Belgian and Luxembourg teams prioritized knowledge sharing, others preferred strict protocol. This highlighted cultural differences and the importance of interpersonal skills.\nThe biggest lesson? You are never fully prepared. Every iteration of Locked Shields is different. But each one sharpens not only your skills, but also your ability to function as a team under extreme conditions.\nFrom the Battlefield to the Classroom This experience directly impacts the classroom. Inspired by the exercise, Howest is introducing new hands-on courses like “Glutamine” in semester five. Students will be dropped into realistic broken networks, with misconfigurations, fake firewalls and simulated threats. It is chaos, but controlled. And that is the point.\nAs one speaker said: “You don’t win Locked Shields. You just survive it better than the rest.”\nFinal Thoughts The exercise teaches more than just cybersecurity. It builds trust. It proves that knowing your teammates can be as important as knowing the tools. Whether that comes from a shared flight or a pre-exercise barbecue, it all matters when the pressure hits.\nWant to see how cyber defence works in real life? This is it.\n","date":"May 13, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog-2_hu_6ceec691ca0ef84f.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"500\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog-2_hu_15ef236ad8ece8ed.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-1/","title":"Cyber Defence on the Digital Frontline: A Mission with NATO"},{"categories":["cybersecurity","CTF","education"],"contents":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience On March 14 and 15, I joined the Cyber Security Challenge Belgium qualifiers with three teammates. For two days, we threw ourselves at CTF challenges covering binary exploitation, Android reversing, cryptography, and more.\nWhat follows is a short recap of the challenges I worked on—some I solved, some I didn’t—but all of them were worth the hours spent.\nA Buffer Overflow to Warm Up One of the first challenges I picked involved a binary with a basic stack overflow. I used standard techniques—finding the offset, hijacking the return address, and injecting shellcode. Tools like pwntools helped automate the payload crafting. It was a good warm-up, and it reminded me how subtle some bugs can be when you\u0026rsquo;re rushed.\nCryptography and Pattern Matching There was a crypto puzzle where I had to find a seed that reproduced a specific ASCII art banner. Once I understood how the banner was generated, I brute-forced possible seeds until one matched. It was a quick but fun exercise in spotting structure and automating search.\nAndroid Reversing: FRIDA and JADX Several APKs were part of the qualifier set. I used JADX to decompile them and FRIDA to patch logic at runtime. In one challenge, I had to bypass some form of license validation. By hooking into the relevant method and forcing it to always return true, I could reveal hidden sections of the app.\nBut one Android challenge stood out more than any other.\nThe Challenge That Stuck with Me: Rebuilding a Split DEX This one was different.\nThe app presented a 4×8 button grid. Each button, when pressed, recorded an index. After pressing several buttons and hitting \u0026ldquo;GO,\u0026rdquo; the app would try to assemble something in memory and load it as a class.\nLooking deeper, I found this in the decompiled code:\nInputStream open = assets.open(String.format(\u0026#34;block%02d\u0026#34;, it.next())); ... Class loadClass = new InMemoryDexClassLoader(ByteBuffer.wrap(byteArrayOutputStream.toByteArray()), getClassLoader()) .loadClass(\u0026#34;be.dauntless.flag.Flag\u0026#34;); Each index corresponded to an asset file named blockXX, and the app was stitching these binary chunks into a single byte stream. It then tried to load the result as a DEX file containing a Flag class.\nThe hard part? There were 31 blocks and no obvious way to know the correct order. The buttons reset after each attempt, making brute-force infeasible. My job was to reverse-engineer the right sequence.\nI tried analyzing the individual blocks to extract string constants, method fragments, and bytecode patterns. I wrote a script to group fragments and infer relative positions, like solving a jigsaw puzzle blindfolded. I made progress, but I never completed it. That puzzle stuck with me because it combined static analysis, runtime loading, and logical reconstruction in a way that no other challenge did.\nThe One That Got Away: TLS Fingerprinting I also spent time on a Go-based TLS server that rejected all my attempts to connect unless my client fingerprint was exactly right. I tried adjusting everything in the tls.Config—cipher suite order, ALPN, even protocol version:\ntls.Config{ MinVersion: tls.VersionTLS13, CipherSuites: []uint16{ tls.TLS_AES_128_GCM_SHA256, // ... }, NextProtos: []string{\u0026#34;h2\u0026#34;}, } But nothing worked. I suspect the server checked deep JA4-style fingerprinting, and I just couldn’t replicate the original client behavior. It was frustrating—but also a good reminder of how messy and detailed real-world protocol handling can be.\nFinal Thoughts I didn’t solve everything. Far from it. But that’s not really the point. Each challenge taught me something—whether it was about Android’s InMemoryDexClassLoader, raw memory reconstruction, or TLS quirks. Working as a team with Evarist, Nathan, and Waut also made it fun, even when we were all stuck.\nIf you\u0026rsquo;re even a little curious about cybersecurity, I can’t recommend this kind of event enough. It’s hands-on, intense, and full of problems that make you think in ways formal education often doesn\u0026rsquo;t.\n","date":"March 15, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog-2_hu_6ceec691ca0ef84f.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"500\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog-2_hu_15ef236ad8ece8ed.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-2/","title":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience"},{"categories":null,"contents":"I built my personal blog using Hugo and deployed it on a lightweight Alpine Linux VPS. I chose this setup to have full control, keep things simple, and avoid bloated platforms or services. Here’s how the process went from site generation to live deployment.\nCreating the Hugo Site On my development machine, I created a new Hugo site:\nhugo new site howest-blog I used the professors-hugo theme and copied its exampleSite content into my project. I customized the layout, structure, and styling by editing content files, SCSS in assets/scss/custom.scss, and partial templates in the theme directory.\nAll content lives under content/, with separate folders for blog/ and project/, each containing .md files with front matter and Markdown content.\nCustomization I edited the config/_default/hugo.toml to configure site parameters like the base URL, theme, language, and menus. SCSS and image assets go in assets/, and are processed by Hugo\u0026rsquo;s pipeline. Static files like favicons are placed in static/.\nTo preview the site locally:\nhugo server To build the static site:\nhugo This generates everything in the public/ folder.\nVPS Deployment I rented a minimal Alpine Linux VPS and installed only what I needed. After setting up SSH and a basic nginx web server, I copied the public/ folder over using scp:\nscp -r public/* user@my-vps:/var/www/html On the VPS, I installed nginx:\napk add nginx And configured /etc/nginx/conf.d/default.conf to serve files from /var/www/html. Then I enabled and started nginx:\nrc-service nginx start rc-update add nginx Now my Hugo site is live and served directly as static files—no backend, no database, just HTML, CSS, and JS.\nWhy Alpine + Hugo? Alpine Linux is minimal and fast, perfect for serving static sites with low resource usage. Combined with Hugo’s speed and flexibility, I get a complete, performant setup that I fully control. It’s secure, lightweight, and easy to update—just rebuild and re-upload the public/ folder.\nThis setup is perfect if you want full control and minimal overhead for a personal blog or portfolio.\n","date":"May 29, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-2/","title":"Building My Hugo Website on a VPS"},{"categories":null,"contents":"DRMDTool is an automation-centric utility designed to streamline the processing of .drmd files by tightly integrating with the N_m3u8DL-RE downloader. The tool offers robust automation via a watch folder and an intuitive web-based interface, significantly reducing the friction for managing and processing DRM-protected streaming content.\nWhat’s New DRMDTool has evolved into a comprehensive platform for batch downloading with enhanced support for user interaction and background processing. It features granular job tracking, dynamic download control (pause, resume, abort), and a refined WebSocket-based console for real-time command output. Subtitle handling now includes automatic downloading and conversion from VTT to SRT, and the downloader adapts based on metadata, organizing content into categorized directories.\nGoals and Use Case The primary aim is to automate .drmd file processing with minimal manual input. Users can configure download formats, specify directories, and enable real-time command broadcasting. DRMDTool is suitable for both interactive use through a web UI and headless automation in pipelines, supporting inotify or polling-based folder watching.\nHow .drmd Files Work A .drmd file is a structured JSON document that defines one or more encrypted media items to be processed by DRMDTool. It contains an Items array, with each item representing a specific media job. DRMDTool parses these entries to generate download commands for N_m3u8DL-RE.\nEach item includes:\nMPD: A DASH manifest, either a direct URL or a base64-encoded version. If base64-encoded, DRMDTool decodes and temporarily saves it before use. Keys: A comma-separated list of KID:key pairs (e.g., abcd1234ef567890:00112233445566778899aabbccddeeff). These are required for decrypting encrypted media streams and are passed directly to N_m3u8DL-RE using --key flags. Filename: The name to be used for the final output file. Subtitles: Comma-separated list of subtitle URLs in .vtt format. DRMDTool downloads and converts these to .srt, then muxes them into the final file. Metadata: A semicolon-separated string like Title;Type;Season (e.g., Example Show;serie;1) used to determine directory structure (Movies/Title or Series/Title/Season). Description and Poster: Optional fields used only for display in the web UI. Example .drmd Structure { \u0026#34;Items\u0026#34;: [ { \u0026#34;MPD\u0026#34;: \u0026#34;aHR0cHM6Ly9leGFtcGxlLmNvbS9zdHJlYW0ubXBk\u0026#34;, \u0026#34;Keys\u0026#34;: \u0026#34;abcd1234ef567890:00112233445566778899aabbccddeeff\u0026#34;, \u0026#34;Filename\u0026#34;: \u0026#34;ExampleShow.S01E01\u0026#34;, \u0026#34;Subtitles\u0026#34;: \u0026#34;https://example.com/sub1.vtt,https://example.com/sub2.vtt\u0026#34;, \u0026#34;Metadata\u0026#34;: \u0026#34;Example Show;serie;1\u0026#34;, \u0026#34;Description\u0026#34;: \u0026#34;Pilot episode\u0026#34;, \u0026#34;Poster\u0026#34;: \u0026#34;\u0026#34; } ] } Processing Steps Detection: DRMDTool either watches a folder or receives .drmd uploads through the web UI. Validation: It waits for the file to finish writing (based on file size stability), then parses its contents. MPD Handling: If base64-encoded, the MPD is decoded and written to a temp file; otherwise, the URL is fetched or passed as-is. Command Generation: Using the MPD, KID:key pairs, output paths, and subtitles, DRMDTool builds a command line for N_m3u8DL-RE. Execution: The download is launched with live progress tracking. Users can pause, resume, or abort jobs, and optionally stream console output via WebSocket. These files serve as portable job definitions. When DRMDTool detects or receives a .drmd file, it parses the items, decodes or downloads the MPD, applies the keys, and builds a download command using N_m3u8DL-RE. Files are saved in organized directories like Movies/Title or Series/Title/Season, and subtitles are embedded if available. Pausing, resuming, and aborting downloads is supported per file.\nArchitecture Overview The configuration is handled via config.toml, with environment variable overrides for containerized or dynamic deployments. Once started, the tool can either monitor a specified folder or allow file uploads through the UI. Each .drmd file is parsed, grouped by series and season (if applicable), and processed sequentially with support for job pausing and resuming.\nWeb UI \u0026amp; CLI To use:\n./drmdtool Visit http://localhost:8080 for the web interface, which supports drag-and-drop uploads, selection of episodes or movies, and real-time progress tracking. For headless operation:\n./drmdtool -f /path/to/file.drmd Jobs can be paused, resumed, or aborted through the web interface, which reflects the backend state via live updates.\nEnhanced Download Logic DRMDTool dynamically builds download commands using metadata from .drmd files and user preferences. It ensures that only the highest quality streams are kept, removing ad periods and duplicate segments from the MPD files. Subtitles are fetched and embedded automatically. Jobs are tracked with robust state management and logs for debugging and visibility.\nRepository Code and setup instructions are hosted here: https://git.directme.in/Joren/DRMDTool\nDRMDtool For advanced usage details, customization, and API structure, refer to the README.md in the repository.\nUI Previews Index Page Select Page Progress Page ","date":"May 21, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-1/","title":"DRMDTool Project"},{"categories":["cybersecurity","event recap"],"contents":"Cyber Defence on the Digital Frontline: A Mission with NATO On a Mission with NATO: Cyber Defence on the Frontline Howest’s ongoing commitment to world-class cybersecurity training took center stage again as six lecturers from the Cyber Security program joined forces with experts from Latvia, Luxembourg and Belgium in one of NATO\u0026rsquo;s most intensive simulations: the Locked Shields exercise, hosted by the Cooperative Cyber Defence Centre of Excellence (CCDCOE). Now in its fifth year of participation, the Howest team shared their firsthand experiences at a special evening talk at Howest Bruges.\nThe Exercise: Locked Shields Locked Shields is no ordinary simulation. It is a full-scale, live-fire cyber defence exercise involving more than 6,000 machines and a narrative scenario so detailed it includes geopolitics, disinformation and even fictional countries. This year, the Blue Team 03 (our team) defended a simulated nation’s critical infrastructure including power plants, satellites, 5G networks and banking systems, all while under constant attack from a coordinated Red Team using automated scripts and over 28,000 attacks across two days.\nAnd yes, every team (Red, Blue, Yellow, White) uses Ansible. For everything.\nHigh Stakes, Real Lessons What do you do when a rogue process might be malware, or maybe just a poorly named service? What happens when your teammate refuses to act unless something is “officially malicious”? The team faced cultural clashes, communication breakdowns and stress-testing of both systems and people.\nThe exercise required more than technical fixes. It demanded communication with simulated commanders, media and public stakeholders. Reporting became just as important as patching. It taught participants how to translate technical impact into real-world consequences. Not \u0026ldquo;port 8443 unreachable\u0026rdquo;, but \u0026ldquo;our air defence system is degraded, and we cannot fly planes\u0026rdquo;.\nThe Black Team: Rapid Response in Action A new but powerful presence in the simulation was the Black Team, a rapid-response unit deployed when problems became too complex for any single team. Acting like special forces, they jumped in when incidents crossed team boundaries or demanded unconventional solutions. Their mission was to find out what was happening, assess the impact and suggest fast, creative responses. Introduced just last year, this team quickly proved its value again in 2025. They even embraced the role with style — “you can wear sunglasses inside” became their unofficial motto.\nTheir presence underlined a critical lesson: not every problem fits neatly within a team’s silo. Real-world defence requires flexibility, speed and lateral thinking.\nHighlights and Blooper Reel There were plenty of mishaps. Misfired scripts, team mix-ups, and one case where a DNS setup from a previous year was reused by mistake. Someone tried renaming cut to shutdown, breaking essential operations until it was fixed. Systems rebooted into chaos, a manual was uploaded to public GitHub, and the team had to quickly learn the difference between symbolic links and real binaries.\nHuman Factors and Growth From detecting malware with Velociraptor and Q9, to encountering teammates who took orders literally, the learning was intense. One participant noted that while Belgian and Luxembourg teams prioritized knowledge sharing, others preferred strict protocol. This highlighted cultural differences and the importance of interpersonal skills.\nThe biggest lesson? You are never fully prepared. Every iteration of Locked Shields is different. But each one sharpens not only your skills, but also your ability to function as a team under extreme conditions.\nFrom the Battlefield to the Classroom This experience directly impacts the classroom. Inspired by the exercise, Howest is introducing new hands-on courses like “Glutamine” in semester five. Students will be dropped into realistic broken networks, with misconfigurations, fake firewalls and simulated threats. It is chaos, but controlled. And that is the point.\nAs one speaker said: “You don’t win Locked Shields. You just survive it better than the rest.”\nFinal Thoughts The exercise teaches more than just cybersecurity. It builds trust. It proves that knowing your teammates can be as important as knowing the tools. Whether that comes from a shared flight or a pre-exercise barbecue, it all matters when the pressure hits.\nWant to see how cyber defence works in real life? This is it.\n","date":"May 13, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog-1_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog-1_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-1/","title":"Cyber Defence on the Digital Frontline: A Mission with NATO"},{"categories":["cybersecurity","CTF","education"],"contents":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience On March 14 and 15, I joined the Cyber Security Challenge Belgium qualifiers with three teammates. For two days, we threw ourselves at CTF challenges covering binary exploitation, Android reversing, cryptography, and more.\nWhat follows is a short recap of the challenges I worked on—some I solved, some I didn’t—but all of them were worth the hours spent.\nA Buffer Overflow to Warm Up One of the first challenges I picked involved a binary with a basic stack overflow. I used standard techniques—finding the offset, hijacking the return address, and injecting shellcode. Tools like pwntools helped automate the payload crafting. It was a good warm-up, and it reminded me how subtle some bugs can be when you\u0026rsquo;re rushed.\nCryptography and Pattern Matching There was a crypto puzzle where I had to find a seed that reproduced a specific ASCII art banner. Once I understood how the banner was generated, I brute-forced possible seeds until one matched. It was a quick but fun exercise in spotting structure and automating search.\nAndroid Reversing: FRIDA and JADX Several APKs were part of the qualifier set. I used JADX to decompile them and FRIDA to patch logic at runtime. In one challenge, I had to bypass some form of license validation. By hooking into the relevant method and forcing it to always return true, I could reveal hidden sections of the app.\nBut one Android challenge stood out more than any other.\nThe Challenge That Stuck with Me: Rebuilding a Split DEX This one was different.\nThe app presented a 4×8 button grid. Each button, when pressed, recorded an index. After pressing several buttons and hitting \u0026ldquo;GO,\u0026rdquo; the app would try to assemble something in memory and load it as a class.\nLooking deeper, I found this in the decompiled code:\nInputStream open = assets.open(String.format(\u0026#34;block%02d\u0026#34;, it.next())); ... Class loadClass = new InMemoryDexClassLoader(ByteBuffer.wrap(byteArrayOutputStream.toByteArray()), getClassLoader()) .loadClass(\u0026#34;be.dauntless.flag.Flag\u0026#34;); Each index corresponded to an asset file named blockXX, and the app was stitching these binary chunks into a single byte stream. It then tried to load the result as a DEX file containing a Flag class.\nThe hard part? There were 31 blocks and no obvious way to know the correct order. The buttons reset after each attempt, making brute-force infeasible. My job was to reverse-engineer the right sequence.\nI tried analyzing the individual blocks to extract string constants, method fragments, and bytecode patterns. I wrote a script to group fragments and infer relative positions, like solving a jigsaw puzzle blindfolded. I made progress, but I never completed it. That puzzle stuck with me because it combined static analysis, runtime loading, and logical reconstruction in a way that no other challenge did.\nThe One That Got Away: TLS Fingerprinting I also spent time on a Go-based TLS server that rejected all my attempts to connect unless my client fingerprint was exactly right. I tried adjusting everything in the tls.Config—cipher suite order, ALPN, even protocol version:\ntls.Config{ MinVersion: tls.VersionTLS13, CipherSuites: []uint16{ tls.TLS_AES_128_GCM_SHA256, // ... }, NextProtos: []string{\u0026#34;h2\u0026#34;}, } But nothing worked. I suspect the server checked deep JA4-style fingerprinting, and I just couldn’t replicate the original client behavior. It was frustrating—but also a good reminder of how messy and detailed real-world protocol handling can be.\nFinal Thoughts I didn’t solve everything. Far from it. But that’s not really the point. Each challenge taught me something—whether it was about Android’s InMemoryDexClassLoader, raw memory reconstruction, or TLS quirks. Working as a team with Evarist, Nathan, and Waut also made it fun, even when we were all stuck.\nIf you\u0026rsquo;re even a little curious about cybersecurity, I can’t recommend this kind of event enough. It’s hands-on, intense, and full of problems that make you think in ways formal education often doesn\u0026rsquo;t.\n","date":"March 15, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog-2_hu_6ceec691ca0ef84f.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"500\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog-2_hu_15ef236ad8ece8ed.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-2/","title":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience"},{"categories":null,"contents":"I built my personal blog using Hugo and deployed it on a lightweight Alpine Linux VPS. I chose this setup to have full control, keep things simple, and avoid bloated platforms or services. Here’s how the process went from site generation to live deployment.\nCreating the Hugo Site On my development machine, I created a new Hugo site:\nhugo new site howest-blog I used the professors-hugo theme and copied its exampleSite content into my project. I customized the layout, structure, and styling by editing content files, SCSS in assets/scss/custom.scss, and partial templates in the theme directory.\nAll content lives under content/, with separate folders for blog/ and project/, each containing .md files with front matter and Markdown content.\nCustomization I edited the config/_default/hugo.toml to configure site parameters like the base URL, theme, language, and menus. SCSS and image assets go in assets/, and are processed by Hugo\u0026rsquo;s pipeline. Static files like favicons are placed in static/.\nTo preview the site locally:\nhugo server To build the static site:\nhugo This generates everything in the public/ folder.\nVPS Deployment I rented a minimal Alpine Linux VPS and installed only what I needed. After setting up SSH and a basic nginx web server, I copied the public/ folder over using scp:\nscp -r public/* user@my-vps:/var/www/html On the VPS, I installed nginx:\napk add nginx And configured /etc/nginx/conf.d/default.conf to serve files from /var/www/html. Then I enabled and started nginx:\nrc-service nginx start rc-update add nginx Now my Hugo site is live and served directly as static files—no backend, no database, just HTML, CSS, and JS.\nWhy Alpine + Hugo? Alpine Linux is minimal and fast, perfect for serving static sites with low resource usage. Combined with Hugo’s speed and flexibility, I get a complete, performant setup that I fully control. It’s secure, lightweight, and easy to update—just rebuild and re-upload the public/ folder.\nThis setup is perfect if you want full control and minimal overhead for a personal blog or portfolio.\n","date":"May 29, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-2/","title":"Building My Hugo Website on a VPS"},{"categories":null,"contents":"DRMDTool is an automation-centric utility designed to streamline the processing of .drmd files by tightly integrating with the N_m3u8DL-RE downloader. The tool offers robust automation via a watch folder and an intuitive web-based interface, significantly reducing the friction for managing and processing DRM-protected streaming content.\nWhat’s New DRMDTool has evolved into a comprehensive platform for batch downloading with enhanced support for user interaction and background processing. It features granular job tracking, dynamic download control (pause, resume, abort), and a refined WebSocket-based console for real-time command output. Subtitle handling now includes automatic downloading and conversion from VTT to SRT, and the downloader adapts based on metadata, organizing content into categorized directories.\nGoals and Use Case The primary aim is to automate .drmd file processing with minimal manual input. Users can configure download formats, specify directories, and enable real-time command broadcasting. DRMDTool is suitable for both interactive use through a web UI and headless automation in pipelines, supporting inotify or polling-based folder watching.\nHow .drmd Files Work A .drmd file is a structured JSON document that defines one or more encrypted media items to be processed by DRMDTool. It contains an Items array, with each item representing a specific media job. DRMDTool parses these entries to generate download commands for N_m3u8DL-RE.\nEach item includes:\nMPD: A DASH manifest, either a direct URL or a base64-encoded version. If base64-encoded, DRMDTool decodes and temporarily saves it before use. Keys: A comma-separated list of KID:key pairs (e.g., abcd1234ef567890:00112233445566778899aabbccddeeff). These are required for decrypting encrypted media streams and are passed directly to N_m3u8DL-RE using --key flags. Filename: The name to be used for the final output file. Subtitles: Comma-separated list of subtitle URLs in .vtt format. DRMDTool downloads and converts these to .srt, then muxes them into the final file. Metadata: A semicolon-separated string like Title;Type;Season (e.g., Example Show;serie;1) used to determine directory structure (Movies/Title or Series/Title/Season). Description and Poster: Optional fields used only for display in the web UI. Example .drmd Structure { \u0026#34;Items\u0026#34;: [ { \u0026#34;MPD\u0026#34;: \u0026#34;aHR0cHM6Ly9leGFtcGxlLmNvbS9zdHJlYW0ubXBk\u0026#34;, \u0026#34;Keys\u0026#34;: \u0026#34;abcd1234ef567890:00112233445566778899aabbccddeeff\u0026#34;, \u0026#34;Filename\u0026#34;: \u0026#34;ExampleShow.S01E01\u0026#34;, \u0026#34;Subtitles\u0026#34;: \u0026#34;https://example.com/sub1.vtt,https://example.com/sub2.vtt\u0026#34;, \u0026#34;Metadata\u0026#34;: \u0026#34;Example Show;serie;1\u0026#34;, \u0026#34;Description\u0026#34;: \u0026#34;Pilot episode\u0026#34;, \u0026#34;Poster\u0026#34;: \u0026#34;\u0026#34; } ] } Processing Steps Detection: DRMDTool either watches a folder or receives .drmd uploads through the web UI. Validation: It waits for the file to finish writing (based on file size stability), then parses its contents. MPD Handling: If base64-encoded, the MPD is decoded and written to a temp file; otherwise, the URL is fetched or passed as-is. Command Generation: Using the MPD, KID:key pairs, output paths, and subtitles, DRMDTool builds a command line for N_m3u8DL-RE. Execution: The download is launched with live progress tracking. Users can pause, resume, or abort jobs, and optionally stream console output via WebSocket. These files serve as portable job definitions. When DRMDTool detects or receives a .drmd file, it parses the items, decodes or downloads the MPD, applies the keys, and builds a download command using N_m3u8DL-RE. Files are saved in organized directories like Movies/Title or Series/Title/Season, and subtitles are embedded if available. Pausing, resuming, and aborting downloads is supported per file.\nArchitecture Overview The configuration is handled via config.toml, with environment variable overrides for containerized or dynamic deployments. Once started, the tool can either monitor a specified folder or allow file uploads through the UI. Each .drmd file is parsed, grouped by series and season (if applicable), and processed sequentially with support for job pausing and resuming.\nWeb UI \u0026amp; CLI To use:\n./drmdtool Visit http://localhost:8080 for the web interface, which supports drag-and-drop uploads, selection of episodes or movies, and real-time progress tracking. For headless operation:\n./drmdtool -f /path/to/file.drmd Jobs can be paused, resumed, or aborted through the web interface, which reflects the backend state via live updates.\nEnhanced Download Logic DRMDTool dynamically builds download commands using metadata from .drmd files and user preferences. It ensures that only the highest quality streams are kept, removing ad periods and duplicate segments from the MPD files. Subtitles are fetched and embedded automatically. Jobs are tracked with robust state management and logs for debugging and visibility.\nRepository Code and setup instructions are hosted here: https://git.directme.in/Joren/DRMDTool\nDRMDtool For advanced usage details, customization, and API structure, refer to the README.md in the repository.\nUI Previews Index Page Select Page Progress Page ","date":"May 21, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-1/","title":"DRMDTool Project"},{"categories":["cybersecurity","event recap"],"contents":"Cyber Defence on the Digital Frontline: A Mission with NATO On a Mission with NATO: Cyber Defence on the Frontline Howest’s ongoing commitment to world-class cybersecurity training took center stage again as six lecturers from the Cyber Security program joined forces with experts from Latvia, Luxembourg and Belgium in one of NATO\u0026rsquo;s most intensive simulations: the Locked Shields exercise, hosted by the Cooperative Cyber Defence Centre of Excellence (CCDCOE). Now in its fifth year of participation, the Howest team shared their firsthand experiences at a special evening talk at Howest Bruges.\nThe Exercise: Locked Shields Locked Shields is no ordinary simulation. It is a full-scale, live-fire cyber defence exercise involving more than 6,000 machines and a narrative scenario so detailed it includes geopolitics, disinformation and even fictional countries. This year, the Blue Team 03 (our team) defended a simulated nation’s critical infrastructure including power plants, satellites, 5G networks and banking systems, all while under constant attack from a coordinated Red Team using automated scripts and over 28,000 attacks across two days.\nAnd yes, every team (Red, Blue, Yellow, White) uses Ansible. For everything.\nHigh Stakes, Real Lessons What do you do when a rogue process might be malware, or maybe just a poorly named service? What happens when your teammate refuses to act unless something is “officially malicious”? The team faced cultural clashes, communication breakdowns and stress-testing of both systems and people.\nThe exercise required more than technical fixes. It demanded communication with simulated commanders, media and public stakeholders. Reporting became just as important as patching. It taught participants how to translate technical impact into real-world consequences. Not \u0026ldquo;port 8443 unreachable\u0026rdquo;, but \u0026ldquo;our air defence system is degraded, and we cannot fly planes\u0026rdquo;.\nThe Black Team: Rapid Response in Action A new but powerful presence in the simulation was the Black Team, a rapid-response unit deployed when problems became too complex for any single team. Acting like special forces, they jumped in when incidents crossed team boundaries or demanded unconventional solutions. Their mission was to find out what was happening, assess the impact and suggest fast, creative responses. Introduced just last year, this team quickly proved its value again in 2025. They even embraced the role with style — “you can wear sunglasses inside” became their unofficial motto.\nTheir presence underlined a critical lesson: not every problem fits neatly within a team’s silo. Real-world defence requires flexibility, speed and lateral thinking.\nHighlights and Blooper Reel There were plenty of mishaps. Misfired scripts, team mix-ups, and one case where a DNS setup from a previous year was reused by mistake. Someone tried renaming cut to shutdown, breaking essential operations until it was fixed. Systems rebooted into chaos, a manual was uploaded to public GitHub, and the team had to quickly learn the difference between symbolic links and real binaries.\nHuman Factors and Growth From detecting malware with Velociraptor and Q9, to encountering teammates who took orders literally, the learning was intense. One participant noted that while Belgian and Luxembourg teams prioritized knowledge sharing, others preferred strict protocol. This highlighted cultural differences and the importance of interpersonal skills.\nThe biggest lesson? You are never fully prepared. Every iteration of Locked Shields is different. But each one sharpens not only your skills, but also your ability to function as a team under extreme conditions.\nFrom the Battlefield to the Classroom This experience directly impacts the classroom. Inspired by the exercise, Howest is introducing new hands-on courses like “Glutamine” in semester five. Students will be dropped into realistic broken networks, with misconfigurations, fake firewalls and simulated threats. It is chaos, but controlled. And that is the point.\nAs one speaker said: “You don’t win Locked Shields. You just survive it better than the rest.”\nFinal Thoughts The exercise teaches more than just cybersecurity. It builds trust. It proves that knowing your teammates can be as important as knowing the tools. Whether that comes from a shared flight or a pre-exercise barbecue, it all matters when the pressure hits.\nWant to see how cyber defence works in real life? This is it.\n","date":"May 13, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog-1_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog-1_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-1/","title":"Cyber Defence on the Digital Frontline: A Mission with NATO"},{"categories":["cybersecurity","CTF","education"],"contents":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience On March 14 and 15, I joined the Cyber Security Challenge Belgium qualifiers with three teammates. For two days, we threw ourselves at CTF challenges covering binary exploitation, Android reversing, cryptography, and more.\nWhat follows is a recap of the challenges I personally worked on—some I solved, some I didn’t—but all of them left me with new skills and new ideas.\nA Buffer Overflow to Warm Up One of the first challenges I picked involved a binary with a basic stack overflow. I used standard techniques—finding the offset, hijacking the return address, and injecting shellcode. Tools like pwntools helped automate the payload crafting. It was a great warm-up and a confidence boost once it worked.\nCryptography and Pattern Matching Another crypto puzzle asked us to match a generated ASCII art banner to its underlying seed. Once I understood how the randomness was embedded into the banner, I brute-forced the space with a simple pattern-matching script. The exercise was clean, deterministic, and satisfying to solve.\nOurEncIsSec: Zip Bombs and OEIS Then there was a more elaborate cryptography challenge: 18 zip files, each password-protected. We cracked the first three passwords using John the Ripper and got numeric values from them. I searched the sequence in OEIS and found it matched A007408, which gave us the full pattern of passwords.\nUsing this, I could extract all zip contents automatically, reconstruct the password-protected message, and finally reveal the flag.\nInfinite Luck: One in a Million? One challenge involved “guessing” a thousand random numbers between 1 and 10. The banner claimed it required infinite luck—but of course, the randomness was seeded. After inspecting the generator, I realized it was deterministic. By precomputing seeds and output sequences, I could match the challenge’s banner to a specific seed and regenerate the entire solution.\nAndroid Reversing: FRIDA and JADX Several APKs were part of the qualifier set. I used JADX to decompile them and FRIDA to patch logic at runtime. In one challenge, I bypassed license validation by forcing key methods to return true and unlocking hidden functionality.\nThe Challenge That Stuck with Me: Rebuilding a Split DEX This one stood out.\nThe app used a 4×8 button grid. Pressing buttons loaded a sequence of blockXX files from assets. These were concatenated in-memory and passed into InMemoryDexClassLoader to load a class called be.dauntless.flag.Flag.\nClass loadClass = new InMemoryDexClassLoader(ByteBuffer.wrap(byteArrayOutputStream.toByteArray()), getClassLoader()) .loadClass(\u0026#34;be.dauntless.flag.Flag\u0026#34;); Each block was a fragment of a DEX file, but the app didn’t tell you the right order. I tried manually inspecting the fragments—identifying methods, string constants, and offsets—to infer how to reassemble the full file. I got close, but didn’t crack it in time.\nThat challenge stuck with me because it combined static analysis, runtime introspection, and logic reconstruction. It wasn’t just technical—it was creative.\nThe One That Got Away: TLS Fingerprinting Another challenge involved a Go-based TLS server that rejected all client connections unless they matched a specific fingerprint. I used Go’s tls.Config to replicate the version, cipher suites, and ALPN:\ntls.Config{ MinVersion: tls.VersionTLS13, CipherSuites: []uint16{ tls.TLS_AES_128_GCM_SHA256, // ... }, NextProtos: []string{\u0026#34;h2\u0026#34;}, } Despite that, the server still refused the connection. I suspect it was using JA4 or similar TLS fingerprinting techniques we couldn’t fully emulate. We had to move on—but I’d love to revisit that one someday.\nFinal Thoughts I didn’t solve everything. But that wasn’t the point. Every challenge was a practical puzzle—something to decode, reverse, bypass, or just understand a little better.\nWorking as a team with Evarist, Nathan, and Waut made it even more valuable. We bounced ideas off each other, divided tasks, and got a much broader set of challenges covered.\nThe Cyber Security Challenge Belgium qualifiers weren’t easy. But they were the best kind of difficult—the kind that teaches you something whether you solve the problem or not.\n","date":"March 15, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog1/binexpl_hu_3d36b409c72f3586.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"160\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog1\\/binexpl_hu_afca672637b6b98d.png';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-2/","title":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience"},{"categories":null,"contents":"I built my personal blog using Hugo and deployed it on a lightweight Alpine Linux VPS. I chose this setup to have full control, keep things simple, and avoid bloated platforms or services. Here’s how the process went from site generation to live deployment.\nCreating the Hugo Site On my development machine, I created a new Hugo site:\nhugo new site howest-blog I used the professors-hugo theme and copied its exampleSite content into my project. I customized the layout, structure, and styling by editing content files, SCSS in assets/scss/custom.scss, and partial templates in the theme directory.\nAll content lives under content/, with separate folders for blog/ and project/, each containing .md files with front matter and Markdown content.\nCustomization I edited the config/_default/hugo.toml to configure site parameters like the base URL, theme, language, and menus. SCSS and image assets go in assets/, and are processed by Hugo\u0026rsquo;s pipeline. Static files like favicons are placed in static/.\nTo preview the site locally:\nhugo server To build the static site:\nhugo This generates everything in the public/ folder.\nVPS Deployment I rented a minimal Alpine Linux VPS and installed only what I needed. After setting up SSH and a basic nginx web server, I copied the public/ folder over using scp:\nscp -r public/* user@my-vps:/var/www/html On the VPS, I installed nginx:\napk add nginx And configured /etc/nginx/conf.d/default.conf to serve files from /var/www/html. Then I enabled and started nginx:\nrc-service nginx start rc-update add nginx Now my Hugo site is live and served directly as static files—no backend, no database, just HTML, CSS, and JS.\nWhy Alpine + Hugo? Alpine Linux is minimal and fast, perfect for serving static sites with low resource usage. Combined with Hugo’s speed and flexibility, I get a complete, performant setup that I fully control. It’s secure, lightweight, and easy to update—just rebuild and re-upload the public/ folder.\nThis setup is perfect if you want full control and minimal overhead for a personal blog or portfolio.\n","date":"May 29, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-2/","title":"Building My Hugo Website on a VPS"},{"categories":null,"contents":"DRMDTool is an automation-centric utility designed to streamline the processing of .drmd files by tightly integrating with the N_m3u8DL-RE downloader. The tool offers robust automation via a watch folder and an intuitive web-based interface, significantly reducing the friction for managing and processing DRM-protected streaming content.\nWhat’s New DRMDTool has evolved into a comprehensive platform for batch downloading with enhanced support for user interaction and background processing. It features granular job tracking, dynamic download control (pause, resume, abort), and a refined WebSocket-based console for real-time command output. Subtitle handling now includes automatic downloading and conversion from VTT to SRT, and the downloader adapts based on metadata, organizing content into categorized directories.\nGoals and Use Case The primary aim is to automate .drmd file processing with minimal manual input. Users can configure download formats, specify directories, and enable real-time command broadcasting. DRMDTool is suitable for both interactive use through a web UI and headless automation in pipelines, supporting inotify or polling-based folder watching.\nHow .drmd Files Work A .drmd file is a structured JSON document that defines one or more encrypted media items to be processed by DRMDTool. It contains an Items array, with each item representing a specific media job. DRMDTool parses these entries to generate download commands for N_m3u8DL-RE.\nEach item includes:\nMPD: A DASH manifest, either a direct URL or a base64-encoded version. If base64-encoded, DRMDTool decodes and temporarily saves it before use. Keys: A comma-separated list of KID:key pairs (e.g., abcd1234ef567890:00112233445566778899aabbccddeeff). These are required for decrypting encrypted media streams and are passed directly to N_m3u8DL-RE using --key flags. Filename: The name to be used for the final output file. Subtitles: Comma-separated list of subtitle URLs in .vtt format. DRMDTool downloads and converts these to .srt, then muxes them into the final file. Metadata: A semicolon-separated string like Title;Type;Season (e.g., Example Show;serie;1) used to determine directory structure (Movies/Title or Series/Title/Season). Description and Poster: Optional fields used only for display in the web UI. Example .drmd Structure { \u0026#34;Items\u0026#34;: [ { \u0026#34;MPD\u0026#34;: \u0026#34;aHR0cHM6Ly9leGFtcGxlLmNvbS9zdHJlYW0ubXBk\u0026#34;, \u0026#34;Keys\u0026#34;: \u0026#34;abcd1234ef567890:00112233445566778899aabbccddeeff\u0026#34;, \u0026#34;Filename\u0026#34;: \u0026#34;ExampleShow.S01E01\u0026#34;, \u0026#34;Subtitles\u0026#34;: \u0026#34;https://example.com/sub1.vtt,https://example.com/sub2.vtt\u0026#34;, \u0026#34;Metadata\u0026#34;: \u0026#34;Example Show;serie;1\u0026#34;, \u0026#34;Description\u0026#34;: \u0026#34;Pilot episode\u0026#34;, \u0026#34;Poster\u0026#34;: \u0026#34;\u0026#34; } ] } Processing Steps Detection: DRMDTool either watches a folder or receives .drmd uploads through the web UI. Validation: It waits for the file to finish writing (based on file size stability), then parses its contents. MPD Handling: If base64-encoded, the MPD is decoded and written to a temp file; otherwise, the URL is fetched or passed as-is. Command Generation: Using the MPD, KID:key pairs, output paths, and subtitles, DRMDTool builds a command line for N_m3u8DL-RE. Execution: The download is launched with live progress tracking. Users can pause, resume, or abort jobs, and optionally stream console output via WebSocket. These files serve as portable job definitions. When DRMDTool detects or receives a .drmd file, it parses the items, decodes or downloads the MPD, applies the keys, and builds a download command using N_m3u8DL-RE. Files are saved in organized directories like Movies/Title or Series/Title/Season, and subtitles are embedded if available. Pausing, resuming, and aborting downloads is supported per file.\nArchitecture Overview The configuration is handled via config.toml, with environment variable overrides for containerized or dynamic deployments. Once started, the tool can either monitor a specified folder or allow file uploads through the UI. Each .drmd file is parsed, grouped by series and season (if applicable), and processed sequentially with support for job pausing and resuming.\nWeb UI \u0026amp; CLI To use:\n./drmdtool Visit http://localhost:8080 for the web interface, which supports drag-and-drop uploads, selection of episodes or movies, and real-time progress tracking. For headless operation:\n./drmdtool -f /path/to/file.drmd Jobs can be paused, resumed, or aborted through the web interface, which reflects the backend state via live updates.\nEnhanced Download Logic DRMDTool dynamically builds download commands using metadata from .drmd files and user preferences. It ensures that only the highest quality streams are kept, removing ad periods and duplicate segments from the MPD files. Subtitles are fetched and embedded automatically. Jobs are tracked with robust state management and logs for debugging and visibility.\nRepository Code and setup instructions are hosted here: https://git.directme.in/Joren/DRMDTool\nDRMDtool For advanced usage details, customization, and API structure, refer to the README.md in the repository.\nUI Previews Index Page Select Page Progress Page ","date":"May 21, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-1/","title":"DRMDTool Project"},{"categories":["cybersecurity","event recap"],"contents":"Cyber Defence on the Digital Frontline: A Mission with NATO On a Mission with NATO: Cyber Defence on the Frontline Howest’s ongoing commitment to world-class cybersecurity training took center stage again as six lecturers from the Cyber Security program joined forces with experts from Latvia, Luxembourg and Belgium in one of NATO\u0026rsquo;s most intensive simulations: the Locked Shields exercise, hosted by the Cooperative Cyber Defence Centre of Excellence (CCDCOE). Now in its fifth year of participation, the Howest team shared their firsthand experiences at a special evening talk at Howest Bruges.\nThe Exercise: Locked Shields Locked Shields is no ordinary simulation. It is a full-scale, live-fire cyber defence exercise involving more than 6,000 machines and a narrative scenario so detailed it includes geopolitics, disinformation and even fictional countries. This year, the Blue Team 03 (our team) defended a simulated nation’s critical infrastructure including power plants, satellites, 5G networks and banking systems, all while under constant attack from a coordinated Red Team using automated scripts and over 28,000 attacks across two days.\nAnd yes, every team (Red, Blue, Yellow, White) uses Ansible. For everything.\nHigh Stakes, Real Lessons What do you do when a rogue process might be malware, or maybe just a poorly named service? What happens when your teammate refuses to act unless something is “officially malicious”? The team faced cultural clashes, communication breakdowns and stress-testing of both systems and people.\nThe exercise required more than technical fixes. It demanded communication with simulated commanders, media and public stakeholders. Reporting became just as important as patching. It taught participants how to translate technical impact into real-world consequences. Not \u0026ldquo;port 8443 unreachable\u0026rdquo;, but \u0026ldquo;our air defence system is degraded, and we cannot fly planes\u0026rdquo;.\nThe Black Team: Rapid Response in Action A new but powerful presence in the simulation was the Black Team, a rapid-response unit deployed when problems became too complex for any single team. Acting like special forces, they jumped in when incidents crossed team boundaries or demanded unconventional solutions. Their mission was to find out what was happening, assess the impact and suggest fast, creative responses. Introduced just last year, this team quickly proved its value again in 2025. They even embraced the role with style — “you can wear sunglasses inside” became their unofficial motto.\nTheir presence underlined a critical lesson: not every problem fits neatly within a team’s silo. Real-world defence requires flexibility, speed and lateral thinking.\nHighlights and Blooper Reel There were plenty of mishaps. Misfired scripts, team mix-ups, and one case where a DNS setup from a previous year was reused by mistake. Someone tried renaming cut to shutdown, breaking essential operations until it was fixed. Systems rebooted into chaos, a manual was uploaded to public GitHub, and the team had to quickly learn the difference between symbolic links and real binaries.\nHuman Factors and Growth From detecting malware with Velociraptor and Q9, to encountering teammates who took orders literally, the learning was intense. One participant noted that while Belgian and Luxembourg teams prioritized knowledge sharing, others preferred strict protocol. This highlighted cultural differences and the importance of interpersonal skills.\nThe biggest lesson? You are never fully prepared. Every iteration of Locked Shields is different. But each one sharpens not only your skills, but also your ability to function as a team under extreme conditions.\nFrom the Battlefield to the Classroom This experience directly impacts the classroom. Inspired by the exercise, Howest is introducing new hands-on courses like “Glutamine” in semester five. Students will be dropped into realistic broken networks, with misconfigurations, fake firewalls and simulated threats. It is chaos, but controlled. And that is the point.\nAs one speaker said: “You don’t win Locked Shields. You just survive it better than the rest.”\nFinal Thoughts The exercise teaches more than just cybersecurity. It builds trust. It proves that knowing your teammates can be as important as knowing the tools. Whether that comes from a shared flight or a pre-exercise barbecue, it all matters when the pressure hits.\nWant to see how cyber defence works in real life? This is it.\n","date":"May 13, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog-1_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog-1_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-1/","title":"Cyber Defence on the Digital Frontline: A Mission with NATO"},{"categories":["cybersecurity","CTF","education"],"contents":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience On March 14 and 15, I joined the Cyber Security Challenge Belgium qualifiers with three teammates. For two days, we threw ourselves at CTF challenges covering binary exploitation, Android reversing, cryptography, and more.\nWhat follows is a recap of the challenges I personally worked on—some I solved, some I didn’t—but all of them left me with new skills and new ideas.\nA Buffer Overflow to Warm Up One of the first challenges I picked involved a binary with a basic stack overflow. I used standard techniques—finding the offset, hijacking the return address, and injecting shellcode. Tools like pwntools helped automate the payload crafting. It was a great warm-up and a confidence boost once it worked.\nCryptography and Pattern Matching Another crypto puzzle asked us to match a generated ASCII art banner to its underlying seed. Once I understood how the randomness was embedded into the banner, I brute-forced the space with a simple pattern-matching script. The exercise was clean, deterministic, and satisfying to solve.\nOurEncIsSec: Zip Bombs and OEIS Then there was a more elaborate cryptography challenge: 18 zip files, each password-protected. We cracked the first three passwords using John the Ripper and got numeric values from them. I searched the sequence in OEIS and found it matched A007408, which gave us the full pattern of passwords.\nUsing this, I could extract all zip contents automatically, reconstruct the password-protected message, and finally reveal the flag.\nInfinite Luck: One in a Million? One challenge involved “guessing” a thousand random numbers between 1 and 10. The banner claimed it required infinite luck—but of course, the randomness was seeded. After inspecting the generator, I realized it was deterministic. By precomputing seeds and output sequences, I could match the challenge’s banner to a specific seed and regenerate the entire solution.\nAndroid Reversing: FRIDA and JADX Several APKs were part of the qualifier set. I used JADX to decompile them and FRIDA to patch logic at runtime. In one challenge, I bypassed license validation by forcing key methods to return true and unlocking hidden functionality.\nThe Challenge That Stuck with Me: Rebuilding a Split DEX This one stood out.\nThe app used a 4×8 button grid. Pressing buttons loaded a sequence of blockXX files from assets. These were concatenated in-memory and passed into InMemoryDexClassLoader to load a class called be.dauntless.flag.Flag.\nClass loadClass = new InMemoryDexClassLoader(ByteBuffer.wrap(byteArrayOutputStream.toByteArray()), getClassLoader()) .loadClass(\u0026#34;be.dauntless.flag.Flag\u0026#34;); Each block was a fragment of a DEX file, but the app didn’t tell you the right order. I tried manually inspecting the fragments—identifying methods, string constants, and offsets—to infer how to reassemble the full file. I got close, but didn’t crack it in time.\nThat challenge stuck with me because it combined static analysis, runtime introspection, and logic reconstruction. It wasn’t just technical—it was creative.\nThe One That Got Away: TLS Fingerprinting Another challenge involved a Go-based TLS server that rejected all client connections unless they matched a specific fingerprint. I used Go’s tls.Config to replicate the version, cipher suites, and ALPN:\ntls.Config{ MinVersion: tls.VersionTLS13, CipherSuites: []uint16{ tls.TLS_AES_128_GCM_SHA256, // ... }, NextProtos: []string{\u0026#34;h2\u0026#34;}, } Despite that, the server still refused the connection. I suspect it was using JA4 or similar TLS fingerprinting techniques we couldn’t fully emulate. We had to move on—but I’d love to revisit that one someday.\nFinal Thoughts I didn’t solve everything. But that wasn’t the point. Every challenge was a practical puzzle—something to decode, reverse, bypass, or just understand a little better.\nWorking as a team with Evarist, Nathan, and Waut made it even more valuable. We bounced ideas off each other, divided tasks, and got a much broader set of challenges covered.\nThe Cyber Security Challenge Belgium qualifiers weren’t easy. But they were the best kind of difficult—the kind that teaches you something whether you solve the problem or not.\n","date":"March 15, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog1/binexpl_hu_3d36b409c72f3586.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"160\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog1\\/binexpl_hu_afca672637b6b98d.png';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-2/","title":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience"},{"categories":null,"contents":"I built my personal blog using Hugo and deployed it on a lightweight Alpine Linux VPS. I chose this setup to have full control, keep things simple, and avoid bloated platforms or services. Here’s how the process went from site generation to live deployment.\nCreating the Hugo Site On my development machine, I created a new Hugo site:\nhugo new site howest-blog I used the professors-hugo theme and copied its exampleSite content into my project. I customized the layout, structure, and styling by editing content files, SCSS in assets/scss/custom.scss, and partial templates in the theme directory.\nAll content lives under content/, with separate folders for blog/ and project/, each containing .md files with front matter and Markdown content.\nCustomization I edited the config/_default/hugo.toml to configure site parameters like the base URL, theme, language, and menus. SCSS and image assets go in assets/, and are processed by Hugo\u0026rsquo;s pipeline. Static files like favicons are placed in static/.\nTo preview the site locally:\nhugo server To build the static site:\nhugo This generates everything in the public/ folder.\nVPS Deployment I rented a minimal Alpine Linux VPS and installed only what I needed. After setting up SSH and a basic nginx web server, I copied the public/ folder over using scp:\nscp -r public/* user@my-vps:/var/www/html On the VPS, I installed nginx:\napk add nginx And configured /etc/nginx/conf.d/default.conf to serve files from /var/www/html. Then I enabled and started nginx:\nrc-service nginx start rc-update add nginx Now my Hugo site is live and served directly as static files—no backend, no database, just HTML, CSS, and JS.\nWhy Alpine + Hugo? Alpine Linux is minimal and fast, perfect for serving static sites with low resource usage. Combined with Hugo’s speed and flexibility, I get a complete, performant setup that I fully control. It’s secure, lightweight, and easy to update—just rebuild and re-upload the public/ folder.\nThis setup is perfect if you want full control and minimal overhead for a personal blog or portfolio.\n","date":"May 29, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-2/","title":"Building My Hugo Website on a VPS"},{"categories":null,"contents":"DRMDTool is an automation-centric utility designed to streamline the processing of .drmd files by tightly integrating with the N_m3u8DL-RE downloader. The tool offers robust automation via a watch folder and an intuitive web-based interface, significantly reducing the friction for managing and processing DRM-protected streaming content.\nWhat’s New DRMDTool has evolved into a comprehensive platform for batch downloading with enhanced support for user interaction and background processing. It features granular job tracking, dynamic download control (pause, resume, abort), and a refined WebSocket-based console for real-time command output. Subtitle handling now includes automatic downloading and conversion from VTT to SRT, and the downloader adapts based on metadata, organizing content into categorized directories.\nGoals and Use Case The primary aim is to automate .drmd file processing with minimal manual input. Users can configure download formats, specify directories, and enable real-time command broadcasting. DRMDTool is suitable for both interactive use through a web UI and headless automation in pipelines, supporting inotify or polling-based folder watching.\nHow .drmd Files Work A .drmd file is a structured JSON document that defines one or more encrypted media items to be processed by DRMDTool. It contains an Items array, with each item representing a specific media job. DRMDTool parses these entries to generate download commands for N_m3u8DL-RE.\nEach item includes:\nMPD: A DASH manifest, either a direct URL or a base64-encoded version. If base64-encoded, DRMDTool decodes and temporarily saves it before use. Keys: A comma-separated list of KID:key pairs (e.g., abcd1234ef567890:00112233445566778899aabbccddeeff). These are required for decrypting encrypted media streams and are passed directly to N_m3u8DL-RE using --key flags. Filename: The name to be used for the final output file. Subtitles: Comma-separated list of subtitle URLs in .vtt format. DRMDTool downloads and converts these to .srt, then muxes them into the final file. Metadata: A semicolon-separated string like Title;Type;Season (e.g., Example Show;serie;1) used to determine directory structure (Movies/Title or Series/Title/Season). Description and Poster: Optional fields used only for display in the web UI. Example .drmd Structure { \u0026#34;Items\u0026#34;: [ { \u0026#34;MPD\u0026#34;: \u0026#34;aHR0cHM6Ly9leGFtcGxlLmNvbS9zdHJlYW0ubXBk\u0026#34;, \u0026#34;Keys\u0026#34;: \u0026#34;abcd1234ef567890:00112233445566778899aabbccddeeff\u0026#34;, \u0026#34;Filename\u0026#34;: \u0026#34;ExampleShow.S01E01\u0026#34;, \u0026#34;Subtitles\u0026#34;: \u0026#34;https://example.com/sub1.vtt,https://example.com/sub2.vtt\u0026#34;, \u0026#34;Metadata\u0026#34;: \u0026#34;Example Show;serie;1\u0026#34;, \u0026#34;Description\u0026#34;: \u0026#34;Pilot episode\u0026#34;, \u0026#34;Poster\u0026#34;: \u0026#34;\u0026#34; } ] } Processing Steps Detection: DRMDTool either watches a folder or receives .drmd uploads through the web UI. Validation: It waits for the file to finish writing (based on file size stability), then parses its contents. MPD Handling: If base64-encoded, the MPD is decoded and written to a temp file; otherwise, the URL is fetched or passed as-is. Command Generation: Using the MPD, KID:key pairs, output paths, and subtitles, DRMDTool builds a command line for N_m3u8DL-RE. Execution: The download is launched with live progress tracking. Users can pause, resume, or abort jobs, and optionally stream console output via WebSocket. These files serve as portable job definitions. When DRMDTool detects or receives a .drmd file, it parses the items, decodes or downloads the MPD, applies the keys, and builds a download command using N_m3u8DL-RE. Files are saved in organized directories like Movies/Title or Series/Title/Season, and subtitles are embedded if available. Pausing, resuming, and aborting downloads is supported per file.\nArchitecture Overview The configuration is handled via config.toml, with environment variable overrides for containerized or dynamic deployments. Once started, the tool can either monitor a specified folder or allow file uploads through the UI. Each .drmd file is parsed, grouped by series and season (if applicable), and processed sequentially with support for job pausing and resuming.\nWeb UI \u0026amp; CLI To use:\n./drmdtool Visit http://localhost:8080 for the web interface, which supports drag-and-drop uploads, selection of episodes or movies, and real-time progress tracking. For headless operation:\n./drmdtool -f /path/to/file.drmd Jobs can be paused, resumed, or aborted through the web interface, which reflects the backend state via live updates.\nEnhanced Download Logic DRMDTool dynamically builds download commands using metadata from .drmd files and user preferences. It ensures that only the highest quality streams are kept, removing ad periods and duplicate segments from the MPD files. Subtitles are fetched and embedded automatically. Jobs are tracked with robust state management and logs for debugging and visibility.\nRepository Code and setup instructions are hosted here: https://git.directme.in/Joren/DRMDTool\nDRMDtool For advanced usage details, customization, and API structure, refer to the README.md in the repository.\nUI Previews Index Page Select Page Progress Page ","date":"May 21, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-1/","title":"DRMDTool Project"},{"categories":["cybersecurity","event recap"],"contents":"Cyber Defence on the Digital Frontline: A Mission with NATO On a Mission with NATO: Cyber Defence on the Frontline Howest’s ongoing commitment to world-class cybersecurity training took center stage again as six lecturers from the Cyber Security program joined forces with experts from Latvia, Luxembourg and Belgium in one of NATO\u0026rsquo;s most intensive simulations: the Locked Shields exercise, hosted by the Cooperative Cyber Defence Centre of Excellence (CCDCOE). Now in its fifth year of participation, the Howest team shared their firsthand experiences at a special evening talk at Howest Bruges.\nThe Exercise: Locked Shields Locked Shields is no ordinary simulation. It is a full-scale, live-fire cyber defence exercise involving more than 6,000 machines and a narrative scenario so detailed it includes geopolitics, disinformation and even fictional countries. This year, the Blue Team 03 (our team) defended a simulated nation’s critical infrastructure including power plants, satellites, 5G networks and banking systems, all while under constant attack from a coordinated Red Team using automated scripts and over 28,000 attacks across two days.\nAnd yes, every team (Red, Blue, Yellow, White) uses Ansible. For everything.\nHigh Stakes, Real Lessons What do you do when a rogue process might be malware, or maybe just a poorly named service? What happens when your teammate refuses to act unless something is “officially malicious”? The team faced cultural clashes, communication breakdowns and stress-testing of both systems and people.\nThe exercise required more than technical fixes. It demanded communication with simulated commanders, media and public stakeholders. Reporting became just as important as patching. It taught participants how to translate technical impact into real-world consequences. Not \u0026ldquo;port 8443 unreachable\u0026rdquo;, but \u0026ldquo;our air defence system is degraded, and we cannot fly planes\u0026rdquo;.\nThe Black Team: Rapid Response in Action A new but powerful presence in the simulation was the Black Team, a rapid-response unit deployed when problems became too complex for any single team. Acting like special forces, they jumped in when incidents crossed team boundaries or demanded unconventional solutions. Their mission was to find out what was happening, assess the impact and suggest fast, creative responses. Introduced just last year, this team quickly proved its value again in 2025. They even embraced the role with style — “you can wear sunglasses inside” became their unofficial motto.\nTheir presence underlined a critical lesson: not every problem fits neatly within a team’s silo. Real-world defence requires flexibility, speed and lateral thinking.\nHighlights and Blooper Reel There were plenty of mishaps. Misfired scripts, team mix-ups, and one case where a DNS setup from a previous year was reused by mistake. Someone tried renaming cut to shutdown, breaking essential operations until it was fixed. Systems rebooted into chaos, a manual was uploaded to public GitHub, and the team had to quickly learn the difference between symbolic links and real binaries.\nHuman Factors and Growth From detecting malware with Velociraptor and Q9, to encountering teammates who took orders literally, the learning was intense. One participant noted that while Belgian and Luxembourg teams prioritized knowledge sharing, others preferred strict protocol. This highlighted cultural differences and the importance of interpersonal skills.\nThe biggest lesson? You are never fully prepared. Every iteration of Locked Shields is different. But each one sharpens not only your skills, but also your ability to function as a team under extreme conditions.\nFrom the Battlefield to the Classroom This experience directly impacts the classroom. Inspired by the exercise, Howest is introducing new hands-on courses like “Glutamine” in semester five. Students will be dropped into realistic broken networks, with misconfigurations, fake firewalls and simulated threats. It is chaos, but controlled. And that is the point.\nAs one speaker said: “You don’t win Locked Shields. You just survive it better than the rest.”\nFinal Thoughts The exercise teaches more than just cybersecurity. It builds trust. It proves that knowing your teammates can be as important as knowing the tools. Whether that comes from a shared flight or a pre-exercise barbecue, it all matters when the pressure hits.\nWant to see how cyber defence works in real life? This is it.\n","date":"May 13, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog-1_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog-1_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-1/","title":"Cyber Defence on the Digital Frontline: A Mission with NATO"},{"categories":["cybersecurity","CTF","education"],"contents":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience On March 14 and 15, I joined the Cyber Security Challenge Belgium qualifiers with three teammates. For two days, we threw ourselves at CTF challenges covering binary exploitation, Android reversing, cryptography, and more.\nWhat follows is a recap of the challenges I personally worked on—some I solved, some I didn’t—but all of them left me with new skills and new ideas.\nA Buffer Overflow to Warm Up One of the first challenges I picked involved a binary with a basic stack overflow. I used standard techniques—finding the offset, hijacking the return address, and injecting shellcode. Tools like pwntools helped automate the payload crafting. It was a great warm-up and a confidence boost once it worked.\nCryptography and Pattern Matching Another crypto puzzle asked us to match a generated ASCII art banner to its underlying seed. Once I understood how the randomness was embedded into the banner, I brute-forced the space with a simple pattern-matching script. The exercise was clean, deterministic, and satisfying to solve.\nOurEncIsSec: Zip Bombs and OEIS Then there was a more elaborate cryptography challenge: 18 zip files, each password-protected. We cracked the first three passwords using John the Ripper and got numeric values from them. I searched the sequence in OEIS and found it matched A007408, which gave us the full pattern of passwords.\nUsing this, I could extract all zip contents automatically, reconstruct the password-protected message, and finally reveal the flag.\nInfinite Luck: One in a Million? One challenge involved “guessing” a thousand random numbers between 1 and 10. The banner claimed it required infinite luck—but of course, the randomness was seeded. After inspecting the generator, I realized it was deterministic. By precomputing seeds and output sequences, I could match the challenge’s banner to a specific seed and regenerate the entire solution.\nAndroid Reversing: FRIDA and JADX Several APKs were part of the qualifier set. I used JADX to decompile them and FRIDA to patch logic at runtime. In one challenge, I bypassed license validation by forcing key methods to return true and unlocking hidden functionality.\nThe Challenge That Stuck with Me: Rebuilding a Split DEX This one stood out.\nThe app used a 4×8 button grid. Pressing buttons loaded a sequence of blockXX files from assets. These were concatenated in-memory and passed into InMemoryDexClassLoader to load a class called be.dauntless.flag.Flag.\nClass loadClass = new InMemoryDexClassLoader(ByteBuffer.wrap(byteArrayOutputStream.toByteArray()), getClassLoader()) .loadClass(\u0026#34;be.dauntless.flag.Flag\u0026#34;); Each block was a fragment of a DEX file, but the app didn’t tell you the right order. I tried manually inspecting the fragments—identifying methods, string constants, and offsets—to infer how to reassemble the full file. I got close, but didn’t crack it in time.\nThat challenge stuck with me because it combined static analysis, runtime introspection, and logic reconstruction. It wasn’t just technical—it was creative.\nThe One That Got Away: TLS Fingerprinting Another challenge involved a Go-based TLS server that rejected all client connections unless they matched a specific fingerprint. I used Go’s tls.Config to replicate the version, cipher suites, and ALPN:\ntls.Config{ MinVersion: tls.VersionTLS13, CipherSuites: []uint16{ tls.TLS_AES_128_GCM_SHA256, // ... }, NextProtos: []string{\u0026#34;h2\u0026#34;}, } Despite that, the server still refused the connection. I suspect it was using JA4 or similar TLS fingerprinting techniques we couldn’t fully emulate. We had to move on—but I’d love to revisit that one someday.\nFinal Thoughts I didn’t solve everything. But that wasn’t the point. Every challenge was a practical puzzle—something to decode, reverse, bypass, or just understand a little better.\nWorking as a team with Evarist, Nathan, and Waut made it even more valuable. We bounced ideas off each other, divided tasks, and got a much broader set of challenges covered.\nThe Cyber Security Challenge Belgium qualifiers weren’t easy. But they were the best kind of difficult—the kind that teaches you something whether you solve the problem or not.\n","date":"March 15, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n \n \n\n\n \n\n","permalink":"/blog/post-2/","title":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience"},{"categories":null,"contents":"I built my personal blog using Hugo and deployed it on a lightweight Alpine Linux VPS. I chose this setup to have full control, keep things simple, and avoid bloated platforms or services. Here’s how the process went from site generation to live deployment.\nCreating the Hugo Site On my development machine, I created a new Hugo site:\nhugo new site howest-blog I used the professors-hugo theme and copied its exampleSite content into my project. I customized the layout, structure, and styling by editing content files, SCSS in assets/scss/custom.scss, and partial templates in the theme directory.\nAll content lives under content/, with separate folders for blog/ and project/, each containing .md files with front matter and Markdown content.\nCustomization I edited the config/_default/hugo.toml to configure site parameters like the base URL, theme, language, and menus. SCSS and image assets go in assets/, and are processed by Hugo\u0026rsquo;s pipeline. Static files like favicons are placed in static/.\nTo preview the site locally:\nhugo server To build the static site:\nhugo This generates everything in the public/ folder.\nVPS Deployment I rented a minimal Alpine Linux VPS and installed only what I needed. After setting up SSH and a basic nginx web server, I copied the public/ folder over using scp:\nscp -r public/* user@my-vps:/var/www/html On the VPS, I installed nginx:\napk add nginx And configured /etc/nginx/conf.d/default.conf to serve files from /var/www/html. Then I enabled and started nginx:\nrc-service nginx start rc-update add nginx Now my Hugo site is live and served directly as static files—no backend, no database, just HTML, CSS, and JS.\nWhy Alpine + Hugo? Alpine Linux is minimal and fast, perfect for serving static sites with low resource usage. Combined with Hugo’s speed and flexibility, I get a complete, performant setup that I fully control. It’s secure, lightweight, and easy to update—just rebuild and re-upload the public/ folder.\nThis setup is perfect if you want full control and minimal overhead for a personal blog or portfolio.\n","date":"May 29, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-2/","title":"Building My Hugo Website on a VPS"},{"categories":null,"contents":"DRMDTool is an automation-centric utility designed to streamline the processing of .drmd files by tightly integrating with the N_m3u8DL-RE downloader. The tool offers robust automation via a watch folder and an intuitive web-based interface, significantly reducing the friction for managing and processing DRM-protected streaming content.\nWhat’s New DRMDTool has evolved into a comprehensive platform for batch downloading with enhanced support for user interaction and background processing. It features granular job tracking, dynamic download control (pause, resume, abort), and a refined WebSocket-based console for real-time command output. Subtitle handling now includes automatic downloading and conversion from VTT to SRT, and the downloader adapts based on metadata, organizing content into categorized directories.\nGoals and Use Case The primary aim is to automate .drmd file processing with minimal manual input. Users can configure download formats, specify directories, and enable real-time command broadcasting. DRMDTool is suitable for both interactive use through a web UI and headless automation in pipelines, supporting inotify or polling-based folder watching.\nHow .drmd Files Work A .drmd file is a structured JSON document that defines one or more encrypted media items to be processed by DRMDTool. It contains an Items array, with each item representing a specific media job. DRMDTool parses these entries to generate download commands for N_m3u8DL-RE.\nEach item includes:\nMPD: A DASH manifest, either a direct URL or a base64-encoded version. If base64-encoded, DRMDTool decodes and temporarily saves it before use. Keys: A comma-separated list of KID:key pairs (e.g., abcd1234ef567890:00112233445566778899aabbccddeeff). These are required for decrypting encrypted media streams and are passed directly to N_m3u8DL-RE using --key flags. Filename: The name to be used for the final output file. Subtitles: Comma-separated list of subtitle URLs in .vtt format. DRMDTool downloads and converts these to .srt, then muxes them into the final file. Metadata: A semicolon-separated string like Title;Type;Season (e.g., Example Show;serie;1) used to determine directory structure (Movies/Title or Series/Title/Season). Description and Poster: Optional fields used only for display in the web UI. Example .drmd Structure { \u0026#34;Items\u0026#34;: [ { \u0026#34;MPD\u0026#34;: \u0026#34;aHR0cHM6Ly9leGFtcGxlLmNvbS9zdHJlYW0ubXBk\u0026#34;, \u0026#34;Keys\u0026#34;: \u0026#34;abcd1234ef567890:00112233445566778899aabbccddeeff\u0026#34;, \u0026#34;Filename\u0026#34;: \u0026#34;ExampleShow.S01E01\u0026#34;, \u0026#34;Subtitles\u0026#34;: \u0026#34;https://example.com/sub1.vtt,https://example.com/sub2.vtt\u0026#34;, \u0026#34;Metadata\u0026#34;: \u0026#34;Example Show;serie;1\u0026#34;, \u0026#34;Description\u0026#34;: \u0026#34;Pilot episode\u0026#34;, \u0026#34;Poster\u0026#34;: \u0026#34;\u0026#34; } ] } Processing Steps Detection: DRMDTool either watches a folder or receives .drmd uploads through the web UI. Validation: It waits for the file to finish writing (based on file size stability), then parses its contents. MPD Handling: If base64-encoded, the MPD is decoded and written to a temp file; otherwise, the URL is fetched or passed as-is. Command Generation: Using the MPD, KID:key pairs, output paths, and subtitles, DRMDTool builds a command line for N_m3u8DL-RE. Execution: The download is launched with live progress tracking. Users can pause, resume, or abort jobs, and optionally stream console output via WebSocket. These files serve as portable job definitions. When DRMDTool detects or receives a .drmd file, it parses the items, decodes or downloads the MPD, applies the keys, and builds a download command using N_m3u8DL-RE. Files are saved in organized directories like Movies/Title or Series/Title/Season, and subtitles are embedded if available. Pausing, resuming, and aborting downloads is supported per file.\nArchitecture Overview The configuration is handled via config.toml, with environment variable overrides for containerized or dynamic deployments. Once started, the tool can either monitor a specified folder or allow file uploads through the UI. Each .drmd file is parsed, grouped by series and season (if applicable), and processed sequentially with support for job pausing and resuming.\nWeb UI \u0026amp; CLI To use:\n./drmdtool Visit http://localhost:8080 for the web interface, which supports drag-and-drop uploads, selection of episodes or movies, and real-time progress tracking. For headless operation:\n./drmdtool -f /path/to/file.drmd Jobs can be paused, resumed, or aborted through the web interface, which reflects the backend state via live updates.\nEnhanced Download Logic DRMDTool dynamically builds download commands using metadata from .drmd files and user preferences. It ensures that only the highest quality streams are kept, removing ad periods and duplicate segments from the MPD files. Subtitles are fetched and embedded automatically. Jobs are tracked with robust state management and logs for debugging and visibility.\nRepository Code and setup instructions are hosted here: https://git.directme.in/Joren/DRMDTool\nDRMDtool For advanced usage details, customization, and API structure, refer to the README.md in the repository.\nUI Previews Index Page Select Page Progress Page ","date":"May 21, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-1/","title":"DRMDTool Project"},{"categories":["cybersecurity","event recap"],"contents":"Cyber Defence on the Digital Frontline: A Mission with NATO On a Mission with NATO: Cyber Defence on the Frontline Howest’s ongoing commitment to world-class cybersecurity training took center stage again as six lecturers from the Cyber Security program joined forces with experts from Latvia, Luxembourg and Belgium in one of NATO\u0026rsquo;s most intensive simulations: the Locked Shields exercise, hosted by the Cooperative Cyber Defence Centre of Excellence (CCDCOE). Now in its fifth year of participation, the Howest team shared their firsthand experiences at a special evening talk at Howest Bruges.\nThe Exercise: Locked Shields Locked Shields is no ordinary simulation. It is a full-scale, live-fire cyber defence exercise involving more than 6,000 machines and a narrative scenario so detailed it includes geopolitics, disinformation and even fictional countries. This year, the Blue Team 03 (our team) defended a simulated nation’s critical infrastructure including power plants, satellites, 5G networks and banking systems, all while under constant attack from a coordinated Red Team using automated scripts and over 28,000 attacks across two days.\nAnd yes, every team (Red, Blue, Yellow, White) uses Ansible. For everything.\nHigh Stakes, Real Lessons What do you do when a rogue process might be malware, or maybe just a poorly named service? What happens when your teammate refuses to act unless something is “officially malicious”? The team faced cultural clashes, communication breakdowns and stress-testing of both systems and people.\nThe exercise required more than technical fixes. It demanded communication with simulated commanders, media and public stakeholders. Reporting became just as important as patching. It taught participants how to translate technical impact into real-world consequences. Not \u0026ldquo;port 8443 unreachable\u0026rdquo;, but \u0026ldquo;our air defence system is degraded, and we cannot fly planes\u0026rdquo;.\nThe Black Team: Rapid Response in Action A new but powerful presence in the simulation was the Black Team, a rapid-response unit deployed when problems became too complex for any single team. Acting like special forces, they jumped in when incidents crossed team boundaries or demanded unconventional solutions. Their mission was to find out what was happening, assess the impact and suggest fast, creative responses. Introduced just last year, this team quickly proved its value again in 2025. They even embraced the role with style — “you can wear sunglasses inside” became their unofficial motto.\nTheir presence underlined a critical lesson: not every problem fits neatly within a team’s silo. Real-world defence requires flexibility, speed and lateral thinking.\nHighlights and Blooper Reel There were plenty of mishaps. Misfired scripts, team mix-ups, and one case where a DNS setup from a previous year was reused by mistake. Someone tried renaming cut to shutdown, breaking essential operations until it was fixed. Systems rebooted into chaos, a manual was uploaded to public GitHub, and the team had to quickly learn the difference between symbolic links and real binaries.\nHuman Factors and Growth From detecting malware with Velociraptor and Q9, to encountering teammates who took orders literally, the learning was intense. One participant noted that while Belgian and Luxembourg teams prioritized knowledge sharing, others preferred strict protocol. This highlighted cultural differences and the importance of interpersonal skills.\nThe biggest lesson? You are never fully prepared. Every iteration of Locked Shields is different. But each one sharpens not only your skills, but also your ability to function as a team under extreme conditions.\nFrom the Battlefield to the Classroom This experience directly impacts the classroom. Inspired by the exercise, Howest is introducing new hands-on courses like “Glutamine” in semester five. Students will be dropped into realistic broken networks, with misconfigurations, fake firewalls and simulated threats. It is chaos, but controlled. And that is the point.\nAs one speaker said: “You don’t win Locked Shields. You just survive it better than the rest.”\nFinal Thoughts The exercise teaches more than just cybersecurity. It builds trust. It proves that knowing your teammates can be as important as knowing the tools. Whether that comes from a shared flight or a pre-exercise barbecue, it all matters when the pressure hits.\nWant to see how cyber defence works in real life? This is it.\n","date":"May 13, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog-1_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog-1_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-1/","title":"Cyber Defence on the Digital Frontline: A Mission with NATO"},{"categories":["cybersecurity","CTF","education"],"contents":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience On March 14 and 15, I joined the Cyber Security Challenge Belgium qualifiers with three teammates. For two days, we threw ourselves at CTF challenges covering binary exploitation, Android reversing, cryptography, and more.\nWhat follows is a recap of the challenges I personally worked on—some I solved, some I didn’t—but all of them left me with new skills and new ideas.\nA Buffer Overflow to Warm Up One of the first challenges I picked involved a binary with a basic stack overflow. I used standard techniques—finding the offset, hijacking the return address, and injecting shellcode. Tools like pwntools helped automate the payload crafting. It was a great warm-up and a confidence boost once it worked.\nCryptography and Pattern Matching Another crypto puzzle asked us to match a generated ASCII art banner to its underlying seed. Once I understood how the randomness was embedded into the banner, I brute-forced the space with a simple pattern-matching script. The exercise was clean, deterministic, and satisfying to solve.\nOurEncIsSec: Zip Bombs and OEIS Then there was a more elaborate cryptography challenge: 18 zip files, each password-protected. We cracked the first three passwords using John the Ripper and got numeric values from them. I searched the sequence in OEIS and found it matched A007408, which gave us the full pattern of passwords.\nUsing this, I could extract all zip contents automatically, reconstruct the password-protected message, and finally reveal the flag.\nInfinite Luck: One in a Million? One challenge involved “guessing” a thousand random numbers between 1 and 10. The banner claimed it required infinite luck—but of course, the randomness was seeded. After inspecting the generator, I realized it was deterministic. By precomputing seeds and output sequences, I could match the challenge’s banner to a specific seed and regenerate the entire solution.\nAndroid Reversing: FRIDA and JADX Several APKs were part of the qualifier set. I used JADX to decompile them and FRIDA to patch logic at runtime. In one challenge, I bypassed license validation by forcing key methods to return true and unlocking hidden functionality.\nThe Challenge That Stuck with Me: Rebuilding a Split DEX This one stood out.\nThe app used a 4×8 button grid. Pressing buttons loaded a sequence of blockXX files from assets. These were concatenated in-memory and passed into InMemoryDexClassLoader to load a class called be.dauntless.flag.Flag.\nClass loadClass = new InMemoryDexClassLoader(ByteBuffer.wrap(byteArrayOutputStream.toByteArray()), getClassLoader()) .loadClass(\u0026#34;be.dauntless.flag.Flag\u0026#34;); Each block was a fragment of a DEX file, but the app didn’t tell you the right order. I tried manually inspecting the fragments—identifying methods, string constants, and offsets—to infer how to reassemble the full file. I got close, but didn’t crack it in time.\nThat challenge stuck with me because it combined static analysis, runtime introspection, and logic reconstruction. It wasn’t just technical—it was creative.\nThe One That Got Away: TLS Fingerprinting Another challenge involved a Go-based TLS server that rejected all client connections unless they matched a specific fingerprint. I used Go’s tls.Config to replicate the version, cipher suites, and ALPN:\ntls.Config{ MinVersion: tls.VersionTLS13, CipherSuites: []uint16{ tls.TLS_AES_128_GCM_SHA256, // ... }, NextProtos: []string{\u0026#34;h2\u0026#34;}, } Despite that, the server still refused the connection. I suspect it was using JA4 or similar TLS fingerprinting techniques we couldn’t fully emulate. We had to move on—but I’d love to revisit that one someday.\nFinal Thoughts I didn’t solve everything. But that wasn’t the point. Every challenge was a practical puzzle—something to decode, reverse, bypass, or just understand a little better.\nWorking as a team with Evarist, Nathan, and Waut made it even more valuable. We bounced ideas off each other, divided tasks, and got a much broader set of challenges covered.\nThe Cyber Security Challenge Belgium qualifiers weren’t easy. But they were the best kind of difficult—the kind that teaches you something whether you solve the problem or not.\n","date":"March 15, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n \n \n\n\n \n\n","permalink":"/blog/post-2/","title":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience"},{"categories":null,"contents":"I built my personal blog using Hugo and deployed it on a lightweight Alpine Linux VPS. I chose this setup to have full control, keep things simple, and avoid bloated platforms or services. Here’s how the process went from site generation to live deployment.\nCreating the Hugo Site On my development machine, I created a new Hugo site:\nhugo new site howest-blog I used the professors-hugo theme and copied its exampleSite content into my project. I customized the layout, structure, and styling by editing content files, SCSS in assets/scss/custom.scss, and partial templates in the theme directory.\nAll content lives under content/, with separate folders for blog/ and project/, each containing .md files with front matter and Markdown content.\nCustomization I edited the config/_default/hugo.toml to configure site parameters like the base URL, theme, language, and menus. SCSS and image assets go in assets/, and are processed by Hugo\u0026rsquo;s pipeline. Static files like favicons are placed in static/.\nTo preview the site locally:\nhugo server To build the static site:\nhugo This generates everything in the public/ folder.\nVPS Deployment I rented a minimal Alpine Linux VPS and installed only what I needed. After setting up SSH and a basic nginx web server, I copied the public/ folder over using scp:\nscp -r public/* user@my-vps:/var/www/html On the VPS, I installed nginx:\napk add nginx And configured /etc/nginx/conf.d/default.conf to serve files from /var/www/html. Then I enabled and started nginx:\nrc-service nginx start rc-update add nginx Now my Hugo site is live and served directly as static files—no backend, no database, just HTML, CSS, and JS.\nWhy Alpine + Hugo? Alpine Linux is minimal and fast, perfect for serving static sites with low resource usage. Combined with Hugo’s speed and flexibility, I get a complete, performant setup that I fully control. It’s secure, lightweight, and easy to update—just rebuild and re-upload the public/ folder.\nThis setup is perfect if you want full control and minimal overhead for a personal blog or portfolio.\n","date":"May 29, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-2/","title":"Building My Hugo Website on a VPS"},{"categories":null,"contents":"DRMDTool is an automation-centric utility designed to streamline the processing of .drmd files by tightly integrating with the N_m3u8DL-RE downloader. The tool offers robust automation via a watch folder and an intuitive web-based interface, significantly reducing the friction for managing and processing DRM-protected streaming content.\nWhat’s New DRMDTool has evolved into a comprehensive platform for batch downloading with enhanced support for user interaction and background processing. It features granular job tracking, dynamic download control (pause, resume, abort), and a refined WebSocket-based console for real-time command output. Subtitle handling now includes automatic downloading and conversion from VTT to SRT, and the downloader adapts based on metadata, organizing content into categorized directories.\nGoals and Use Case The primary aim is to automate .drmd file processing with minimal manual input. Users can configure download formats, specify directories, and enable real-time command broadcasting. DRMDTool is suitable for both interactive use through a web UI and headless automation in pipelines, supporting inotify or polling-based folder watching.\nHow .drmd Files Work A .drmd file is a structured JSON document that defines one or more encrypted media items to be processed by DRMDTool. It contains an Items array, with each item representing a specific media job. DRMDTool parses these entries to generate download commands for N_m3u8DL-RE.\nEach item includes:\nMPD: A DASH manifest, either a direct URL or a base64-encoded version. If base64-encoded, DRMDTool decodes and temporarily saves it before use. Keys: A comma-separated list of KID:key pairs (e.g., abcd1234ef567890:00112233445566778899aabbccddeeff). These are required for decrypting encrypted media streams and are passed directly to N_m3u8DL-RE using --key flags. Filename: The name to be used for the final output file. Subtitles: Comma-separated list of subtitle URLs in .vtt format. DRMDTool downloads and converts these to .srt, then muxes them into the final file. Metadata: A semicolon-separated string like Title;Type;Season (e.g., Example Show;serie;1) used to determine directory structure (Movies/Title or Series/Title/Season). Description and Poster: Optional fields used only for display in the web UI. Example .drmd Structure { \u0026#34;Items\u0026#34;: [ { \u0026#34;MPD\u0026#34;: \u0026#34;aHR0cHM6Ly9leGFtcGxlLmNvbS9zdHJlYW0ubXBk\u0026#34;, \u0026#34;Keys\u0026#34;: \u0026#34;abcd1234ef567890:00112233445566778899aabbccddeeff\u0026#34;, \u0026#34;Filename\u0026#34;: \u0026#34;ExampleShow.S01E01\u0026#34;, \u0026#34;Subtitles\u0026#34;: \u0026#34;https://example.com/sub1.vtt,https://example.com/sub2.vtt\u0026#34;, \u0026#34;Metadata\u0026#34;: \u0026#34;Example Show;serie;1\u0026#34;, \u0026#34;Description\u0026#34;: \u0026#34;Pilot episode\u0026#34;, \u0026#34;Poster\u0026#34;: \u0026#34;\u0026#34; } ] } Processing Steps Detection: DRMDTool either watches a folder or receives .drmd uploads through the web UI. Validation: It waits for the file to finish writing (based on file size stability), then parses its contents. MPD Handling: If base64-encoded, the MPD is decoded and written to a temp file; otherwise, the URL is fetched or passed as-is. Command Generation: Using the MPD, KID:key pairs, output paths, and subtitles, DRMDTool builds a command line for N_m3u8DL-RE. Execution: The download is launched with live progress tracking. Users can pause, resume, or abort jobs, and optionally stream console output via WebSocket. These files serve as portable job definitions. When DRMDTool detects or receives a .drmd file, it parses the items, decodes or downloads the MPD, applies the keys, and builds a download command using N_m3u8DL-RE. Files are saved in organized directories like Movies/Title or Series/Title/Season, and subtitles are embedded if available. Pausing, resuming, and aborting downloads is supported per file.\nArchitecture Overview The configuration is handled via config.toml, with environment variable overrides for containerized or dynamic deployments. Once started, the tool can either monitor a specified folder or allow file uploads through the UI. Each .drmd file is parsed, grouped by series and season (if applicable), and processed sequentially with support for job pausing and resuming.\nWeb UI \u0026amp; CLI To use:\n./drmdtool Visit http://localhost:8080 for the web interface, which supports drag-and-drop uploads, selection of episodes or movies, and real-time progress tracking. For headless operation:\n./drmdtool -f /path/to/file.drmd Jobs can be paused, resumed, or aborted through the web interface, which reflects the backend state via live updates.\nEnhanced Download Logic DRMDTool dynamically builds download commands using metadata from .drmd files and user preferences. It ensures that only the highest quality streams are kept, removing ad periods and duplicate segments from the MPD files. Subtitles are fetched and embedded automatically. Jobs are tracked with robust state management and logs for debugging and visibility.\nRepository Code and setup instructions are hosted here: https://git.directme.in/Joren/DRMDTool\nDRMDtool For advanced usage details, customization, and API structure, refer to the README.md in the repository.\nUI Previews Index Page Select Page Progress Page ","date":"May 21, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-1/","title":"DRMDTool Project"},{"categories":["cybersecurity","event recap"],"contents":"Cyber Defence on the Digital Frontline: A Mission with NATO On a Mission with NATO: Cyber Defence on the Frontline Howest’s ongoing commitment to world-class cybersecurity training took center stage again as six lecturers from the Cyber Security program joined forces with experts from Latvia, Luxembourg and Belgium in one of NATO\u0026rsquo;s most intensive simulations: the Locked Shields exercise, hosted by the Cooperative Cyber Defence Centre of Excellence (CCDCOE). Now in its fifth year of participation, the Howest team shared their firsthand experiences at a special evening talk at Howest Bruges.\nThe Exercise: Locked Shields Locked Shields is no ordinary simulation. It is a full-scale, live-fire cyber defence exercise involving more than 6,000 machines and a narrative scenario so detailed it includes geopolitics, disinformation and even fictional countries. This year, the Blue Team 03 (our team) defended a simulated nation’s critical infrastructure including power plants, satellites, 5G networks and banking systems, all while under constant attack from a coordinated Red Team using automated scripts and over 28,000 attacks across two days.\nAnd yes, every team (Red, Blue, Yellow, White) uses Ansible. For everything.\nHigh Stakes, Real Lessons What do you do when a rogue process might be malware, or maybe just a poorly named service? What happens when your teammate refuses to act unless something is “officially malicious”? The team faced cultural clashes, communication breakdowns and stress-testing of both systems and people.\nThe exercise required more than technical fixes. It demanded communication with simulated commanders, media and public stakeholders. Reporting became just as important as patching. It taught participants how to translate technical impact into real-world consequences. Not \u0026ldquo;port 8443 unreachable\u0026rdquo;, but \u0026ldquo;our air defence system is degraded, and we cannot fly planes\u0026rdquo;.\nThe Black Team: Rapid Response in Action A new but powerful presence in the simulation was the Black Team, a rapid-response unit deployed when problems became too complex for any single team. Acting like special forces, they jumped in when incidents crossed team boundaries or demanded unconventional solutions. Their mission was to find out what was happening, assess the impact and suggest fast, creative responses. Introduced just last year, this team quickly proved its value again in 2025. They even embraced the role with style — “you can wear sunglasses inside” became their unofficial motto.\nTheir presence underlined a critical lesson: not every problem fits neatly within a team’s silo. Real-world defence requires flexibility, speed and lateral thinking.\nHighlights and Blooper Reel There were plenty of mishaps. Misfired scripts, team mix-ups, and one case where a DNS setup from a previous year was reused by mistake. Someone tried renaming cut to shutdown, breaking essential operations until it was fixed. Systems rebooted into chaos, a manual was uploaded to public GitHub, and the team had to quickly learn the difference between symbolic links and real binaries.\nHuman Factors and Growth From detecting malware with Velociraptor and Q9, to encountering teammates who took orders literally, the learning was intense. One participant noted that while Belgian and Luxembourg teams prioritized knowledge sharing, others preferred strict protocol. This highlighted cultural differences and the importance of interpersonal skills.\nThe biggest lesson? You are never fully prepared. Every iteration of Locked Shields is different. But each one sharpens not only your skills, but also your ability to function as a team under extreme conditions.\nFrom the Battlefield to the Classroom This experience directly impacts the classroom. Inspired by the exercise, Howest is introducing new hands-on courses like “Glutamine” in semester five. Students will be dropped into realistic broken networks, with misconfigurations, fake firewalls and simulated threats. It is chaos, but controlled. And that is the point.\nAs one speaker said: “You don’t win Locked Shields. You just survive it better than the rest.”\nFinal Thoughts The exercise teaches more than just cybersecurity. It builds trust. It proves that knowing your teammates can be as important as knowing the tools. Whether that comes from a shared flight or a pre-exercise barbecue, it all matters when the pressure hits.\nWant to see how cyber defence works in real life? This is it.\n","date":"May 13, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog-1_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog-1_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-1/","title":"Cyber Defence on the Digital Frontline: A Mission with NATO"},{"categories":["cybersecurity","CTF","education"],"contents":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience On March 14 and 15, I joined the Cyber Security Challenge Belgium qualifiers with three teammates. For two days, we threw ourselves at CTF challenges covering binary exploitation, Android reversing, cryptography, and more.\nWhat follows is a recap of the challenges I personally worked on—some I solved, some I didn’t—but all of them left me with new skills and new ideas.\nA Buffer Overflow to Warm Up One of the first challenges I picked involved a binary with a basic stack overflow. I used standard techniques—finding the offset, hijacking the return address, and injecting shellcode. Tools like pwntools helped automate the payload crafting. It was a great warm-up and a confidence boost once it worked.\nCryptography and Pattern Matching Another crypto puzzle asked us to match a generated ASCII art banner to its underlying seed. Once I understood how the randomness was embedded into the banner, I brute-forced the space with a simple pattern-matching script. The exercise was clean, deterministic, and satisfying to solve.\nOurEncIsSec: Zip Bombs and OEIS Then there was a more elaborate cryptography challenge: 18 zip files, each password-protected. We cracked the first three passwords using John the Ripper and got numeric values from them. I searched the sequence in OEIS and found it matched A007408, which gave us the full pattern of passwords.\nUsing this, I could extract all zip contents automatically, reconstruct the password-protected message, and finally reveal the flag.\nInfinite Luck: One in a Million? One challenge involved “guessing” a thousand random numbers between 1 and 10. The banner claimed it required infinite luck—but of course, the randomness was seeded. After inspecting the generator, I realized it was deterministic. By precomputing seeds and output sequences, I could match the challenge’s banner to a specific seed and regenerate the entire solution.\nAndroid Reversing: FRIDA and JADX Several APKs were part of the qualifier set. I used JADX to decompile them and FRIDA to patch logic at runtime. In one challenge, I bypassed license validation by forcing key methods to return true and unlocking hidden functionality.\nThe Challenge That Stuck with Me: Rebuilding a Split DEX This one stood out.\nThe app used a 4×8 button grid. Pressing buttons loaded a sequence of blockXX files from assets. These were concatenated in-memory and passed into InMemoryDexClassLoader to load a class called be.dauntless.flag.Flag.\nClass loadClass = new InMemoryDexClassLoader(ByteBuffer.wrap(byteArrayOutputStream.toByteArray()), getClassLoader()) .loadClass(\u0026#34;be.dauntless.flag.Flag\u0026#34;); Each block was a fragment of a DEX file, but the app didn’t tell you the right order. I tried manually inspecting the fragments—identifying methods, string constants, and offsets—to infer how to reassemble the full file. I got close, but didn’t crack it in time.\nThat challenge stuck with me because it combined static analysis, runtime introspection, and logic reconstruction. It wasn’t just technical—it was creative.\nThe One That Got Away: TLS Fingerprinting Another challenge involved a Go-based TLS server that rejected all client connections unless they matched a specific fingerprint. I used Go’s tls.Config to replicate the version, cipher suites, and ALPN:\ntls.Config{ MinVersion: tls.VersionTLS13, CipherSuites: []uint16{ tls.TLS_AES_128_GCM_SHA256, // ... }, NextProtos: []string{\u0026#34;h2\u0026#34;}, } Despite that, the server still refused the connection. I suspect it was using JA4 or similar TLS fingerprinting techniques we couldn’t fully emulate. We had to move on—but I’d love to revisit that one someday.\nFinal Thoughts I didn’t solve everything. But that wasn’t the point. Every challenge was a practical puzzle—something to decode, reverse, bypass, or just understand a little better.\nWorking as a team with Evarist, Nathan, and Waut made it even more valuable. We bounced ideas off each other, divided tasks, and got a much broader set of challenges covered.\nThe Cyber Security Challenge Belgium qualifiers weren’t easy. But they were the best kind of difficult—the kind that teaches you something whether you solve the problem or not.\n","date":"March 15, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/post-2/binexpl_hu_3d36b409c72f3586.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"160\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/post-2\\/binexpl_hu_afca672637b6b98d.png';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-2/","title":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience"},{"categories":null,"contents":"I built my personal blog using Hugo and deployed it on a lightweight Alpine Linux VPS. I chose this setup to have full control, keep things simple, and avoid bloated platforms or services. Here’s how the process went from site generation to live deployment.\nCreating the Hugo Site On my development machine, I created a new Hugo site:\nhugo new site howest-blog I used the professors-hugo theme and copied its exampleSite content into my project. I customized the layout, structure, and styling by editing content files, SCSS in assets/scss/custom.scss, and partial templates in the theme directory.\nAll content lives under content/, with separate folders for blog/ and project/, each containing .md files with front matter and Markdown content.\nCustomization I edited the config/_default/hugo.toml to configure site parameters like the base URL, theme, language, and menus. SCSS and image assets go in assets/, and are processed by Hugo\u0026rsquo;s pipeline. Static files like favicons are placed in static/.\nTo preview the site locally:\nhugo server To build the static site:\nhugo This generates everything in the public/ folder.\nVPS Deployment I rented a minimal Alpine Linux VPS and installed only what I needed. After setting up SSH and a basic nginx web server, I copied the public/ folder over using scp:\nscp -r public/* user@my-vps:/var/www/html On the VPS, I installed nginx:\napk add nginx And configured /etc/nginx/conf.d/default.conf to serve files from /var/www/html. Then I enabled and started nginx:\nrc-service nginx start rc-update add nginx Now my Hugo site is live and served directly as static files—no backend, no database, just HTML, CSS, and JS.\nWhy Alpine + Hugo? Alpine Linux is minimal and fast, perfect for serving static sites with low resource usage. Combined with Hugo’s speed and flexibility, I get a complete, performant setup that I fully control. It’s secure, lightweight, and easy to update—just rebuild and re-upload the public/ folder.\nThis setup is perfect if you want full control and minimal overhead for a personal blog or portfolio.\n","date":"May 29, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-2/","title":"Building My Hugo Website on a VPS"},{"categories":null,"contents":"DRMDTool is an automation-centric utility designed to streamline the processing of .drmd files by tightly integrating with the N_m3u8DL-RE downloader. The tool offers robust automation via a watch folder and an intuitive web-based interface, significantly reducing the friction for managing and processing DRM-protected streaming content.\nWhat’s New DRMDTool has evolved into a comprehensive platform for batch downloading with enhanced support for user interaction and background processing. It features granular job tracking, dynamic download control (pause, resume, abort), and a refined WebSocket-based console for real-time command output. Subtitle handling now includes automatic downloading and conversion from VTT to SRT, and the downloader adapts based on metadata, organizing content into categorized directories.\nGoals and Use Case The primary aim is to automate .drmd file processing with minimal manual input. Users can configure download formats, specify directories, and enable real-time command broadcasting. DRMDTool is suitable for both interactive use through a web UI and headless automation in pipelines, supporting inotify or polling-based folder watching.\nHow .drmd Files Work A .drmd file is a structured JSON document that defines one or more encrypted media items to be processed by DRMDTool. It contains an Items array, with each item representing a specific media job. DRMDTool parses these entries to generate download commands for N_m3u8DL-RE.\nEach item includes:\nMPD: A DASH manifest, either a direct URL or a base64-encoded version. If base64-encoded, DRMDTool decodes and temporarily saves it before use. Keys: A comma-separated list of KID:key pairs (e.g., abcd1234ef567890:00112233445566778899aabbccddeeff). These are required for decrypting encrypted media streams and are passed directly to N_m3u8DL-RE using --key flags. Filename: The name to be used for the final output file. Subtitles: Comma-separated list of subtitle URLs in .vtt format. DRMDTool downloads and converts these to .srt, then muxes them into the final file. Metadata: A semicolon-separated string like Title;Type;Season (e.g., Example Show;serie;1) used to determine directory structure (Movies/Title or Series/Title/Season). Description and Poster: Optional fields used only for display in the web UI. Example .drmd Structure { \u0026#34;Items\u0026#34;: [ { \u0026#34;MPD\u0026#34;: \u0026#34;aHR0cHM6Ly9leGFtcGxlLmNvbS9zdHJlYW0ubXBk\u0026#34;, \u0026#34;Keys\u0026#34;: \u0026#34;abcd1234ef567890:00112233445566778899aabbccddeeff\u0026#34;, \u0026#34;Filename\u0026#34;: \u0026#34;ExampleShow.S01E01\u0026#34;, \u0026#34;Subtitles\u0026#34;: \u0026#34;https://example.com/sub1.vtt,https://example.com/sub2.vtt\u0026#34;, \u0026#34;Metadata\u0026#34;: \u0026#34;Example Show;serie;1\u0026#34;, \u0026#34;Description\u0026#34;: \u0026#34;Pilot episode\u0026#34;, \u0026#34;Poster\u0026#34;: \u0026#34;\u0026#34; } ] } Processing Steps Detection: DRMDTool either watches a folder or receives .drmd uploads through the web UI. Validation: It waits for the file to finish writing (based on file size stability), then parses its contents. MPD Handling: If base64-encoded, the MPD is decoded and written to a temp file; otherwise, the URL is fetched or passed as-is. Command Generation: Using the MPD, KID:key pairs, output paths, and subtitles, DRMDTool builds a command line for N_m3u8DL-RE. Execution: The download is launched with live progress tracking. Users can pause, resume, or abort jobs, and optionally stream console output via WebSocket. These files serve as portable job definitions. When DRMDTool detects or receives a .drmd file, it parses the items, decodes or downloads the MPD, applies the keys, and builds a download command using N_m3u8DL-RE. Files are saved in organized directories like Movies/Title or Series/Title/Season, and subtitles are embedded if available. Pausing, resuming, and aborting downloads is supported per file.\nArchitecture Overview The configuration is handled via config.toml, with environment variable overrides for containerized or dynamic deployments. Once started, the tool can either monitor a specified folder or allow file uploads through the UI. Each .drmd file is parsed, grouped by series and season (if applicable), and processed sequentially with support for job pausing and resuming.\nWeb UI \u0026amp; CLI To use:\n./drmdtool Visit http://localhost:8080 for the web interface, which supports drag-and-drop uploads, selection of episodes or movies, and real-time progress tracking. For headless operation:\n./drmdtool -f /path/to/file.drmd Jobs can be paused, resumed, or aborted through the web interface, which reflects the backend state via live updates.\nEnhanced Download Logic DRMDTool dynamically builds download commands using metadata from .drmd files and user preferences. It ensures that only the highest quality streams are kept, removing ad periods and duplicate segments from the MPD files. Subtitles are fetched and embedded automatically. Jobs are tracked with robust state management and logs for debugging and visibility.\nRepository Code and setup instructions are hosted here: https://git.directme.in/Joren/DRMDTool\nDRMDtool For advanced usage details, customization, and API structure, refer to the README.md in the repository.\nUI Previews Index Page Select Page Progress Page ","date":"May 21, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-1/","title":"DRMDTool Project"},{"categories":["cybersecurity","event recap"],"contents":"Cyber Defence on the Digital Frontline: A Mission with NATO On a Mission with NATO: Cyber Defence on the Frontline Howest’s ongoing commitment to world-class cybersecurity training took center stage again as six lecturers from the Cyber Security program joined forces with experts from Latvia, Luxembourg and Belgium in one of NATO\u0026rsquo;s most intensive simulations: the Locked Shields exercise, hosted by the Cooperative Cyber Defence Centre of Excellence (CCDCOE). Now in its fifth year of participation, the Howest team shared their firsthand experiences at a special evening talk at Howest Bruges.\nThe Exercise: Locked Shields Locked Shields is no ordinary simulation. It is a full-scale, live-fire cyber defence exercise involving more than 6,000 machines and a narrative scenario so detailed it includes geopolitics, disinformation and even fictional countries. This year, the Blue Team 03 (our team) defended a simulated nation’s critical infrastructure including power plants, satellites, 5G networks and banking systems, all while under constant attack from a coordinated Red Team using automated scripts and over 28,000 attacks across two days.\nAnd yes, every team (Red, Blue, Yellow, White) uses Ansible. For everything.\nHigh Stakes, Real Lessons What do you do when a rogue process might be malware, or maybe just a poorly named service? What happens when your teammate refuses to act unless something is “officially malicious”? The team faced cultural clashes, communication breakdowns and stress-testing of both systems and people.\nThe exercise required more than technical fixes. It demanded communication with simulated commanders, media and public stakeholders. Reporting became just as important as patching. It taught participants how to translate technical impact into real-world consequences. Not \u0026ldquo;port 8443 unreachable\u0026rdquo;, but \u0026ldquo;our air defence system is degraded, and we cannot fly planes\u0026rdquo;.\nThe Black Team: Rapid Response in Action A new but powerful presence in the simulation was the Black Team, a rapid-response unit deployed when problems became too complex for any single team. Acting like special forces, they jumped in when incidents crossed team boundaries or demanded unconventional solutions. Their mission was to find out what was happening, assess the impact and suggest fast, creative responses. Introduced just last year, this team quickly proved its value again in 2025. They even embraced the role with style — “you can wear sunglasses inside” became their unofficial motto.\nTheir presence underlined a critical lesson: not every problem fits neatly within a team’s silo. Real-world defence requires flexibility, speed and lateral thinking.\nHighlights and Blooper Reel There were plenty of mishaps. Misfired scripts, team mix-ups, and one case where a DNS setup from a previous year was reused by mistake. Someone tried renaming cut to shutdown, breaking essential operations until it was fixed. Systems rebooted into chaos, a manual was uploaded to public GitHub, and the team had to quickly learn the difference between symbolic links and real binaries.\nHuman Factors and Growth From detecting malware with Velociraptor and Q9, to encountering teammates who took orders literally, the learning was intense. One participant noted that while Belgian and Luxembourg teams prioritized knowledge sharing, others preferred strict protocol. This highlighted cultural differences and the importance of interpersonal skills.\nThe biggest lesson? You are never fully prepared. Every iteration of Locked Shields is different. But each one sharpens not only your skills, but also your ability to function as a team under extreme conditions.\nFrom the Battlefield to the Classroom This experience directly impacts the classroom. Inspired by the exercise, Howest is introducing new hands-on courses like “Glutamine” in semester five. Students will be dropped into realistic broken networks, with misconfigurations, fake firewalls and simulated threats. It is chaos, but controlled. And that is the point.\nAs one speaker said: “You don’t win Locked Shields. You just survive it better than the rest.”\nFinal Thoughts The exercise teaches more than just cybersecurity. It builds trust. It proves that knowing your teammates can be as important as knowing the tools. Whether that comes from a shared flight or a pre-exercise barbecue, it all matters when the pressure hits.\nWant to see how cyber defence works in real life? This is it.\n","date":"May 13, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog-1_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog-1_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-1/","title":"Cyber Defence on the Digital Frontline: A Mission with NATO"},{"categories":["cybersecurity","CTF","education"],"contents":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience On March 14 and 15, I joined the Cyber Security Challenge Belgium qualifiers with three teammates. For two days, we threw ourselves at CTF challenges covering binary exploitation, Android reversing, cryptography, and more.\nWhat follows is a recap of the challenges I personally worked on—some I solved, some I didn’t—but all of them left me with new skills and new ideas.\nA Buffer Overflow to Warm Up One of the first challenges I picked involved a binary with a basic stack overflow. I used standard techniques—finding the offset, hijacking the return address, and injecting shellcode. Tools like pwntools helped automate the payload crafting. It was a great warm-up and a confidence boost once it worked.\nCryptography and Pattern Matching Another crypto puzzle asked us to match a generated ASCII art banner to its underlying seed. Once I understood how the randomness was embedded into the banner, I brute-forced the space with a simple pattern-matching script. The exercise was clean, deterministic, and satisfying to solve.\nOurEncIsSec: Zip Bombs and OEIS Then there was a more elaborate cryptography challenge: 18 zip files, each password-protected. We cracked the first three passwords using John the Ripper and got numeric values from them. I searched the sequence in OEIS and found it matched A007408, which gave us the full pattern of passwords.\nUsing this, I could extract all zip contents automatically, reconstruct the password-protected message, and finally reveal the flag.\nInfinite Luck: One in a Million? One challenge involved “guessing” a thousand random numbers between 1 and 10. The banner claimed it required infinite luck—but of course, the randomness was seeded. After inspecting the generator, I realized it was deterministic. By precomputing seeds and output sequences, I could match the challenge’s banner to a specific seed and regenerate the entire solution.\nAndroid Reversing: FRIDA and JADX Several APKs were part of the qualifier set. I used JADX to decompile them and FRIDA to patch logic at runtime. In one challenge, I bypassed license validation by forcing key methods to return true and unlocking hidden functionality.\nThe Challenge That Stuck with Me: Rebuilding a Split DEX This one stood out.\nThe app used a 4×8 button grid. Pressing buttons loaded a sequence of blockXX files from assets. These were concatenated in-memory and passed into InMemoryDexClassLoader to load a class called be.dauntless.flag.Flag.\nClass loadClass = new InMemoryDexClassLoader(ByteBuffer.wrap(byteArrayOutputStream.toByteArray()), getClassLoader()) .loadClass(\u0026#34;be.dauntless.flag.Flag\u0026#34;); Each block was a fragment of a DEX file, but the app didn’t tell you the right order. I tried manually inspecting the fragments—identifying methods, string constants, and offsets—to infer how to reassemble the full file. I got close, but didn’t crack it in time.\nThat challenge stuck with me because it combined static analysis, runtime introspection, and logic reconstruction. It wasn’t just technical—it was creative.\nThe One That Got Away: TLS Fingerprinting Another challenge involved a Go-based TLS server that rejected all client connections unless they matched a specific fingerprint. I used Go’s tls.Config to replicate the version, cipher suites, and ALPN:\ntls.Config{ MinVersion: tls.VersionTLS13, CipherSuites: []uint16{ tls.TLS_AES_128_GCM_SHA256, // ... }, NextProtos: []string{\u0026#34;h2\u0026#34;}, } Despite that, the server still refused the connection. I suspect it was using JA4 or similar TLS fingerprinting techniques we couldn’t fully emulate. We had to move on—but I’d love to revisit that one someday.\nFinal Thoughts I didn’t solve everything. But that wasn’t the point. Every challenge was a practical puzzle—something to decode, reverse, bypass, or just understand a little better.\nWorking as a team with Evarist, Nathan, and Waut made it even more valuable. We bounced ideas off each other, divided tasks, and got a much broader set of challenges covered.\nThe Cyber Security Challenge Belgium qualifiers weren’t easy. But they were the best kind of difficult—the kind that teaches you something whether you solve the problem or not.\n","date":"March 15, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/post-2/binexpl_hu_3d36b409c72f3586.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"160\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/post-2\\/binexpl_hu_afca672637b6b98d.png';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-2/","title":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience"},{"categories":null,"contents":"I built my personal blog using Hugo and deployed it on a lightweight Alpine Linux VPS. I chose this setup to have full control, keep things simple, and avoid bloated platforms or services. Here’s how the process went from site generation to live deployment.\nCreating the Hugo Site On my development machine, I created a new Hugo site:\nhugo new site howest-blog I used the professors-hugo theme and copied its exampleSite content into my project. I customized the layout, structure, and styling by editing content files, SCSS in assets/scss/custom.scss, and partial templates in the theme directory.\nAll content lives under content/, with separate folders for blog/ and project/, each containing .md files with front matter and Markdown content.\nCustomization I edited the config/_default/hugo.toml to configure site parameters like the base URL, theme, language, and menus. SCSS and image assets go in assets/, and are processed by Hugo\u0026rsquo;s pipeline. Static files like favicons are placed in static/.\nTo preview the site locally:\nhugo server To build the static site:\nhugo This generates everything in the public/ folder.\nVPS Deployment I rented a minimal Alpine Linux VPS and installed only what I needed. After setting up SSH and a basic nginx web server, I copied the public/ folder over using scp:\nscp -r public/* user@my-vps:/var/www/html On the VPS, I installed nginx:\napk add nginx And configured /etc/nginx/conf.d/default.conf to serve files from /var/www/html. Then I enabled and started nginx:\nrc-service nginx start rc-update add nginx Now my Hugo site is live and served directly as static files—no backend, no database, just HTML, CSS, and JS.\nWhy Alpine + Hugo? Alpine Linux is minimal and fast, perfect for serving static sites with low resource usage. Combined with Hugo’s speed and flexibility, I get a complete, performant setup that I fully control. It’s secure, lightweight, and easy to update—just rebuild and re-upload the public/ folder.\nThis setup is perfect if you want full control and minimal overhead for a personal blog or portfolio.\n","date":"May 29, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-2/","title":"Building My Hugo Website on a VPS"},{"categories":null,"contents":"DRMDTool is an automation-centric utility designed to streamline the processing of .drmd files by tightly integrating with the N_m3u8DL-RE downloader. The tool offers robust automation via a watch folder and an intuitive web-based interface, significantly reducing the friction for managing and processing DRM-protected streaming content.\nWhat’s New DRMDTool has evolved into a comprehensive platform for batch downloading with enhanced support for user interaction and background processing. It features granular job tracking, dynamic download control (pause, resume, abort), and a refined WebSocket-based console for real-time command output. Subtitle handling now includes automatic downloading and conversion from VTT to SRT, and the downloader adapts based on metadata, organizing content into categorized directories.\nGoals and Use Case The primary aim is to automate .drmd file processing with minimal manual input. Users can configure download formats, specify directories, and enable real-time command broadcasting. DRMDTool is suitable for both interactive use through a web UI and headless automation in pipelines, supporting inotify or polling-based folder watching.\nHow .drmd Files Work A .drmd file is a structured JSON document that defines one or more encrypted media items to be processed by DRMDTool. It contains an Items array, with each item representing a specific media job. DRMDTool parses these entries to generate download commands for N_m3u8DL-RE.\nEach item includes:\nMPD: A DASH manifest, either a direct URL or a base64-encoded version. If base64-encoded, DRMDTool decodes and temporarily saves it before use. Keys: A comma-separated list of KID:key pairs (e.g., abcd1234ef567890:00112233445566778899aabbccddeeff). These are required for decrypting encrypted media streams and are passed directly to N_m3u8DL-RE using --key flags. Filename: The name to be used for the final output file. Subtitles: Comma-separated list of subtitle URLs in .vtt format. DRMDTool downloads and converts these to .srt, then muxes them into the final file. Metadata: A semicolon-separated string like Title;Type;Season (e.g., Example Show;serie;1) used to determine directory structure (Movies/Title or Series/Title/Season). Description and Poster: Optional fields used only for display in the web UI. Example .drmd Structure { \u0026#34;Items\u0026#34;: [ { \u0026#34;MPD\u0026#34;: \u0026#34;aHR0cHM6Ly9leGFtcGxlLmNvbS9zdHJlYW0ubXBk\u0026#34;, \u0026#34;Keys\u0026#34;: \u0026#34;abcd1234ef567890:00112233445566778899aabbccddeeff\u0026#34;, \u0026#34;Filename\u0026#34;: \u0026#34;ExampleShow.S01E01\u0026#34;, \u0026#34;Subtitles\u0026#34;: \u0026#34;https://example.com/sub1.vtt,https://example.com/sub2.vtt\u0026#34;, \u0026#34;Metadata\u0026#34;: \u0026#34;Example Show;serie;1\u0026#34;, \u0026#34;Description\u0026#34;: \u0026#34;Pilot episode\u0026#34;, \u0026#34;Poster\u0026#34;: \u0026#34;\u0026#34; } ] } Processing Steps Detection: DRMDTool either watches a folder or receives .drmd uploads through the web UI. Validation: It waits for the file to finish writing (based on file size stability), then parses its contents. MPD Handling: If base64-encoded, the MPD is decoded and written to a temp file; otherwise, the URL is fetched or passed as-is. Command Generation: Using the MPD, KID:key pairs, output paths, and subtitles, DRMDTool builds a command line for N_m3u8DL-RE. Execution: The download is launched with live progress tracking. Users can pause, resume, or abort jobs, and optionally stream console output via WebSocket. These files serve as portable job definitions. When DRMDTool detects or receives a .drmd file, it parses the items, decodes or downloads the MPD, applies the keys, and builds a download command using N_m3u8DL-RE. Files are saved in organized directories like Movies/Title or Series/Title/Season, and subtitles are embedded if available. Pausing, resuming, and aborting downloads is supported per file.\nArchitecture Overview The configuration is handled via config.toml, with environment variable overrides for containerized or dynamic deployments. Once started, the tool can either monitor a specified folder or allow file uploads through the UI. Each .drmd file is parsed, grouped by series and season (if applicable), and processed sequentially with support for job pausing and resuming.\nWeb UI \u0026amp; CLI To use:\n./drmdtool Visit http://localhost:8080 for the web interface, which supports drag-and-drop uploads, selection of episodes or movies, and real-time progress tracking. For headless operation:\n./drmdtool -f /path/to/file.drmd Jobs can be paused, resumed, or aborted through the web interface, which reflects the backend state via live updates.\nEnhanced Download Logic DRMDTool dynamically builds download commands using metadata from .drmd files and user preferences. It ensures that only the highest quality streams are kept, removing ad periods and duplicate segments from the MPD files. Subtitles are fetched and embedded automatically. Jobs are tracked with robust state management and logs for debugging and visibility.\nRepository Code and setup instructions are hosted here: https://git.directme.in/Joren/DRMDTool\nDRMDtool For advanced usage details, customization, and API structure, refer to the README.md in the repository.\nUI Previews Index Page Select Page Progress Page ","date":"May 21, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-1/","title":"DRMDTool Project"},{"categories":["cybersecurity","event recap"],"contents":"Cyber Defence on the Digital Frontline: A Mission with NATO On a Mission with NATO: Cyber Defence on the Frontline Howest’s ongoing commitment to world-class cybersecurity training took center stage again as six lecturers from the Cyber Security program joined forces with experts from Latvia, Luxembourg and Belgium in one of NATO\u0026rsquo;s most intensive simulations: the Locked Shields exercise, hosted by the Cooperative Cyber Defence Centre of Excellence (CCDCOE). Now in its fifth year of participation, the Howest team shared their firsthand experiences at a special evening talk at Howest Bruges.\nThe Exercise: Locked Shields Locked Shields is no ordinary simulation. It is a full-scale, live-fire cyber defence exercise involving more than 6,000 machines and a narrative scenario so detailed it includes geopolitics, disinformation and even fictional countries. This year, the Blue Team 03 (our team) defended a simulated nation’s critical infrastructure including power plants, satellites, 5G networks and banking systems, all while under constant attack from a coordinated Red Team using automated scripts and over 28,000 attacks across two days.\nAnd yes, every team (Red, Blue, Yellow, White) uses Ansible. For everything.\nHigh Stakes, Real Lessons What do you do when a rogue process might be malware, or maybe just a poorly named service? What happens when your teammate refuses to act unless something is “officially malicious”? The team faced cultural clashes, communication breakdowns and stress-testing of both systems and people.\nThe exercise required more than technical fixes. It demanded communication with simulated commanders, media and public stakeholders. Reporting became just as important as patching. It taught participants how to translate technical impact into real-world consequences. Not \u0026ldquo;port 8443 unreachable\u0026rdquo;, but \u0026ldquo;our air defence system is degraded, and we cannot fly planes\u0026rdquo;.\nThe Black Team: Rapid Response in Action A new but powerful presence in the simulation was the Black Team, a rapid-response unit deployed when problems became too complex for any single team. Acting like special forces, they jumped in when incidents crossed team boundaries or demanded unconventional solutions. Their mission was to find out what was happening, assess the impact and suggest fast, creative responses. Introduced just last year, this team quickly proved its value again in 2025. They even embraced the role with style — “you can wear sunglasses inside” became their unofficial motto.\nTheir presence underlined a critical lesson: not every problem fits neatly within a team’s silo. Real-world defence requires flexibility, speed and lateral thinking.\nHighlights and Blooper Reel There were plenty of mishaps. Misfired scripts, team mix-ups, and one case where a DNS setup from a previous year was reused by mistake. Someone tried renaming cut to shutdown, breaking essential operations until it was fixed. Systems rebooted into chaos, a manual was uploaded to public GitHub, and the team had to quickly learn the difference between symbolic links and real binaries.\nHuman Factors and Growth From detecting malware with Velociraptor and Q9, to encountering teammates who took orders literally, the learning was intense. One participant noted that while Belgian and Luxembourg teams prioritized knowledge sharing, others preferred strict protocol. This highlighted cultural differences and the importance of interpersonal skills.\nThe biggest lesson? You are never fully prepared. Every iteration of Locked Shields is different. But each one sharpens not only your skills, but also your ability to function as a team under extreme conditions.\nFrom the Battlefield to the Classroom This experience directly impacts the classroom. Inspired by the exercise, Howest is introducing new hands-on courses like “Glutamine” in semester five. Students will be dropped into realistic broken networks, with misconfigurations, fake firewalls and simulated threats. It is chaos, but controlled. And that is the point.\nAs one speaker said: “You don’t win Locked Shields. You just survive it better than the rest.”\nFinal Thoughts The exercise teaches more than just cybersecurity. It builds trust. It proves that knowing your teammates can be as important as knowing the tools. Whether that comes from a shared flight or a pre-exercise barbecue, it all matters when the pressure hits.\nWant to see how cyber defence works in real life? This is it.\n","date":"May 13, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog-1_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog-1_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-1/","title":"Cyber Defence on the Digital Frontline: A Mission with NATO"},{"categories":["cybersecurity","CTF","education"],"contents":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience On March 14 and 15, I joined the Cyber Security Challenge Belgium qualifiers with three teammates. For two days, we threw ourselves at CTF challenges covering binary exploitation, Android reversing, cryptography, and more.\nWhat follows is a recap of the challenges I personally worked on—some I solved, some I didn’t—but all of them left me with new skills and new ideas.\nA Buffer Overflow to Warm Up One of the first challenges I picked involved a binary with a basic stack overflow. I used standard techniques—finding the offset, hijacking the return address, and injecting shellcode. Tools like pwntools helped automate the payload crafting. It was a great warm-up and a confidence boost once it worked.\nCryptography and Pattern Matching Another crypto puzzle asked us to match a generated ASCII art banner to its underlying seed. Once I understood how the randomness was embedded into the banner, I brute-forced the space with a simple pattern-matching script. The exercise was clean, deterministic, and satisfying to solve.\nOurEncIsSec: Zip Bombs and OEIS Then there was a more elaborate cryptography challenge: 18 zip files, each password-protected. We cracked the first three passwords using John the Ripper and got numeric values from them. I searched the sequence in OEIS and found it matched A007408, which gave us the full pattern of passwords.\nUsing this, I could extract all zip contents automatically, reconstruct the password-protected message, and finally reveal the flag.\nan image caption\rInfinite Luck: One in a Million? One challenge involved “guessing” a thousand random numbers between 1 and 10. The banner claimed it required infinite luck—but of course, the randomness was seeded. After inspecting the generator, I realized it was deterministic. By precomputing seeds and output sequences, I could match the challenge’s banner to a specific seed and regenerate the entire solution.\nAndroid Reversing: FRIDA and JADX Several APKs were part of the qualifier set. I used JADX to decompile them and FRIDA to patch logic at runtime. In one challenge, I bypassed license validation by forcing key methods to return true and unlocking hidden functionality.\nThe Challenge That Stuck with Me: Rebuilding a Split DEX This one stood out.\nThe app used a 4×8 button grid. Pressing buttons loaded a sequence of blockXX files from assets. These were concatenated in-memory and passed into InMemoryDexClassLoader to load a class called be.dauntless.flag.Flag.\nClass loadClass = new InMemoryDexClassLoader(ByteBuffer.wrap(byteArrayOutputStream.toByteArray()), getClassLoader()) .loadClass(\u0026#34;be.dauntless.flag.Flag\u0026#34;); Each block was a fragment of a DEX file, but the app didn’t tell you the right order. I tried manually inspecting the fragments—identifying methods, string constants, and offsets—to infer how to reassemble the full file. I got close, but didn’t crack it in time.\nThat challenge stuck with me because it combined static analysis, runtime introspection, and logic reconstruction. It wasn’t just technical—it was creative.\nThe One That Got Away: TLS Fingerprinting Another challenge involved a Go-based TLS server that rejected all client connections unless they matched a specific fingerprint. I used Go’s tls.Config to replicate the version, cipher suites, and ALPN:\ntls.Config{ MinVersion: tls.VersionTLS13, CipherSuites: []uint16{ tls.TLS_AES_128_GCM_SHA256, // ... }, NextProtos: []string{\u0026#34;h2\u0026#34;}, } Despite that, the server still refused the connection. I suspect it was using JA4 or similar TLS fingerprinting techniques we couldn’t fully emulate. We had to move on—but I’d love to revisit that one someday.\nFinal Thoughts I didn’t solve everything. But that wasn’t the point. Every challenge was a practical puzzle—something to decode, reverse, bypass, or just understand a little better.\nWorking as a team with Evarist, Nathan, and Waut made it even more valuable. We bounced ideas off each other, divided tasks, and got a much broader set of challenges covered.\nThe Cyber Security Challenge Belgium qualifiers weren’t easy. But they were the best kind of difficult—the kind that teaches you something whether you solve the problem or not.\n","date":"March 15, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/post-2/binexpl_hu_3d36b409c72f3586.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"160\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/post-2\\/binexpl_hu_afca672637b6b98d.png';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-2/","title":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience"},{"categories":null,"contents":"I built my personal blog using Hugo and deployed it on a lightweight Alpine Linux VPS. I chose this setup to have full control, keep things simple, and avoid bloated platforms or services. Here’s how the process went from site generation to live deployment.\nCreating the Hugo Site On my development machine, I created a new Hugo site:\nhugo new site howest-blog I used the professors-hugo theme and copied its exampleSite content into my project. I customized the layout, structure, and styling by editing content files, SCSS in assets/scss/custom.scss, and partial templates in the theme directory.\nAll content lives under content/, with separate folders for blog/ and project/, each containing .md files with front matter and Markdown content.\nCustomization I edited the config/_default/hugo.toml to configure site parameters like the base URL, theme, language, and menus. SCSS and image assets go in assets/, and are processed by Hugo\u0026rsquo;s pipeline. Static files like favicons are placed in static/.\nTo preview the site locally:\nhugo server To build the static site:\nhugo This generates everything in the public/ folder.\nVPS Deployment I rented a minimal Alpine Linux VPS and installed only what I needed. After setting up SSH and a basic nginx web server, I copied the public/ folder over using scp:\nscp -r public/* user@my-vps:/var/www/html On the VPS, I installed nginx:\napk add nginx And configured /etc/nginx/conf.d/default.conf to serve files from /var/www/html. Then I enabled and started nginx:\nrc-service nginx start rc-update add nginx Now my Hugo site is live and served directly as static files—no backend, no database, just HTML, CSS, and JS.\nWhy Alpine + Hugo? Alpine Linux is minimal and fast, perfect for serving static sites with low resource usage. Combined with Hugo’s speed and flexibility, I get a complete, performant setup that I fully control. It’s secure, lightweight, and easy to update—just rebuild and re-upload the public/ folder.\nThis setup is perfect if you want full control and minimal overhead for a personal blog or portfolio.\n","date":"May 29, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-2/","title":"Building My Hugo Website on a VPS"},{"categories":null,"contents":"DRMDTool is an automation-centric utility designed to streamline the processing of .drmd files by tightly integrating with the N_m3u8DL-RE downloader. The tool offers robust automation via a watch folder and an intuitive web-based interface, significantly reducing the friction for managing and processing DRM-protected streaming content.\nWhat’s New DRMDTool has evolved into a comprehensive platform for batch downloading with enhanced support for user interaction and background processing. It features granular job tracking, dynamic download control (pause, resume, abort), and a refined WebSocket-based console for real-time command output. Subtitle handling now includes automatic downloading and conversion from VTT to SRT, and the downloader adapts based on metadata, organizing content into categorized directories.\nGoals and Use Case The primary aim is to automate .drmd file processing with minimal manual input. Users can configure download formats, specify directories, and enable real-time command broadcasting. DRMDTool is suitable for both interactive use through a web UI and headless automation in pipelines, supporting inotify or polling-based folder watching.\nHow .drmd Files Work A .drmd file is a structured JSON document that defines one or more encrypted media items to be processed by DRMDTool. It contains an Items array, with each item representing a specific media job. DRMDTool parses these entries to generate download commands for N_m3u8DL-RE.\nEach item includes:\nMPD: A DASH manifest, either a direct URL or a base64-encoded version. If base64-encoded, DRMDTool decodes and temporarily saves it before use. Keys: A comma-separated list of KID:key pairs (e.g., abcd1234ef567890:00112233445566778899aabbccddeeff). These are required for decrypting encrypted media streams and are passed directly to N_m3u8DL-RE using --key flags. Filename: The name to be used for the final output file. Subtitles: Comma-separated list of subtitle URLs in .vtt format. DRMDTool downloads and converts these to .srt, then muxes them into the final file. Metadata: A semicolon-separated string like Title;Type;Season (e.g., Example Show;serie;1) used to determine directory structure (Movies/Title or Series/Title/Season). Description and Poster: Optional fields used only for display in the web UI. Example .drmd Structure { \u0026#34;Items\u0026#34;: [ { \u0026#34;MPD\u0026#34;: \u0026#34;aHR0cHM6Ly9leGFtcGxlLmNvbS9zdHJlYW0ubXBk\u0026#34;, \u0026#34;Keys\u0026#34;: \u0026#34;abcd1234ef567890:00112233445566778899aabbccddeeff\u0026#34;, \u0026#34;Filename\u0026#34;: \u0026#34;ExampleShow.S01E01\u0026#34;, \u0026#34;Subtitles\u0026#34;: \u0026#34;https://example.com/sub1.vtt,https://example.com/sub2.vtt\u0026#34;, \u0026#34;Metadata\u0026#34;: \u0026#34;Example Show;serie;1\u0026#34;, \u0026#34;Description\u0026#34;: \u0026#34;Pilot episode\u0026#34;, \u0026#34;Poster\u0026#34;: \u0026#34;\u0026#34; } ] } Processing Steps Detection: DRMDTool either watches a folder or receives .drmd uploads through the web UI. Validation: It waits for the file to finish writing (based on file size stability), then parses its contents. MPD Handling: If base64-encoded, the MPD is decoded and written to a temp file; otherwise, the URL is fetched or passed as-is. Command Generation: Using the MPD, KID:key pairs, output paths, and subtitles, DRMDTool builds a command line for N_m3u8DL-RE. Execution: The download is launched with live progress tracking. Users can pause, resume, or abort jobs, and optionally stream console output via WebSocket. These files serve as portable job definitions. When DRMDTool detects or receives a .drmd file, it parses the items, decodes or downloads the MPD, applies the keys, and builds a download command using N_m3u8DL-RE. Files are saved in organized directories like Movies/Title or Series/Title/Season, and subtitles are embedded if available. Pausing, resuming, and aborting downloads is supported per file.\nArchitecture Overview The configuration is handled via config.toml, with environment variable overrides for containerized or dynamic deployments. Once started, the tool can either monitor a specified folder or allow file uploads through the UI. Each .drmd file is parsed, grouped by series and season (if applicable), and processed sequentially with support for job pausing and resuming.\nWeb UI \u0026amp; CLI To use:\n./drmdtool Visit http://localhost:8080 for the web interface, which supports drag-and-drop uploads, selection of episodes or movies, and real-time progress tracking. For headless operation:\n./drmdtool -f /path/to/file.drmd Jobs can be paused, resumed, or aborted through the web interface, which reflects the backend state via live updates.\nEnhanced Download Logic DRMDTool dynamically builds download commands using metadata from .drmd files and user preferences. It ensures that only the highest quality streams are kept, removing ad periods and duplicate segments from the MPD files. Subtitles are fetched and embedded automatically. Jobs are tracked with robust state management and logs for debugging and visibility.\nRepository Code and setup instructions are hosted here: https://git.directme.in/Joren/DRMDTool\nDRMDtool For advanced usage details, customization, and API structure, refer to the README.md in the repository.\nUI Previews Index Page Select Page Progress Page ","date":"May 21, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-1/","title":"DRMDTool Project"},{"categories":["cybersecurity","event recap"],"contents":"Cyber Defence on the Digital Frontline: A Mission with NATO On a Mission with NATO: Cyber Defence on the Frontline Howest’s ongoing commitment to world-class cybersecurity training took center stage again as six lecturers from the Cyber Security program joined forces with experts from Latvia, Luxembourg and Belgium in one of NATO\u0026rsquo;s most intensive simulations: the Locked Shields exercise, hosted by the Cooperative Cyber Defence Centre of Excellence (CCDCOE). Now in its fifth year of participation, the Howest team shared their firsthand experiences at a special evening talk at Howest Bruges.\nThe Exercise: Locked Shields Locked Shields is no ordinary simulation. It is a full-scale, live-fire cyber defence exercise involving more than 6,000 machines and a narrative scenario so detailed it includes geopolitics, disinformation and even fictional countries. This year, the Blue Team 03 (our team) defended a simulated nation’s critical infrastructure including power plants, satellites, 5G networks and banking systems, all while under constant attack from a coordinated Red Team using automated scripts and over 28,000 attacks across two days.\nAnd yes, every team (Red, Blue, Yellow, White) uses Ansible. For everything.\nHigh Stakes, Real Lessons What do you do when a rogue process might be malware, or maybe just a poorly named service? What happens when your teammate refuses to act unless something is “officially malicious”? The team faced cultural clashes, communication breakdowns and stress-testing of both systems and people.\nThe exercise required more than technical fixes. It demanded communication with simulated commanders, media and public stakeholders. Reporting became just as important as patching. It taught participants how to translate technical impact into real-world consequences. Not \u0026ldquo;port 8443 unreachable\u0026rdquo;, but \u0026ldquo;our air defence system is degraded, and we cannot fly planes\u0026rdquo;.\nThe Black Team: Rapid Response in Action A new but powerful presence in the simulation was the Black Team, a rapid-response unit deployed when problems became too complex for any single team. Acting like special forces, they jumped in when incidents crossed team boundaries or demanded unconventional solutions. Their mission was to find out what was happening, assess the impact and suggest fast, creative responses. Introduced just last year, this team quickly proved its value again in 2025. They even embraced the role with style — “you can wear sunglasses inside” became their unofficial motto.\nTheir presence underlined a critical lesson: not every problem fits neatly within a team’s silo. Real-world defence requires flexibility, speed and lateral thinking.\nHighlights and Blooper Reel There were plenty of mishaps. Misfired scripts, team mix-ups, and one case where a DNS setup from a previous year was reused by mistake. Someone tried renaming cut to shutdown, breaking essential operations until it was fixed. Systems rebooted into chaos, a manual was uploaded to public GitHub, and the team had to quickly learn the difference between symbolic links and real binaries.\nHuman Factors and Growth From detecting malware with Velociraptor and Q9, to encountering teammates who took orders literally, the learning was intense. One participant noted that while Belgian and Luxembourg teams prioritized knowledge sharing, others preferred strict protocol. This highlighted cultural differences and the importance of interpersonal skills.\nThe biggest lesson? You are never fully prepared. Every iteration of Locked Shields is different. But each one sharpens not only your skills, but also your ability to function as a team under extreme conditions.\nFrom the Battlefield to the Classroom This experience directly impacts the classroom. Inspired by the exercise, Howest is introducing new hands-on courses like “Glutamine” in semester five. Students will be dropped into realistic broken networks, with misconfigurations, fake firewalls and simulated threats. It is chaos, but controlled. And that is the point.\nAs one speaker said: “You don’t win Locked Shields. You just survive it better than the rest.”\nFinal Thoughts The exercise teaches more than just cybersecurity. It builds trust. It proves that knowing your teammates can be as important as knowing the tools. Whether that comes from a shared flight or a pre-exercise barbecue, it all matters when the pressure hits.\nWant to see how cyber defence works in real life? This is it.\n","date":"May 13, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog-1_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog-1_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-1/","title":"Cyber Defence on the Digital Frontline: A Mission with NATO"},{"categories":["cybersecurity","CTF","education"],"contents":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience On March 14 and 15, I joined the Cyber Security Challenge Belgium qualifiers with three teammates. For two days, we threw ourselves at CTF challenges covering binary exploitation, Android reversing, cryptography, and more.\nWhat follows is a recap of the challenges I personally worked on—some I solved, some I didn’t—but all of them left me with new skills and new ideas.\nA Buffer Overflow to Warm Up One of the first challenges I picked involved a binary with a basic stack overflow. I used standard techniques—finding the offset, hijacking the return address, and injecting shellcode. Tools like pwntools helped automate the payload crafting. It was a great warm-up and a confidence boost once it worked.\nhttp://192.168.90.54:1313/images/blog/blog1/binexpl.png does not exist\rCryptography and Pattern Matching Another crypto puzzle asked us to match a generated ASCII art banner to its underlying seed. Once I understood how the randomness was embedded into the banner, I brute-forced the space with a simple pattern-matching script. The exercise was clean, deterministic, and satisfying to solve.\nOurEncIsSec: Zip Bombs and OEIS Then there was a more elaborate cryptography challenge: 18 zip files, each password-protected. We cracked the first three passwords using John the Ripper and got numeric values from them. I searched the sequence in OEIS and found it matched A007408, which gave us the full pattern of passwords.\nUsing this, I could extract all zip contents automatically, reconstruct the password-protected message, and finally reveal the flag.\nOurEncIsSec Screenshot\rInfinite Luck: One in a Million? One challenge involved “guessing” a thousand random numbers between 1 and 10. The banner claimed it required infinite luck—but of course, the randomness was seeded. After inspecting the generator, I realized it was deterministic. By precomputing seeds and output sequences, I could match the challenge’s banner to a specific seed and regenerate the entire solution.\nAndroid Reversing: FRIDA and JADX Several APKs were part of the qualifier set. I used JADX to decompile them and FRIDA to patch logic at runtime. In one challenge, I bypassed license validation by forcing key methods to return true and unlocking hidden functionality.\nThe Challenge That Stuck with Me: Rebuilding a Split DEX This one stood out.\nThe app used a 4×8 button grid. Pressing buttons loaded a sequence of blockXX files from assets. These were concatenated in-memory and passed into InMemoryDexClassLoader to load a class called be.dauntless.flag.Flag.\nClass loadClass = new InMemoryDexClassLoader(ByteBuffer.wrap(byteArrayOutputStream.toByteArray()), getClassLoader()) .loadClass(\u0026#34;be.dauntless.flag.Flag\u0026#34;); Each block was a fragment of a DEX file, but the app didn’t tell you the right order. I tried manually inspecting the fragments—identifying methods, string constants, and offsets—to infer how to reassemble the full file. I got close, but didn’t crack it in time.\nThat challenge stuck with me because it combined static analysis, runtime introspection, and logic reconstruction. It wasn’t just technical—it was creative.\nThe One That Got Away: TLS Fingerprinting Another challenge involved a Go-based TLS server that rejected all client connections unless they matched a specific fingerprint. I used Go’s tls.Config to replicate the version, cipher suites, and ALPN:\ntls.Config{ MinVersion: tls.VersionTLS13, CipherSuites: []uint16{ tls.TLS_AES_128_GCM_SHA256, // ... }, NextProtos: []string{\u0026#34;h2\u0026#34;}, } Despite that, the server still refused the connection. I suspect it was using JA4 or similar TLS fingerprinting techniques we couldn’t fully emulate. We had to move on—but I’d love to revisit that one someday.\nFinal Thoughts I didn’t solve everything. But that wasn’t the point. Every challenge was a practical puzzle—something to decode, reverse, bypass, or just understand a little better.\nWorking as a team with Evarist, Nathan, and Waut made it even more valuable. We bounced ideas off each other, divided tasks, and got a much broader set of challenges covered.\nThe Cyber Security Challenge Belgium qualifiers weren’t easy. But they were the best kind of difficult—the kind that teaches you something whether you solve the problem or not.\n","date":"March 15, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/post-2/binexpl_hu_3d36b409c72f3586.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"160\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/post-2\\/binexpl_hu_afca672637b6b98d.png';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-2/","title":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience"},{"categories":null,"contents":"I built my personal blog using Hugo and deployed it on a lightweight Alpine Linux VPS. I chose this setup to have full control, keep things simple, and avoid bloated platforms or services. Here’s how the process went from site generation to live deployment.\nCreating the Hugo Site On my development machine, I created a new Hugo site:\nhugo new site howest-blog I used the professors-hugo theme and copied its exampleSite content into my project. I customized the layout, structure, and styling by editing content files, SCSS in assets/scss/custom.scss, and partial templates in the theme directory.\nAll content lives under content/, with separate folders for blog/ and project/, each containing .md files with front matter and Markdown content.\nCustomization I edited the config/_default/hugo.toml to configure site parameters like the base URL, theme, language, and menus. SCSS and image assets go in assets/, and are processed by Hugo\u0026rsquo;s pipeline. Static files like favicons are placed in static/.\nTo preview the site locally:\nhugo server To build the static site:\nhugo This generates everything in the public/ folder.\nVPS Deployment I rented a minimal Alpine Linux VPS and installed only what I needed. After setting up SSH and a basic nginx web server, I copied the public/ folder over using scp:\nscp -r public/* user@my-vps:/var/www/html On the VPS, I installed nginx:\napk add nginx And configured /etc/nginx/conf.d/default.conf to serve files from /var/www/html. Then I enabled and started nginx:\nrc-service nginx start rc-update add nginx Now my Hugo site is live and served directly as static files—no backend, no database, just HTML, CSS, and JS.\nWhy Alpine + Hugo? Alpine Linux is minimal and fast, perfect for serving static sites with low resource usage. Combined with Hugo’s speed and flexibility, I get a complete, performant setup that I fully control. It’s secure, lightweight, and easy to update—just rebuild and re-upload the public/ folder.\nThis setup is perfect if you want full control and minimal overhead for a personal blog or portfolio.\n","date":"May 29, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-2/","title":"Building My Hugo Website on a VPS"},{"categories":null,"contents":"DRMDTool is an automation-centric utility designed to streamline the processing of .drmd files by tightly integrating with the N_m3u8DL-RE downloader. The tool offers robust automation via a watch folder and an intuitive web-based interface, significantly reducing the friction for managing and processing DRM-protected streaming content.\nWhat’s New DRMDTool has evolved into a comprehensive platform for batch downloading with enhanced support for user interaction and background processing. It features granular job tracking, dynamic download control (pause, resume, abort), and a refined WebSocket-based console for real-time command output. Subtitle handling now includes automatic downloading and conversion from VTT to SRT, and the downloader adapts based on metadata, organizing content into categorized directories.\nGoals and Use Case The primary aim is to automate .drmd file processing with minimal manual input. Users can configure download formats, specify directories, and enable real-time command broadcasting. DRMDTool is suitable for both interactive use through a web UI and headless automation in pipelines, supporting inotify or polling-based folder watching.\nHow .drmd Files Work A .drmd file is a structured JSON document that defines one or more encrypted media items to be processed by DRMDTool. It contains an Items array, with each item representing a specific media job. DRMDTool parses these entries to generate download commands for N_m3u8DL-RE.\nEach item includes:\nMPD: A DASH manifest, either a direct URL or a base64-encoded version. If base64-encoded, DRMDTool decodes and temporarily saves it before use. Keys: A comma-separated list of KID:key pairs (e.g., abcd1234ef567890:00112233445566778899aabbccddeeff). These are required for decrypting encrypted media streams and are passed directly to N_m3u8DL-RE using --key flags. Filename: The name to be used for the final output file. Subtitles: Comma-separated list of subtitle URLs in .vtt format. DRMDTool downloads and converts these to .srt, then muxes them into the final file. Metadata: A semicolon-separated string like Title;Type;Season (e.g., Example Show;serie;1) used to determine directory structure (Movies/Title or Series/Title/Season). Description and Poster: Optional fields used only for display in the web UI. Example .drmd Structure { \u0026#34;Items\u0026#34;: [ { \u0026#34;MPD\u0026#34;: \u0026#34;aHR0cHM6Ly9leGFtcGxlLmNvbS9zdHJlYW0ubXBk\u0026#34;, \u0026#34;Keys\u0026#34;: \u0026#34;abcd1234ef567890:00112233445566778899aabbccddeeff\u0026#34;, \u0026#34;Filename\u0026#34;: \u0026#34;ExampleShow.S01E01\u0026#34;, \u0026#34;Subtitles\u0026#34;: \u0026#34;https://example.com/sub1.vtt,https://example.com/sub2.vtt\u0026#34;, \u0026#34;Metadata\u0026#34;: \u0026#34;Example Show;serie;1\u0026#34;, \u0026#34;Description\u0026#34;: \u0026#34;Pilot episode\u0026#34;, \u0026#34;Poster\u0026#34;: \u0026#34;\u0026#34; } ] } Processing Steps Detection: DRMDTool either watches a folder or receives .drmd uploads through the web UI. Validation: It waits for the file to finish writing (based on file size stability), then parses its contents. MPD Handling: If base64-encoded, the MPD is decoded and written to a temp file; otherwise, the URL is fetched or passed as-is. Command Generation: Using the MPD, KID:key pairs, output paths, and subtitles, DRMDTool builds a command line for N_m3u8DL-RE. Execution: The download is launched with live progress tracking. Users can pause, resume, or abort jobs, and optionally stream console output via WebSocket. These files serve as portable job definitions. When DRMDTool detects or receives a .drmd file, it parses the items, decodes or downloads the MPD, applies the keys, and builds a download command using N_m3u8DL-RE. Files are saved in organized directories like Movies/Title or Series/Title/Season, and subtitles are embedded if available. Pausing, resuming, and aborting downloads is supported per file.\nArchitecture Overview The configuration is handled via config.toml, with environment variable overrides for containerized or dynamic deployments. Once started, the tool can either monitor a specified folder or allow file uploads through the UI. Each .drmd file is parsed, grouped by series and season (if applicable), and processed sequentially with support for job pausing and resuming.\nWeb UI \u0026amp; CLI To use:\n./drmdtool Visit http://localhost:8080 for the web interface, which supports drag-and-drop uploads, selection of episodes or movies, and real-time progress tracking. For headless operation:\n./drmdtool -f /path/to/file.drmd Jobs can be paused, resumed, or aborted through the web interface, which reflects the backend state via live updates.\nEnhanced Download Logic DRMDTool dynamically builds download commands using metadata from .drmd files and user preferences. It ensures that only the highest quality streams are kept, removing ad periods and duplicate segments from the MPD files. Subtitles are fetched and embedded automatically. Jobs are tracked with robust state management and logs for debugging and visibility.\nRepository Code and setup instructions are hosted here: https://git.directme.in/Joren/DRMDTool\nDRMDtool For advanced usage details, customization, and API structure, refer to the README.md in the repository.\nUI Previews Index Page Select Page Progress Page ","date":"May 21, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-1/","title":"DRMDTool Project"},{"categories":["cybersecurity","event recap"],"contents":"Cyber Defence on the Digital Frontline: A Mission with NATO On a Mission with NATO: Cyber Defence on the Frontline Howest’s ongoing commitment to world-class cybersecurity training took center stage again as six lecturers from the Cyber Security program joined forces with experts from Latvia, Luxembourg and Belgium in one of NATO\u0026rsquo;s most intensive simulations: the Locked Shields exercise, hosted by the Cooperative Cyber Defence Centre of Excellence (CCDCOE). Now in its fifth year of participation, the Howest team shared their firsthand experiences at a special evening talk at Howest Bruges.\nThe Exercise: Locked Shields Locked Shields is no ordinary simulation. It is a full-scale, live-fire cyber defence exercise involving more than 6,000 machines and a narrative scenario so detailed it includes geopolitics, disinformation and even fictional countries. This year, the Blue Team 03 (our team) defended a simulated nation’s critical infrastructure including power plants, satellites, 5G networks and banking systems, all while under constant attack from a coordinated Red Team using automated scripts and over 28,000 attacks across two days.\nAnd yes, every team (Red, Blue, Yellow, White) uses Ansible. For everything.\nHigh Stakes, Real Lessons What do you do when a rogue process might be malware, or maybe just a poorly named service? What happens when your teammate refuses to act unless something is “officially malicious”? The team faced cultural clashes, communication breakdowns and stress-testing of both systems and people.\nThe exercise required more than technical fixes. It demanded communication with simulated commanders, media and public stakeholders. Reporting became just as important as patching. It taught participants how to translate technical impact into real-world consequences. Not \u0026ldquo;port 8443 unreachable\u0026rdquo;, but \u0026ldquo;our air defence system is degraded, and we cannot fly planes\u0026rdquo;.\nThe Black Team: Rapid Response in Action A new but powerful presence in the simulation was the Black Team, a rapid-response unit deployed when problems became too complex for any single team. Acting like special forces, they jumped in when incidents crossed team boundaries or demanded unconventional solutions. Their mission was to find out what was happening, assess the impact and suggest fast, creative responses. Introduced just last year, this team quickly proved its value again in 2025. They even embraced the role with style — “you can wear sunglasses inside” became their unofficial motto.\nTheir presence underlined a critical lesson: not every problem fits neatly within a team’s silo. Real-world defence requires flexibility, speed and lateral thinking.\nHighlights and Blooper Reel There were plenty of mishaps. Misfired scripts, team mix-ups, and one case where a DNS setup from a previous year was reused by mistake. Someone tried renaming cut to shutdown, breaking essential operations until it was fixed. Systems rebooted into chaos, a manual was uploaded to public GitHub, and the team had to quickly learn the difference between symbolic links and real binaries.\nHuman Factors and Growth From detecting malware with Velociraptor and Q9, to encountering teammates who took orders literally, the learning was intense. One participant noted that while Belgian and Luxembourg teams prioritized knowledge sharing, others preferred strict protocol. This highlighted cultural differences and the importance of interpersonal skills.\nThe biggest lesson? You are never fully prepared. Every iteration of Locked Shields is different. But each one sharpens not only your skills, but also your ability to function as a team under extreme conditions.\nFrom the Battlefield to the Classroom This experience directly impacts the classroom. Inspired by the exercise, Howest is introducing new hands-on courses like “Glutamine” in semester five. Students will be dropped into realistic broken networks, with misconfigurations, fake firewalls and simulated threats. It is chaos, but controlled. And that is the point.\nAs one speaker said: “You don’t win Locked Shields. You just survive it better than the rest.”\nFinal Thoughts The exercise teaches more than just cybersecurity. It builds trust. It proves that knowing your teammates can be as important as knowing the tools. Whether that comes from a shared flight or a pre-exercise barbecue, it all matters when the pressure hits.\nWant to see how cyber defence works in real life? This is it.\n","date":"May 13, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog-1_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog-1_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-1/","title":"Cyber Defence on the Digital Frontline: A Mission with NATO"},{"categories":["cybersecurity","CTF","education"],"contents":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience On March 14 and 15, I joined the Cyber Security Challenge Belgium qualifiers with three teammates. For two days, we threw ourselves at CTF challenges covering binary exploitation, Android reversing, cryptography, and more.\nWhat follows is a recap of the challenges I personally worked on—some I solved, some I didn’t—but all of them left me with new skills and new ideas.\nA Buffer Overflow to Warm Up One of the first challenges I picked involved a binary with a basic stack overflow. I used standard techniques—finding the offset, hijacking the return address, and injecting shellcode. Tools like pwntools helped automate the payload crafting. It was a great warm-up and a confidence boost once it worked.\nBinary Exploitation Flag\rCryptography and Pattern Matching Another crypto puzzle asked us to match a generated ASCII art banner to its underlying seed. Once I understood how the randomness was embedded into the banner, I brute-forced the space with a simple pattern-matching script. The exercise was clean, deterministic, and satisfying to solve.\nOurEncIsSec: Zip Bombs and OEIS Then there was a more elaborate cryptography challenge: 18 zip files, each password-protected. We cracked the first three passwords using John the Ripper and got numeric values from them. I searched the sequence in OEIS and found it matched A007408, which gave us the full pattern of passwords.\nUsing this, I could extract all zip contents automatically, reconstruct the password-protected message, and finally reveal the flag.\nOurEncIsSec Screenshot\rInfinite Luck: One in a Million? One challenge involved “guessing” a thousand random numbers between 1 and 10. The banner claimed it required infinite luck—but of course, the randomness was seeded. After inspecting the generator, I realized it was deterministic. By precomputing seeds and output sequences, I could match the challenge’s banner to a specific seed and regenerate the entire solution.\nAndroid Reversing: FRIDA and JADX Several APKs were part of the qualifier set. I used JADX to decompile them and FRIDA to patch logic at runtime. In one challenge, I bypassed license validation by forcing key methods to return true and unlocking hidden functionality.\nThe Challenge That Stuck with Me: Rebuilding a Split DEX This one stood out.\nThe app used a 4×8 button grid. Pressing buttons loaded a sequence of blockXX files from assets. These were concatenated in-memory and passed into InMemoryDexClassLoader to load a class called be.dauntless.flag.Flag.\nClass loadClass = new InMemoryDexClassLoader(ByteBuffer.wrap(byteArrayOutputStream.toByteArray()), getClassLoader()) .loadClass(\u0026#34;be.dauntless.flag.Flag\u0026#34;); Each block was a fragment of a DEX file, but the app didn’t tell you the right order. I tried manually inspecting the fragments—identifying methods, string constants, and offsets—to infer how to reassemble the full file. I got close, but didn’t crack it in time.\nThat challenge stuck with me because it combined static analysis, runtime introspection, and logic reconstruction. It wasn’t just technical—it was creative.\nThe One That Got Away: TLS Fingerprinting Another challenge involved a Go-based TLS server that rejected all client connections unless they matched a specific fingerprint. I used Go’s tls.Config to replicate the version, cipher suites, and ALPN:\ntls.Config{ MinVersion: tls.VersionTLS13, CipherSuites: []uint16{ tls.TLS_AES_128_GCM_SHA256, // ... }, NextProtos: []string{\u0026#34;h2\u0026#34;}, } Despite that, the server still refused the connection. I suspect it was using JA4 or similar TLS fingerprinting techniques we couldn’t fully emulate. We had to move on—but I’d love to revisit that one someday.\nFinal Thoughts I didn’t solve everything. But that wasn’t the point. Every challenge was a practical puzzle—something to decode, reverse, bypass, or just understand a little better.\nWorking as a team with Evarist, Nathan, and Waut made it even more valuable. We bounced ideas off each other, divided tasks, and got a much broader set of challenges covered.\nThe Cyber Security Challenge Belgium qualifiers weren’t easy. But they were the best kind of difficult—the kind that teaches you something whether you solve the problem or not.\n","date":"March 15, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/post-2/binexpl_hu_3d36b409c72f3586.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"160\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/post-2\\/binexpl_hu_afca672637b6b98d.png';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-2/","title":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience"},{"categories":null,"contents":"I built my personal blog using Hugo and deployed it on a lightweight Alpine Linux VPS. I chose this setup to have full control, keep things simple, and avoid bloated platforms or services. Here’s how the process went from site generation to live deployment.\nCreating the Hugo Site On my development machine, I created a new Hugo site:\nhugo new site howest-blog I used the professors-hugo theme and copied its exampleSite content into my project. I customized the layout, structure, and styling by editing content files, SCSS in assets/scss/custom.scss, and partial templates in the theme directory.\nAll content lives under content/, with separate folders for blog/ and project/, each containing .md files with front matter and Markdown content.\nCustomization I edited the config/_default/hugo.toml to configure site parameters like the base URL, theme, language, and menus. SCSS and image assets go in assets/, and are processed by Hugo\u0026rsquo;s pipeline. Static files like favicons are placed in static/.\nTo preview the site locally:\nhugo server To build the static site:\nhugo This generates everything in the public/ folder.\nVPS Deployment I rented a minimal Alpine Linux VPS and installed only what I needed. After setting up SSH and a basic nginx web server, I copied the public/ folder over using scp:\nscp -r public/* user@my-vps:/var/www/html On the VPS, I installed nginx:\napk add nginx And configured /etc/nginx/conf.d/default.conf to serve files from /var/www/html. Then I enabled and started nginx:\nrc-service nginx start rc-update add nginx Now my Hugo site is live and served directly as static files—no backend, no database, just HTML, CSS, and JS.\nWhy Alpine + Hugo? Alpine Linux is minimal and fast, perfect for serving static sites with low resource usage. Combined with Hugo’s speed and flexibility, I get a complete, performant setup that I fully control. It’s secure, lightweight, and easy to update—just rebuild and re-upload the public/ folder.\nThis setup is perfect if you want full control and minimal overhead for a personal blog or portfolio.\n","date":"May 29, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-2/","title":"Building My Hugo Website on a VPS"},{"categories":null,"contents":"DRMDTool is an automation-centric utility designed to streamline the processing of .drmd files by tightly integrating with the N_m3u8DL-RE downloader. The tool offers robust automation via a watch folder and an intuitive web-based interface, significantly reducing the friction for managing and processing DRM-protected streaming content.\nWhat’s New DRMDTool has evolved into a comprehensive platform for batch downloading with enhanced support for user interaction and background processing. It features granular job tracking, dynamic download control (pause, resume, abort), and a refined WebSocket-based console for real-time command output. Subtitle handling now includes automatic downloading and conversion from VTT to SRT, and the downloader adapts based on metadata, organizing content into categorized directories.\nGoals and Use Case The primary aim is to automate .drmd file processing with minimal manual input. Users can configure download formats, specify directories, and enable real-time command broadcasting. DRMDTool is suitable for both interactive use through a web UI and headless automation in pipelines, supporting inotify or polling-based folder watching.\nHow .drmd Files Work A .drmd file is a structured JSON document that defines one or more encrypted media items to be processed by DRMDTool. It contains an Items array, with each item representing a specific media job. DRMDTool parses these entries to generate download commands for N_m3u8DL-RE.\nEach item includes:\nMPD: A DASH manifest, either a direct URL or a base64-encoded version. If base64-encoded, DRMDTool decodes and temporarily saves it before use. Keys: A comma-separated list of KID:key pairs (e.g., abcd1234ef567890:00112233445566778899aabbccddeeff). These are required for decrypting encrypted media streams and are passed directly to N_m3u8DL-RE using --key flags. Filename: The name to be used for the final output file. Subtitles: Comma-separated list of subtitle URLs in .vtt format. DRMDTool downloads and converts these to .srt, then muxes them into the final file. Metadata: A semicolon-separated string like Title;Type;Season (e.g., Example Show;serie;1) used to determine directory structure (Movies/Title or Series/Title/Season). Description and Poster: Optional fields used only for display in the web UI. Example .drmd Structure { \u0026#34;Items\u0026#34;: [ { \u0026#34;MPD\u0026#34;: \u0026#34;aHR0cHM6Ly9leGFtcGxlLmNvbS9zdHJlYW0ubXBk\u0026#34;, \u0026#34;Keys\u0026#34;: \u0026#34;abcd1234ef567890:00112233445566778899aabbccddeeff\u0026#34;, \u0026#34;Filename\u0026#34;: \u0026#34;ExampleShow.S01E01\u0026#34;, \u0026#34;Subtitles\u0026#34;: \u0026#34;https://example.com/sub1.vtt,https://example.com/sub2.vtt\u0026#34;, \u0026#34;Metadata\u0026#34;: \u0026#34;Example Show;serie;1\u0026#34;, \u0026#34;Description\u0026#34;: \u0026#34;Pilot episode\u0026#34;, \u0026#34;Poster\u0026#34;: \u0026#34;\u0026#34; } ] } Processing Steps Detection: DRMDTool either watches a folder or receives .drmd uploads through the web UI. Validation: It waits for the file to finish writing (based on file size stability), then parses its contents. MPD Handling: If base64-encoded, the MPD is decoded and written to a temp file; otherwise, the URL is fetched or passed as-is. Command Generation: Using the MPD, KID:key pairs, output paths, and subtitles, DRMDTool builds a command line for N_m3u8DL-RE. Execution: The download is launched with live progress tracking. Users can pause, resume, or abort jobs, and optionally stream console output via WebSocket. These files serve as portable job definitions. When DRMDTool detects or receives a .drmd file, it parses the items, decodes or downloads the MPD, applies the keys, and builds a download command using N_m3u8DL-RE. Files are saved in organized directories like Movies/Title or Series/Title/Season, and subtitles are embedded if available. Pausing, resuming, and aborting downloads is supported per file.\nArchitecture Overview The configuration is handled via config.toml, with environment variable overrides for containerized or dynamic deployments. Once started, the tool can either monitor a specified folder or allow file uploads through the UI. Each .drmd file is parsed, grouped by series and season (if applicable), and processed sequentially with support for job pausing and resuming.\nWeb UI \u0026amp; CLI To use:\n./drmdtool Visit http://localhost:8080 for the web interface, which supports drag-and-drop uploads, selection of episodes or movies, and real-time progress tracking. For headless operation:\n./drmdtool -f /path/to/file.drmd Jobs can be paused, resumed, or aborted through the web interface, which reflects the backend state via live updates.\nEnhanced Download Logic DRMDTool dynamically builds download commands using metadata from .drmd files and user preferences. It ensures that only the highest quality streams are kept, removing ad periods and duplicate segments from the MPD files. Subtitles are fetched and embedded automatically. Jobs are tracked with robust state management and logs for debugging and visibility.\nRepository Code and setup instructions are hosted here: https://git.directme.in/Joren/DRMDTool\nDRMDtool For advanced usage details, customization, and API structure, refer to the README.md in the repository.\nUI Previews Index Page Select Page Progress Page ","date":"May 21, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-1/","title":"DRMDTool Project"},{"categories":["cybersecurity","event recap"],"contents":"Cyber Defence on the Digital Frontline: A Mission with NATO On a Mission with NATO: Cyber Defence on the Frontline Howest’s ongoing commitment to world-class cybersecurity training took center stage again as six lecturers from the Cyber Security program joined forces with experts from Latvia, Luxembourg and Belgium in one of NATO\u0026rsquo;s most intensive simulations: the Locked Shields exercise, hosted by the Cooperative Cyber Defence Centre of Excellence (CCDCOE). Now in its fifth year of participation, the Howest team shared their firsthand experiences at a special evening talk at Howest Bruges.\nThe Exercise: Locked Shields Locked Shields is no ordinary simulation. It is a full-scale, live-fire cyber defence exercise involving more than 6,000 machines and a narrative scenario so detailed it includes geopolitics, disinformation and even fictional countries. This year, the Blue Team 03 (our team) defended a simulated nation’s critical infrastructure including power plants, satellites, 5G networks and banking systems, all while under constant attack from a coordinated Red Team using automated scripts and over 28,000 attacks across two days.\nAnd yes, every team (Red, Blue, Yellow, White) uses Ansible. For everything.\nHigh Stakes, Real Lessons What do you do when a rogue process might be malware, or maybe just a poorly named service? What happens when your teammate refuses to act unless something is “officially malicious”? The team faced cultural clashes, communication breakdowns and stress-testing of both systems and people.\nThe exercise required more than technical fixes. It demanded communication with simulated commanders, media and public stakeholders. Reporting became just as important as patching. It taught participants how to translate technical impact into real-world consequences. Not \u0026ldquo;port 8443 unreachable\u0026rdquo;, but \u0026ldquo;our air defence system is degraded, and we cannot fly planes\u0026rdquo;.\nThe Black Team: Rapid Response in Action A new but powerful presence in the simulation was the Black Team, a rapid-response unit deployed when problems became too complex for any single team. Acting like special forces, they jumped in when incidents crossed team boundaries or demanded unconventional solutions. Their mission was to find out what was happening, assess the impact and suggest fast, creative responses. Introduced just last year, this team quickly proved its value again in 2025. They even embraced the role with style — “you can wear sunglasses inside” became their unofficial motto.\nTheir presence underlined a critical lesson: not every problem fits neatly within a team’s silo. Real-world defence requires flexibility, speed and lateral thinking.\nHighlights and Blooper Reel There were plenty of mishaps. Misfired scripts, team mix-ups, and one case where a DNS setup from a previous year was reused by mistake. Someone tried renaming cut to shutdown, breaking essential operations until it was fixed. Systems rebooted into chaos, a manual was uploaded to public GitHub, and the team had to quickly learn the difference between symbolic links and real binaries.\nHuman Factors and Growth From detecting malware with Velociraptor and Q9, to encountering teammates who took orders literally, the learning was intense. One participant noted that while Belgian and Luxembourg teams prioritized knowledge sharing, others preferred strict protocol. This highlighted cultural differences and the importance of interpersonal skills.\nThe biggest lesson? You are never fully prepared. Every iteration of Locked Shields is different. But each one sharpens not only your skills, but also your ability to function as a team under extreme conditions.\nFrom the Battlefield to the Classroom This experience directly impacts the classroom. Inspired by the exercise, Howest is introducing new hands-on courses like “Glutamine” in semester five. Students will be dropped into realistic broken networks, with misconfigurations, fake firewalls and simulated threats. It is chaos, but controlled. And that is the point.\nAs one speaker said: “You don’t win Locked Shields. You just survive it better than the rest.”\nFinal Thoughts The exercise teaches more than just cybersecurity. It builds trust. It proves that knowing your teammates can be as important as knowing the tools. Whether that comes from a shared flight or a pre-exercise barbecue, it all matters when the pressure hits.\nWant to see how cyber defence works in real life? This is it.\n","date":"May 13, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog-1_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog-1_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-1/","title":"Cyber Defence on the Digital Frontline: A Mission with NATO"},{"categories":["cybersecurity","CTF","education"],"contents":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience On March 14 and 15, I joined the Cyber Security Challenge Belgium qualifiers with three teammates. For two days, we threw ourselves at CTF challenges covering binary exploitation, Android reversing, cryptography, and more.\nWhat follows is a recap of the challenges I personally worked on—some I solved, some I didn’t—but all of them left me with new skills and new ideas.\nA Buffer Overflow to Warm Up One of the first challenges I picked involved a binary with a basic stack overflow. I used standard techniques—finding the offset, hijacking the return address, and injecting shellcode. Tools like pwntools helped automate the payload crafting. It was a great warm-up and a confidence boost once it worked.\nBinary Exploitation Flag\rCryptography and Pattern Matching Another crypto puzzle asked us to match a generated ASCII art banner to its underlying seed. Once I understood how the randomness was embedded into the banner, I brute-forced the space with a simple pattern-matching script. The exercise was clean, deterministic, and satisfying to solve.\nOurEncIsSec: Zip Bombs and OEIS Then there was a more elaborate cryptography challenge: 18 zip files, each password-protected. We cracked the first three passwords using John the Ripper and got numeric values from them. I searched the sequence in OEIS and found it matched A007408, which gave us the full pattern of passwords.\nUsing this, I could extract all zip contents automatically, reconstruct the password-protected message, and finally reveal the flag.\nOurEncIsSec Screenshot\rInfinite Luck: One in a Million? One challenge involved “guessing” a thousand random numbers between 1 and 10. The banner claimed it required infinite luck—but of course, the randomness was seeded. After inspecting the generator, I realized it was deterministic. By precomputing seeds and output sequences, I could match the challenge’s banner to a specific seed and regenerate the entire solution.\nBinary Exploitation Flag\rBinary Exploitation Flag\rAndroid Reversing: FRIDA and JADX Several APKs were part of the qualifier set. I used JADX to decompile them and FRIDA to patch logic at runtime. In one challenge, I bypassed license validation by forcing key methods to return true and unlocking hidden functionality.\nThe Challenge That Stuck with Me: Rebuilding a Split DEX This one stood out.\nThe app used a 4×8 button grid. Pressing buttons loaded a sequence of blockXX files from assets. These were concatenated in-memory and passed into InMemoryDexClassLoader to load a class called be.dauntless.flag.Flag.\nClass loadClass = new InMemoryDexClassLoader(ByteBuffer.wrap(byteArrayOutputStream.toByteArray()), getClassLoader()) .loadClass(\u0026#34;be.dauntless.flag.Flag\u0026#34;); Each block was a fragment of a DEX file, but the app didn’t tell you the right order. I tried manually inspecting the fragments—identifying methods, string constants, and offsets—to infer how to reassemble the full file. I got close, but didn’t crack it in time.\nThat challenge stuck with me because it combined static analysis, runtime introspection, and logic reconstruction. It wasn’t just technical—it was creative.\nThe One That Got Away: TLS Fingerprinting Another challenge involved a Go-based TLS server that rejected all client connections unless they matched a specific fingerprint. I used Go’s tls.Config to replicate the version, cipher suites, and ALPN:\ntls.Config{ MinVersion: tls.VersionTLS13, CipherSuites: []uint16{ tls.TLS_AES_128_GCM_SHA256, // ... }, NextProtos: []string{\u0026#34;h2\u0026#34;}, } Despite that, the server still refused the connection. I suspect it was using JA4 or similar TLS fingerprinting techniques we couldn’t fully emulate. We had to move on—but I’d love to revisit that one someday.\nFinal Thoughts I didn’t solve everything. But that wasn’t the point. Every challenge was a practical puzzle—something to decode, reverse, bypass, or just understand a little better.\nWorking as a team with Evarist, Nathan, and Waut made it even more valuable. We bounced ideas off each other, divided tasks, and got a much broader set of challenges covered.\nThe Cyber Security Challenge Belgium qualifiers weren’t easy. But they were the best kind of difficult—the kind that teaches you something whether you solve the problem or not.\n","date":"March 15, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/post-2/binexpl_hu_3d36b409c72f3586.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"160\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/post-2\\/binexpl_hu_afca672637b6b98d.png';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-2/","title":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience"},{"categories":null,"contents":"I built my personal blog using Hugo and deployed it on a lightweight Alpine Linux VPS. I chose this setup to have full control, keep things simple, and avoid bloated platforms or services. Here’s how the process went from site generation to live deployment.\nCreating the Hugo Site On my development machine, I created a new Hugo site:\nhugo new site howest-blog I used the professors-hugo theme and copied its exampleSite content into my project. I customized the layout, structure, and styling by editing content files, SCSS in assets/scss/custom.scss, and partial templates in the theme directory.\nAll content lives under content/, with separate folders for blog/ and project/, each containing .md files with front matter and Markdown content.\nCustomization I edited the config/_default/hugo.toml to configure site parameters like the base URL, theme, language, and menus. SCSS and image assets go in assets/, and are processed by Hugo\u0026rsquo;s pipeline. Static files like favicons are placed in static/.\nTo preview the site locally:\nhugo server To build the static site:\nhugo This generates everything in the public/ folder.\nVPS Deployment I rented a minimal Alpine Linux VPS and installed only what I needed. After setting up SSH and a basic nginx web server, I copied the public/ folder over using scp:\nscp -r public/* user@my-vps:/var/www/html On the VPS, I installed nginx:\napk add nginx And configured /etc/nginx/conf.d/default.conf to serve files from /var/www/html. Then I enabled and started nginx:\nrc-service nginx start rc-update add nginx Now my Hugo site is live and served directly as static files—no backend, no database, just HTML, CSS, and JS.\nWhy Alpine + Hugo? Alpine Linux is minimal and fast, perfect for serving static sites with low resource usage. Combined with Hugo’s speed and flexibility, I get a complete, performant setup that I fully control. It’s secure, lightweight, and easy to update—just rebuild and re-upload the public/ folder.\nThis setup is perfect if you want full control and minimal overhead for a personal blog or portfolio.\n","date":"May 29, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-2/","title":"Building My Hugo Website on a VPS"},{"categories":null,"contents":"DRMDTool is an automation-centric utility designed to streamline the processing of .drmd files by tightly integrating with the N_m3u8DL-RE downloader. The tool offers robust automation via a watch folder and an intuitive web-based interface, significantly reducing the friction for managing and processing DRM-protected streaming content.\nWhat’s New DRMDTool has evolved into a comprehensive platform for batch downloading with enhanced support for user interaction and background processing. It features granular job tracking, dynamic download control (pause, resume, abort), and a refined WebSocket-based console for real-time command output. Subtitle handling now includes automatic downloading and conversion from VTT to SRT, and the downloader adapts based on metadata, organizing content into categorized directories.\nGoals and Use Case The primary aim is to automate .drmd file processing with minimal manual input. Users can configure download formats, specify directories, and enable real-time command broadcasting. DRMDTool is suitable for both interactive use through a web UI and headless automation in pipelines, supporting inotify or polling-based folder watching.\nHow .drmd Files Work A .drmd file is a structured JSON document that defines one or more encrypted media items to be processed by DRMDTool. It contains an Items array, with each item representing a specific media job. DRMDTool parses these entries to generate download commands for N_m3u8DL-RE.\nEach item includes:\nMPD: A DASH manifest, either a direct URL or a base64-encoded version. If base64-encoded, DRMDTool decodes and temporarily saves it before use. Keys: A comma-separated list of KID:key pairs (e.g., abcd1234ef567890:00112233445566778899aabbccddeeff). These are required for decrypting encrypted media streams and are passed directly to N_m3u8DL-RE using --key flags. Filename: The name to be used for the final output file. Subtitles: Comma-separated list of subtitle URLs in .vtt format. DRMDTool downloads and converts these to .srt, then muxes them into the final file. Metadata: A semicolon-separated string like Title;Type;Season (e.g., Example Show;serie;1) used to determine directory structure (Movies/Title or Series/Title/Season). Description and Poster: Optional fields used only for display in the web UI. Example .drmd Structure { \u0026#34;Items\u0026#34;: [ { \u0026#34;MPD\u0026#34;: \u0026#34;aHR0cHM6Ly9leGFtcGxlLmNvbS9zdHJlYW0ubXBk\u0026#34;, \u0026#34;Keys\u0026#34;: \u0026#34;abcd1234ef567890:00112233445566778899aabbccddeeff\u0026#34;, \u0026#34;Filename\u0026#34;: \u0026#34;ExampleShow.S01E01\u0026#34;, \u0026#34;Subtitles\u0026#34;: \u0026#34;https://example.com/sub1.vtt,https://example.com/sub2.vtt\u0026#34;, \u0026#34;Metadata\u0026#34;: \u0026#34;Example Show;serie;1\u0026#34;, \u0026#34;Description\u0026#34;: \u0026#34;Pilot episode\u0026#34;, \u0026#34;Poster\u0026#34;: \u0026#34;\u0026#34; } ] } Processing Steps Detection: DRMDTool either watches a folder or receives .drmd uploads through the web UI. Validation: It waits for the file to finish writing (based on file size stability), then parses its contents. MPD Handling: If base64-encoded, the MPD is decoded and written to a temp file; otherwise, the URL is fetched or passed as-is. Command Generation: Using the MPD, KID:key pairs, output paths, and subtitles, DRMDTool builds a command line for N_m3u8DL-RE. Execution: The download is launched with live progress tracking. Users can pause, resume, or abort jobs, and optionally stream console output via WebSocket. These files serve as portable job definitions. When DRMDTool detects or receives a .drmd file, it parses the items, decodes or downloads the MPD, applies the keys, and builds a download command using N_m3u8DL-RE. Files are saved in organized directories like Movies/Title or Series/Title/Season, and subtitles are embedded if available. Pausing, resuming, and aborting downloads is supported per file.\nArchitecture Overview The configuration is handled via config.toml, with environment variable overrides for containerized or dynamic deployments. Once started, the tool can either monitor a specified folder or allow file uploads through the UI. Each .drmd file is parsed, grouped by series and season (if applicable), and processed sequentially with support for job pausing and resuming.\nWeb UI \u0026amp; CLI To use:\n./drmdtool Visit http://localhost:8080 for the web interface, which supports drag-and-drop uploads, selection of episodes or movies, and real-time progress tracking. For headless operation:\n./drmdtool -f /path/to/file.drmd Jobs can be paused, resumed, or aborted through the web interface, which reflects the backend state via live updates.\nEnhanced Download Logic DRMDTool dynamically builds download commands using metadata from .drmd files and user preferences. It ensures that only the highest quality streams are kept, removing ad periods and duplicate segments from the MPD files. Subtitles are fetched and embedded automatically. Jobs are tracked with robust state management and logs for debugging and visibility.\nRepository Code and setup instructions are hosted here: https://git.directme.in/Joren/DRMDTool\nDRMDtool For advanced usage details, customization, and API structure, refer to the README.md in the repository.\nUI Previews Index Page Select Page Progress Page ","date":"May 21, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-1/","title":"DRMDTool Project"},{"categories":["cybersecurity","event recap"],"contents":"Cyber Defence on the Digital Frontline: A Mission with NATO On a Mission with NATO: Cyber Defence on the Frontline Howest’s ongoing commitment to world-class cybersecurity training took center stage again as six lecturers from the Cyber Security program joined forces with experts from Latvia, Luxembourg and Belgium in one of NATO\u0026rsquo;s most intensive simulations: the Locked Shields exercise, hosted by the Cooperative Cyber Defence Centre of Excellence (CCDCOE). Now in its fifth year of participation, the Howest team shared their firsthand experiences at a special evening talk at Howest Bruges.\nThe Exercise: Locked Shields Locked Shields is no ordinary simulation. It is a full-scale, live-fire cyber defence exercise involving more than 6,000 machines and a narrative scenario so detailed it includes geopolitics, disinformation and even fictional countries. This year, the Blue Team 03 (our team) defended a simulated nation’s critical infrastructure including power plants, satellites, 5G networks and banking systems, all while under constant attack from a coordinated Red Team using automated scripts and over 28,000 attacks across two days.\nAnd yes, every team (Red, Blue, Yellow, White) uses Ansible. For everything.\nHigh Stakes, Real Lessons What do you do when a rogue process might be malware, or maybe just a poorly named service? What happens when your teammate refuses to act unless something is “officially malicious”? The team faced cultural clashes, communication breakdowns and stress-testing of both systems and people.\nThe exercise required more than technical fixes. It demanded communication with simulated commanders, media and public stakeholders. Reporting became just as important as patching. It taught participants how to translate technical impact into real-world consequences. Not \u0026ldquo;port 8443 unreachable\u0026rdquo;, but \u0026ldquo;our air defence system is degraded, and we cannot fly planes\u0026rdquo;.\nThe Black Team: Rapid Response in Action A new but powerful presence in the simulation was the Black Team, a rapid-response unit deployed when problems became too complex for any single team. Acting like special forces, they jumped in when incidents crossed team boundaries or demanded unconventional solutions. Their mission was to find out what was happening, assess the impact and suggest fast, creative responses. Introduced just last year, this team quickly proved its value again in 2025. They even embraced the role with style — “you can wear sunglasses inside” became their unofficial motto.\nTheir presence underlined a critical lesson: not every problem fits neatly within a team’s silo. Real-world defence requires flexibility, speed and lateral thinking.\nHighlights and Blooper Reel There were plenty of mishaps. Misfired scripts, team mix-ups, and one case where a DNS setup from a previous year was reused by mistake. Someone tried renaming cut to shutdown, breaking essential operations until it was fixed. Systems rebooted into chaos, a manual was uploaded to public GitHub, and the team had to quickly learn the difference between symbolic links and real binaries.\nHuman Factors and Growth From detecting malware with Velociraptor and Q9, to encountering teammates who took orders literally, the learning was intense. One participant noted that while Belgian and Luxembourg teams prioritized knowledge sharing, others preferred strict protocol. This highlighted cultural differences and the importance of interpersonal skills.\nThe biggest lesson? You are never fully prepared. Every iteration of Locked Shields is different. But each one sharpens not only your skills, but also your ability to function as a team under extreme conditions.\nFrom the Battlefield to the Classroom This experience directly impacts the classroom. Inspired by the exercise, Howest is introducing new hands-on courses like “Glutamine” in semester five. Students will be dropped into realistic broken networks, with misconfigurations, fake firewalls and simulated threats. It is chaos, but controlled. And that is the point.\nAs one speaker said: “You don’t win Locked Shields. You just survive it better than the rest.”\nFinal Thoughts The exercise teaches more than just cybersecurity. It builds trust. It proves that knowing your teammates can be as important as knowing the tools. Whether that comes from a shared flight or a pre-exercise barbecue, it all matters when the pressure hits.\nWant to see how cyber defence works in real life? This is it.\n","date":"May 13, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog-1_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog-1_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-1/","title":"Cyber Defence on the Digital Frontline: A Mission with NATO"},{"categories":["cybersecurity","CTF","education"],"contents":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience On March 14 and 15, I joined the Cyber Security Challenge Belgium qualifiers with three teammates. For two days, we threw ourselves at CTF challenges covering binary exploitation, Android reversing, cryptography, and more.\nWhat follows is a recap of the challenges I personally worked on—some I solved, some I didn’t—but all of them left me with new skills and new ideas.\nA Buffer Overflow to Warm Up One of the first challenges I picked involved a binary with a basic stack overflow. I used standard techniques—finding the offset, hijacking the return address, and injecting shellcode. Tools like pwntools helped automate the payload crafting. It was a great warm-up and a confidence boost once it worked.\nBinary Exploitation Flag\rCryptography and Pattern Matching Another crypto puzzle asked us to match a generated ASCII art banner to its underlying seed. Once I understood how the randomness was embedded into the banner, I brute-forced the space with a simple pattern-matching script. The exercise was clean, deterministic, and satisfying to solve.\nOurEncIsSec: Zip Bombs and OEIS Then there was a more elaborate cryptography challenge: 18 zip files, each password-protected. We cracked the first three passwords using John the Ripper and got numeric values from them. I searched the sequence in OEIS and found it matched A007408, which gave us the full pattern of passwords.\nUsing this, I could extract all zip contents automatically, reconstruct the password-protected message, and finally reveal the flag.\nOurEncIsSec Screenshot\rInfinite Luck: One in a Million? One challenge involved “guessing” a thousand random numbers between 1 and 10. The banner claimed it required infinite luck—but of course, the randomness was seeded. After inspecting the generator, I realized it was deterministic. By precomputing seeds and output sequences, I could match the challenge’s banner to a specific seed and regenerate the entire solution.\nBinary Exploitation Flag\rBinary Exploitation Flag\rAndroid Reversing: FRIDA and JADX Several APKs were part of the qualifier set. I used JADX to decompile them and FRIDA to patch logic at runtime. In one challenge, I bypassed license validation by forcing key methods to return true and unlocking hidden functionality.\nThe Challenge That Stuck with Me: Rebuilding a Split DEX This one stood out.\nThe app used a 4×8 button grid. Pressing buttons loaded a sequence of blockXX files from assets. These were concatenated in-memory and passed into InMemoryDexClassLoader to load a class called be.dauntless.flag.Flag.\nClass loadClass = new InMemoryDexClassLoader(ByteBuffer.wrap(byteArrayOutputStream.toByteArray()), getClassLoader()) .loadClass(\u0026#34;be.dauntless.flag.Flag\u0026#34;); Each block was a fragment of a DEX file, but the app didn’t tell you the right order. I tried manually inspecting the fragments—identifying methods, string constants, and offsets—to infer how to reassemble the full file. I got close, but didn’t crack it in time.\nThat challenge stuck with me because it combined static analysis, runtime introspection, and logic reconstruction. It wasn’t just technical—it was creative.\nThe One That Got Away: TLS Fingerprinting Another challenge involved a Go-based TLS server that rejected all client connections unless they matched a specific fingerprint. I used Go’s tls.Config to replicate the version, cipher suites, and ALPN:\ntls.Config{ MinVersion: tls.VersionTLS13, CipherSuites: []uint16{ tls.TLS_AES_128_GCM_SHA256, // ... }, NextProtos: []string{\u0026#34;h2\u0026#34;}, } Despite that, the server still refused the connection. I suspect it was using JA4 or similar TLS fingerprinting techniques we couldn’t fully emulate. We had to move on—but I’d love to revisit that one someday.\nFinal Thoughts I didn’t solve everything. But that wasn’t the point. Every challenge was a practical puzzle—something to decode, reverse, bypass, or just understand a little better.\nWorking as a team with Evarist, Nathan, and Waut made it even more valuable. We bounced ideas off each other, divided tasks, and got a much broader set of challenges covered.\nThe Cyber Security Challenge Belgium qualifiers weren’t easy. But they were the best kind of difficult—the kind that teaches you something whether you solve the problem or not.\n","date":"March 15, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/post-2/binexpl_hu_3d36b409c72f3586.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"160\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/post-2\\/binexpl_hu_afca672637b6b98d.png';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-2/","title":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience"},{"categories":null,"contents":"I built my personal blog using Hugo and deployed it on a lightweight Alpine Linux VPS. I chose this setup to have full control, keep things simple, and avoid bloated platforms or services. Here’s how the process went from site generation to live deployment.\nCreating the Hugo Site On my development machine, I created a new Hugo site:\nhugo new site howest-blog I used the professors-hugo theme and copied its exampleSite content into my project. I customized the layout, structure, and styling by editing content files, SCSS in assets/scss/custom.scss, and partial templates in the theme directory.\nAll content lives under content/, with separate folders for blog/ and project/, each containing .md files with front matter and Markdown content.\nCustomization I edited the config/_default/hugo.toml to configure site parameters like the base URL, theme, language, and menus. SCSS and image assets go in assets/, and are processed by Hugo\u0026rsquo;s pipeline. Static files like favicons are placed in static/.\nTo preview the site locally:\nhugo server To build the static site:\nhugo This generates everything in the public/ folder.\nVPS Deployment I rented a minimal Alpine Linux VPS and installed only what I needed. After setting up SSH and a basic nginx web server, I copied the public/ folder over using scp:\nscp -r public/* user@my-vps:/var/www/html On the VPS, I installed nginx:\napk add nginx And configured /etc/nginx/conf.d/default.conf to serve files from /var/www/html. Then I enabled and started nginx:\nrc-service nginx start rc-update add nginx Now my Hugo site is live and served directly as static files—no backend, no database, just HTML, CSS, and JS.\nWhy Alpine + Hugo? Alpine Linux is minimal and fast, perfect for serving static sites with low resource usage. Combined with Hugo’s speed and flexibility, I get a complete, performant setup that I fully control. It’s secure, lightweight, and easy to update—just rebuild and re-upload the public/ folder.\nThis setup is perfect if you want full control and minimal overhead for a personal blog or portfolio.\n","date":"May 29, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-2/","title":"Building My Hugo Website on a VPS"},{"categories":null,"contents":"DRMDTool is an automation-centric utility designed to streamline the processing of .drmd files by tightly integrating with the N_m3u8DL-RE downloader. The tool offers robust automation via a watch folder and an intuitive web-based interface, significantly reducing the friction for managing and processing DRM-protected streaming content.\nWhat’s New DRMDTool has evolved into a comprehensive platform for batch downloading with enhanced support for user interaction and background processing. It features granular job tracking, dynamic download control (pause, resume, abort), and a refined WebSocket-based console for real-time command output. Subtitle handling now includes automatic downloading and conversion from VTT to SRT, and the downloader adapts based on metadata, organizing content into categorized directories.\nGoals and Use Case The primary aim is to automate .drmd file processing with minimal manual input. Users can configure download formats, specify directories, and enable real-time command broadcasting. DRMDTool is suitable for both interactive use through a web UI and headless automation in pipelines, supporting inotify or polling-based folder watching.\nHow .drmd Files Work A .drmd file is a structured JSON document that defines one or more encrypted media items to be processed by DRMDTool. It contains an Items array, with each item representing a specific media job. DRMDTool parses these entries to generate download commands for N_m3u8DL-RE.\nEach item includes:\nMPD: A DASH manifest, either a direct URL or a base64-encoded version. If base64-encoded, DRMDTool decodes and temporarily saves it before use. Keys: A comma-separated list of KID:key pairs (e.g., abcd1234ef567890:00112233445566778899aabbccddeeff). These are required for decrypting encrypted media streams and are passed directly to N_m3u8DL-RE using --key flags. Filename: The name to be used for the final output file. Subtitles: Comma-separated list of subtitle URLs in .vtt format. DRMDTool downloads and converts these to .srt, then muxes them into the final file. Metadata: A semicolon-separated string like Title;Type;Season (e.g., Example Show;serie;1) used to determine directory structure (Movies/Title or Series/Title/Season). Description and Poster: Optional fields used only for display in the web UI. Example .drmd Structure { \u0026#34;Items\u0026#34;: [ { \u0026#34;MPD\u0026#34;: \u0026#34;aHR0cHM6Ly9leGFtcGxlLmNvbS9zdHJlYW0ubXBk\u0026#34;, \u0026#34;Keys\u0026#34;: \u0026#34;abcd1234ef567890:00112233445566778899aabbccddeeff\u0026#34;, \u0026#34;Filename\u0026#34;: \u0026#34;ExampleShow.S01E01\u0026#34;, \u0026#34;Subtitles\u0026#34;: \u0026#34;https://example.com/sub1.vtt,https://example.com/sub2.vtt\u0026#34;, \u0026#34;Metadata\u0026#34;: \u0026#34;Example Show;serie;1\u0026#34;, \u0026#34;Description\u0026#34;: \u0026#34;Pilot episode\u0026#34;, \u0026#34;Poster\u0026#34;: \u0026#34;\u0026#34; } ] } Processing Steps Detection: DRMDTool either watches a folder or receives .drmd uploads through the web UI. Validation: It waits for the file to finish writing (based on file size stability), then parses its contents. MPD Handling: If base64-encoded, the MPD is decoded and written to a temp file; otherwise, the URL is fetched or passed as-is. Command Generation: Using the MPD, KID:key pairs, output paths, and subtitles, DRMDTool builds a command line for N_m3u8DL-RE. Execution: The download is launched with live progress tracking. Users can pause, resume, or abort jobs, and optionally stream console output via WebSocket. These files serve as portable job definitions. When DRMDTool detects or receives a .drmd file, it parses the items, decodes or downloads the MPD, applies the keys, and builds a download command using N_m3u8DL-RE. Files are saved in organized directories like Movies/Title or Series/Title/Season, and subtitles are embedded if available. Pausing, resuming, and aborting downloads is supported per file.\nArchitecture Overview The configuration is handled via config.toml, with environment variable overrides for containerized or dynamic deployments. Once started, the tool can either monitor a specified folder or allow file uploads through the UI. Each .drmd file is parsed, grouped by series and season (if applicable), and processed sequentially with support for job pausing and resuming.\nWeb UI \u0026amp; CLI To use:\n./drmdtool Visit http://localhost:8080 for the web interface, which supports drag-and-drop uploads, selection of episodes or movies, and real-time progress tracking. For headless operation:\n./drmdtool -f /path/to/file.drmd Jobs can be paused, resumed, or aborted through the web interface, which reflects the backend state via live updates.\nEnhanced Download Logic DRMDTool dynamically builds download commands using metadata from .drmd files and user preferences. It ensures that only the highest quality streams are kept, removing ad periods and duplicate segments from the MPD files. Subtitles are fetched and embedded automatically. Jobs are tracked with robust state management and logs for debugging and visibility.\nRepository Code and setup instructions are hosted here: https://git.directme.in/Joren/DRMDTool\nDRMDtool For advanced usage details, customization, and API structure, refer to the README.md in the repository.\nUI Previews Index Page Select Page Progress Page ","date":"May 21, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-1/","title":"DRMDTool Project"},{"categories":["cybersecurity","event recap"],"contents":"Cyber Defence on the Digital Frontline: A Mission with NATO On a Mission with NATO: Cyber Defence on the Frontline Howest’s ongoing commitment to world-class cybersecurity training took center stage again as six lecturers from the Cyber Security program joined forces with experts from Latvia, Luxembourg and Belgium in one of NATO\u0026rsquo;s most intensive simulations: the Locked Shields exercise, hosted by the Cooperative Cyber Defence Centre of Excellence (CCDCOE). Now in its fifth year of participation, the Howest team shared their firsthand experiences at a special evening talk at Howest Bruges.\nThe Exercise: Locked Shields Locked Shields is no ordinary simulation. It is a full-scale, live-fire cyber defence exercise involving more than 6,000 machines and a narrative scenario so detailed it includes geopolitics, disinformation and even fictional countries. This year, the Blue Team 03 (our team) defended a simulated nation’s critical infrastructure including power plants, satellites, 5G networks and banking systems, all while under constant attack from a coordinated Red Team using automated scripts and over 28,000 attacks across two days.\nAnd yes, every team (Red, Blue, Yellow, White) uses Ansible. For everything.\nHigh Stakes, Real Lessons What do you do when a rogue process might be malware, or maybe just a poorly named service? What happens when your teammate refuses to act unless something is “officially malicious”? The team faced cultural clashes, communication breakdowns and stress-testing of both systems and people.\nThe exercise required more than technical fixes. It demanded communication with simulated commanders, media and public stakeholders. Reporting became just as important as patching. It taught participants how to translate technical impact into real-world consequences. Not \u0026ldquo;port 8443 unreachable\u0026rdquo;, but \u0026ldquo;our air defence system is degraded, and we cannot fly planes\u0026rdquo;.\nThe Black Team: Rapid Response in Action A new but powerful presence in the simulation was the Black Team, a rapid-response unit deployed when problems became too complex for any single team. Acting like special forces, they jumped in when incidents crossed team boundaries or demanded unconventional solutions. Their mission was to find out what was happening, assess the impact and suggest fast, creative responses. Introduced just last year, this team quickly proved its value again in 2025. They even embraced the role with style — “you can wear sunglasses inside” became their unofficial motto.\nTheir presence underlined a critical lesson: not every problem fits neatly within a team’s silo. Real-world defence requires flexibility, speed and lateral thinking.\nHighlights and Blooper Reel There were plenty of mishaps. Misfired scripts, team mix-ups, and one case where a DNS setup from a previous year was reused by mistake. Someone tried renaming cut to shutdown, breaking essential operations until it was fixed. Systems rebooted into chaos, a manual was uploaded to public GitHub, and the team had to quickly learn the difference between symbolic links and real binaries.\nHuman Factors and Growth From detecting malware with Velociraptor and Q9, to encountering teammates who took orders literally, the learning was intense. One participant noted that while Belgian and Luxembourg teams prioritized knowledge sharing, others preferred strict protocol. This highlighted cultural differences and the importance of interpersonal skills.\nThe biggest lesson? You are never fully prepared. Every iteration of Locked Shields is different. But each one sharpens not only your skills, but also your ability to function as a team under extreme conditions.\nFrom the Battlefield to the Classroom This experience directly impacts the classroom. Inspired by the exercise, Howest is introducing new hands-on courses like “Glutamine” in semester five. Students will be dropped into realistic broken networks, with misconfigurations, fake firewalls and simulated threats. It is chaos, but controlled. And that is the point.\nAs one speaker said: “You don’t win Locked Shields. You just survive it better than the rest.”\nFinal Thoughts The exercise teaches more than just cybersecurity. It builds trust. It proves that knowing your teammates can be as important as knowing the tools. Whether that comes from a shared flight or a pre-exercise barbecue, it all matters when the pressure hits.\nWant to see how cyber defence works in real life? This is it.\n","date":"May 13, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog-1_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog-1_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-1/","title":"Cyber Defence on the Digital Frontline: A Mission with NATO"},{"categories":["cybersecurity","CTF","education"],"contents":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience On March 14 and 15, I joined the Cyber Security Challenge Belgium qualifiers with three teammates. For two days, we threw ourselves at CTF challenges covering binary exploitation, Android reversing, cryptography, and more.\nWhat follows is a recap of the challenges I personally worked on—some I solved, some I didn’t—but all of them left me with new skills and new ideas.\nA Buffer Overflow to Warm Up One of the first challenges I picked involved a binary with a basic stack overflow. I used standard techniques—finding the offset, hijacking the return address, and injecting shellcode. Tools like pwntools helped automate the payload crafting. It was a great warm-up and a confidence boost once it worked.\nBinary Exploitation Flag\rCryptography and Pattern Matching Another crypto puzzle asked us to match a generated ASCII art banner to its underlying seed. Once I understood how the randomness was embedded into the banner, I brute-forced the space with a simple pattern-matching script. The exercise was clean, deterministic, and satisfying to solve.\nOurEncIsSec: Zip Bombs and OEIS Then there was a more elaborate cryptography challenge: 18 zip files, each password-protected. We cracked the first three passwords using John the Ripper and got numeric values from them. I searched the sequence in OEIS and found it matched A007408, which gave us the full pattern of passwords.\nUsing this, I could extract all zip contents automatically, reconstruct the password-protected message, and finally reveal the flag.\nPicture of the solution\rInfinite Luck: One in a Million? One challenge involved “guessing” a thousand random numbers between 1 and 10. The banner claimed it required infinite luck—but of course, the randomness was seeded. After inspecting the generator, I realized it was deterministic. By precomputing seeds and output sequences, I could match the challenge’s banner to a specific seed and regenerate the entire solution.\nBinary Exploitation Flag\rBinary Exploitation Flag\rAndroid Reversing: FRIDA and JADX Several APKs were part of the qualifier set. I used JADX to decompile them and FRIDA to patch logic at runtime. In one challenge, I bypassed license validation by forcing key methods to return true and unlocking hidden functionality.\nThe Challenge That Stuck with Me: Rebuilding a Split DEX This one stood out.\nThe app used a 4×8 button grid. Pressing buttons loaded a sequence of blockXX files from assets. These were concatenated in-memory and passed into InMemoryDexClassLoader to load a class called be.dauntless.flag.Flag.\nClass loadClass = new InMemoryDexClassLoader(ByteBuffer.wrap(byteArrayOutputStream.toByteArray()), getClassLoader()) .loadClass(\u0026#34;be.dauntless.flag.Flag\u0026#34;); Each block was a fragment of a DEX file, but the app didn’t tell you the right order. I tried manually inspecting the fragments—identifying methods, string constants, and offsets—to infer how to reassemble the full file. I got close, but didn’t crack it in time.\nThat challenge stuck with me because it combined static analysis, runtime introspection, and logic reconstruction. It wasn’t just technical—it was creative.\nThe One That Got Away: TLS Fingerprinting Another challenge involved a Go-based TLS server that rejected all client connections unless they matched a specific fingerprint. I used Go’s tls.Config to replicate the version, cipher suites, and ALPN:\ntls.Config{ MinVersion: tls.VersionTLS13, CipherSuites: []uint16{ tls.TLS_AES_128_GCM_SHA256, // ... }, NextProtos: []string{\u0026#34;h2\u0026#34;}, } Despite that, the server still refused the connection. I suspect it was using JA4 or similar TLS fingerprinting techniques we couldn’t fully emulate. We had to move on—but I’d love to revisit that one someday.\nFinal Thoughts I didn’t solve everything. But that wasn’t the point. Every challenge was a practical puzzle—something to decode, reverse, bypass, or just understand a little better.\nWorking as a team with Evarist, Nathan, and Waut made it even more valuable. We bounced ideas off each other, divided tasks, and got a much broader set of challenges covered.\nThe Cyber Security Challenge Belgium qualifiers weren’t easy. But they were the best kind of difficult—the kind that teaches you something whether you solve the problem or not.\n","date":"March 15, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/post-2/binexpl_hu_3d36b409c72f3586.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"160\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/post-2\\/binexpl_hu_afca672637b6b98d.png';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-2/","title":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience"},{"categories":null,"contents":"I built my personal blog using Hugo and deployed it on a lightweight Alpine Linux VPS. I chose this setup to have full control, keep things simple, and avoid bloated platforms or services. Here’s how the process went from site generation to live deployment.\nCreating the Hugo Site On my development machine, I created a new Hugo site:\nhugo new site howest-blog I used the professors-hugo theme and copied its exampleSite content into my project. I customized the layout, structure, and styling by editing content files, SCSS in assets/scss/custom.scss, and partial templates in the theme directory.\nAll content lives under content/, with separate folders for blog/ and project/, each containing .md files with front matter and Markdown content.\nCustomization I edited the config/_default/hugo.toml to configure site parameters like the base URL, theme, language, and menus. SCSS and image assets go in assets/, and are processed by Hugo\u0026rsquo;s pipeline. Static files like favicons are placed in static/.\nTo preview the site locally:\nhugo server To build the static site:\nhugo This generates everything in the public/ folder.\nVPS Deployment I rented a minimal Alpine Linux VPS and installed only what I needed. After setting up SSH and a basic nginx web server, I copied the public/ folder over using scp:\nscp -r public/* user@my-vps:/var/www/html On the VPS, I installed nginx:\napk add nginx And configured /etc/nginx/conf.d/default.conf to serve files from /var/www/html. Then I enabled and started nginx:\nrc-service nginx start rc-update add nginx Now my Hugo site is live and served directly as static files—no backend, no database, just HTML, CSS, and JS.\nWhy Alpine + Hugo? Alpine Linux is minimal and fast, perfect for serving static sites with low resource usage. Combined with Hugo’s speed and flexibility, I get a complete, performant setup that I fully control. It’s secure, lightweight, and easy to update—just rebuild and re-upload the public/ folder.\nThis setup is perfect if you want full control and minimal overhead for a personal blog or portfolio.\n","date":"May 29, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-2/","title":"Building My Hugo Website on a VPS"},{"categories":null,"contents":"DRMDTool is an automation-centric utility designed to streamline the processing of .drmd files by tightly integrating with the N_m3u8DL-RE downloader. The tool offers robust automation via a watch folder and an intuitive web-based interface, significantly reducing the friction for managing and processing DRM-protected streaming content.\nWhat’s New DRMDTool has evolved into a comprehensive platform for batch downloading with enhanced support for user interaction and background processing. It features granular job tracking, dynamic download control (pause, resume, abort), and a refined WebSocket-based console for real-time command output. Subtitle handling now includes automatic downloading and conversion from VTT to SRT, and the downloader adapts based on metadata, organizing content into categorized directories.\nGoals and Use Case The primary aim is to automate .drmd file processing with minimal manual input. Users can configure download formats, specify directories, and enable real-time command broadcasting. DRMDTool is suitable for both interactive use through a web UI and headless automation in pipelines, supporting inotify or polling-based folder watching.\nHow .drmd Files Work A .drmd file is a structured JSON document that defines one or more encrypted media items to be processed by DRMDTool. It contains an Items array, with each item representing a specific media job. DRMDTool parses these entries to generate download commands for N_m3u8DL-RE.\nEach item includes:\nMPD: A DASH manifest, either a direct URL or a base64-encoded version. If base64-encoded, DRMDTool decodes and temporarily saves it before use. Keys: A comma-separated list of KID:key pairs (e.g., abcd1234ef567890:00112233445566778899aabbccddeeff). These are required for decrypting encrypted media streams and are passed directly to N_m3u8DL-RE using --key flags. Filename: The name to be used for the final output file. Subtitles: Comma-separated list of subtitle URLs in .vtt format. DRMDTool downloads and converts these to .srt, then muxes them into the final file. Metadata: A semicolon-separated string like Title;Type;Season (e.g., Example Show;serie;1) used to determine directory structure (Movies/Title or Series/Title/Season). Description and Poster: Optional fields used only for display in the web UI. Example .drmd Structure { \u0026#34;Items\u0026#34;: [ { \u0026#34;MPD\u0026#34;: \u0026#34;aHR0cHM6Ly9leGFtcGxlLmNvbS9zdHJlYW0ubXBk\u0026#34;, \u0026#34;Keys\u0026#34;: \u0026#34;abcd1234ef567890:00112233445566778899aabbccddeeff\u0026#34;, \u0026#34;Filename\u0026#34;: \u0026#34;ExampleShow.S01E01\u0026#34;, \u0026#34;Subtitles\u0026#34;: \u0026#34;https://example.com/sub1.vtt,https://example.com/sub2.vtt\u0026#34;, \u0026#34;Metadata\u0026#34;: \u0026#34;Example Show;serie;1\u0026#34;, \u0026#34;Description\u0026#34;: \u0026#34;Pilot episode\u0026#34;, \u0026#34;Poster\u0026#34;: \u0026#34;\u0026#34; } ] } Processing Steps Detection: DRMDTool either watches a folder or receives .drmd uploads through the web UI. Validation: It waits for the file to finish writing (based on file size stability), then parses its contents. MPD Handling: If base64-encoded, the MPD is decoded and written to a temp file; otherwise, the URL is fetched or passed as-is. Command Generation: Using the MPD, KID:key pairs, output paths, and subtitles, DRMDTool builds a command line for N_m3u8DL-RE. Execution: The download is launched with live progress tracking. Users can pause, resume, or abort jobs, and optionally stream console output via WebSocket. These files serve as portable job definitions. When DRMDTool detects or receives a .drmd file, it parses the items, decodes or downloads the MPD, applies the keys, and builds a download command using N_m3u8DL-RE. Files are saved in organized directories like Movies/Title or Series/Title/Season, and subtitles are embedded if available. Pausing, resuming, and aborting downloads is supported per file.\nArchitecture Overview The configuration is handled via config.toml, with environment variable overrides for containerized or dynamic deployments. Once started, the tool can either monitor a specified folder or allow file uploads through the UI. Each .drmd file is parsed, grouped by series and season (if applicable), and processed sequentially with support for job pausing and resuming.\nWeb UI \u0026amp; CLI To use:\n./drmdtool Visit http://localhost:8080 for the web interface, which supports drag-and-drop uploads, selection of episodes or movies, and real-time progress tracking. For headless operation:\n./drmdtool -f /path/to/file.drmd Jobs can be paused, resumed, or aborted through the web interface, which reflects the backend state via live updates.\nEnhanced Download Logic DRMDTool dynamically builds download commands using metadata from .drmd files and user preferences. It ensures that only the highest quality streams are kept, removing ad periods and duplicate segments from the MPD files. Subtitles are fetched and embedded automatically. Jobs are tracked with robust state management and logs for debugging and visibility.\nRepository Code and setup instructions are hosted here: https://git.directme.in/Joren/DRMDTool\nDRMDtool For advanced usage details, customization, and API structure, refer to the README.md in the repository.\nUI Previews Index Page Select Page Progress Page ","date":"May 21, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-1/","title":"DRMDTool Project"},{"categories":["cybersecurity","event recap"],"contents":"Cyber Defence on the Digital Frontline: A Mission with NATO On a Mission with NATO: Cyber Defence on the Frontline Howest’s ongoing commitment to world-class cybersecurity training took center stage again as six lecturers from the Cyber Security program joined forces with experts from Latvia, Luxembourg and Belgium in one of NATO\u0026rsquo;s most intensive simulations: the Locked Shields exercise, hosted by the Cooperative Cyber Defence Centre of Excellence (CCDCOE). Now in its fifth year of participation, the Howest team shared their firsthand experiences at a special evening talk at Howest Bruges.\nThe Exercise: Locked Shields Locked Shields is no ordinary simulation. It is a full-scale, live-fire cyber defence exercise involving more than 6,000 machines and a narrative scenario so detailed it includes geopolitics, disinformation and even fictional countries. This year, the Blue Team 03 (our team) defended a simulated nation’s critical infrastructure including power plants, satellites, 5G networks and banking systems, all while under constant attack from a coordinated Red Team using automated scripts and over 28,000 attacks across two days.\nAnd yes, every team (Red, Blue, Yellow, White) uses Ansible. For everything.\nHigh Stakes, Real Lessons What do you do when a rogue process might be malware, or maybe just a poorly named service? What happens when your teammate refuses to act unless something is “officially malicious”? The team faced cultural clashes, communication breakdowns and stress-testing of both systems and people.\nThe exercise required more than technical fixes. It demanded communication with simulated commanders, media and public stakeholders. Reporting became just as important as patching. It taught participants how to translate technical impact into real-world consequences. Not \u0026ldquo;port 8443 unreachable\u0026rdquo;, but \u0026ldquo;our air defence system is degraded, and we cannot fly planes\u0026rdquo;.\nThe Black Team: Rapid Response in Action A new but powerful presence in the simulation was the Black Team, a rapid-response unit deployed when problems became too complex for any single team. Acting like special forces, they jumped in when incidents crossed team boundaries or demanded unconventional solutions. Their mission was to find out what was happening, assess the impact and suggest fast, creative responses. Introduced just last year, this team quickly proved its value again in 2025. They even embraced the role with style — “you can wear sunglasses inside” became their unofficial motto.\nTheir presence underlined a critical lesson: not every problem fits neatly within a team’s silo. Real-world defence requires flexibility, speed and lateral thinking.\nHighlights and Blooper Reel There were plenty of mishaps. Misfired scripts, team mix-ups, and one case where a DNS setup from a previous year was reused by mistake. Someone tried renaming cut to shutdown, breaking essential operations until it was fixed. Systems rebooted into chaos, a manual was uploaded to public GitHub, and the team had to quickly learn the difference between symbolic links and real binaries.\nHuman Factors and Growth From detecting malware with Velociraptor and Q9, to encountering teammates who took orders literally, the learning was intense. One participant noted that while Belgian and Luxembourg teams prioritized knowledge sharing, others preferred strict protocol. This highlighted cultural differences and the importance of interpersonal skills.\nThe biggest lesson? You are never fully prepared. Every iteration of Locked Shields is different. But each one sharpens not only your skills, but also your ability to function as a team under extreme conditions.\nFrom the Battlefield to the Classroom This experience directly impacts the classroom. Inspired by the exercise, Howest is introducing new hands-on courses like “Glutamine” in semester five. Students will be dropped into realistic broken networks, with misconfigurations, fake firewalls and simulated threats. It is chaos, but controlled. And that is the point.\nAs one speaker said: “You don’t win Locked Shields. You just survive it better than the rest.”\nFinal Thoughts The exercise teaches more than just cybersecurity. It builds trust. It proves that knowing your teammates can be as important as knowing the tools. Whether that comes from a shared flight or a pre-exercise barbecue, it all matters when the pressure hits.\nWant to see how cyber defence works in real life? This is it.\n","date":"May 13, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog-1_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog-1_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-1/","title":"Cyber Defence on the Digital Frontline: A Mission with NATO"},{"categories":null,"contents":"I built my personal blog using Hugo and deployed it on a lightweight Alpine Linux VPS. I chose this setup to have full control, keep things simple, and avoid bloated platforms or services. Here’s how the process went from site generation to live deployment.\nCreating the Hugo Site On my development machine, I created a new Hugo site:\nhugo new site howest-blog I used the professors-hugo theme and copied its exampleSite content into my project. I customized the layout, structure, and styling by editing content files, SCSS in assets/scss/custom.scss, and partial templates in the theme directory.\nAll content lives under content/, with separate folders for blog/ and project/, each containing .md files with front matter and Markdown content.\nCustomization I edited the config/_default/hugo.toml to configure site parameters like the base URL, theme, language, and menus. SCSS and image assets go in assets/, and are processed by Hugo\u0026rsquo;s pipeline. Static files like favicons are placed in static/.\nTo preview the site locally:\nhugo server To build the static site:\nhugo This generates everything in the public/ folder.\nVPS Deployment I rented a minimal Alpine Linux VPS and installed only what I needed. After setting up SSH and a basic nginx web server, I copied the public/ folder over using scp:\nscp -r public/* user@my-vps:/var/www/html On the VPS, I installed nginx:\napk add nginx And configured /etc/nginx/conf.d/default.conf to serve files from /var/www/html. Then I enabled and started nginx:\nrc-service nginx start rc-update add nginx Now my Hugo site is live and served directly as static files—no backend, no database, just HTML, CSS, and JS.\nWhy Alpine + Hugo? Alpine Linux is minimal and fast, perfect for serving static sites with low resource usage. Combined with Hugo’s speed and flexibility, I get a complete, performant setup that I fully control. It’s secure, lightweight, and easy to update—just rebuild and re-upload the public/ folder.\nThis setup is perfect if you want full control and minimal overhead for a personal blog or portfolio.\n","date":"May 29, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-2/","title":"Building My Hugo Website on a VPS"},{"categories":null,"contents":"DRMDTool is an automation-centric utility designed to streamline the processing of .drmd files by tightly integrating with the N_m3u8DL-RE downloader. The tool offers robust automation via a watch folder and an intuitive web-based interface, significantly reducing the friction for managing and processing DRM-protected streaming content.\nWhat’s New DRMDTool has evolved into a comprehensive platform for batch downloading with enhanced support for user interaction and background processing. It features granular job tracking, dynamic download control (pause, resume, abort), and a refined WebSocket-based console for real-time command output. Subtitle handling now includes automatic downloading and conversion from VTT to SRT, and the downloader adapts based on metadata, organizing content into categorized directories.\nGoals and Use Case The primary aim is to automate .drmd file processing with minimal manual input. Users can configure download formats, specify directories, and enable real-time command broadcasting. DRMDTool is suitable for both interactive use through a web UI and headless automation in pipelines, supporting inotify or polling-based folder watching.\nHow .drmd Files Work A .drmd file is a structured JSON document that defines one or more encrypted media items to be processed by DRMDTool. It contains an Items array, with each item representing a specific media job. DRMDTool parses these entries to generate download commands for N_m3u8DL-RE.\nEach item includes:\nMPD: A DASH manifest, either a direct URL or a base64-encoded version. If base64-encoded, DRMDTool decodes and temporarily saves it before use. Keys: A comma-separated list of KID:key pairs (e.g., abcd1234ef567890:00112233445566778899aabbccddeeff). These are required for decrypting encrypted media streams and are passed directly to N_m3u8DL-RE using --key flags. Filename: The name to be used for the final output file. Subtitles: Comma-separated list of subtitle URLs in .vtt format. DRMDTool downloads and converts these to .srt, then muxes them into the final file. Metadata: A semicolon-separated string like Title;Type;Season (e.g., Example Show;serie;1) used to determine directory structure (Movies/Title or Series/Title/Season). Description and Poster: Optional fields used only for display in the web UI. Example .drmd Structure { \u0026#34;Items\u0026#34;: [ { \u0026#34;MPD\u0026#34;: \u0026#34;aHR0cHM6Ly9leGFtcGxlLmNvbS9zdHJlYW0ubXBk\u0026#34;, \u0026#34;Keys\u0026#34;: \u0026#34;abcd1234ef567890:00112233445566778899aabbccddeeff\u0026#34;, \u0026#34;Filename\u0026#34;: \u0026#34;ExampleShow.S01E01\u0026#34;, \u0026#34;Subtitles\u0026#34;: \u0026#34;https://example.com/sub1.vtt,https://example.com/sub2.vtt\u0026#34;, \u0026#34;Metadata\u0026#34;: \u0026#34;Example Show;serie;1\u0026#34;, \u0026#34;Description\u0026#34;: \u0026#34;Pilot episode\u0026#34;, \u0026#34;Poster\u0026#34;: \u0026#34;\u0026#34; } ] } Processing Steps Detection: DRMDTool either watches a folder or receives .drmd uploads through the web UI. Validation: It waits for the file to finish writing (based on file size stability), then parses its contents. MPD Handling: If base64-encoded, the MPD is decoded and written to a temp file; otherwise, the URL is fetched or passed as-is. Command Generation: Using the MPD, KID:key pairs, output paths, and subtitles, DRMDTool builds a command line for N_m3u8DL-RE. Execution: The download is launched with live progress tracking. Users can pause, resume, or abort jobs, and optionally stream console output via WebSocket. These files serve as portable job definitions. When DRMDTool detects or receives a .drmd file, it parses the items, decodes or downloads the MPD, applies the keys, and builds a download command using N_m3u8DL-RE. Files are saved in organized directories like Movies/Title or Series/Title/Season, and subtitles are embedded if available. Pausing, resuming, and aborting downloads is supported per file.\nArchitecture Overview The configuration is handled via config.toml, with environment variable overrides for containerized or dynamic deployments. Once started, the tool can either monitor a specified folder or allow file uploads through the UI. Each .drmd file is parsed, grouped by series and season (if applicable), and processed sequentially with support for job pausing and resuming.\nWeb UI \u0026amp; CLI To use:\n./drmdtool Visit http://localhost:8080 for the web interface, which supports drag-and-drop uploads, selection of episodes or movies, and real-time progress tracking. For headless operation:\n./drmdtool -f /path/to/file.drmd Jobs can be paused, resumed, or aborted through the web interface, which reflects the backend state via live updates.\nEnhanced Download Logic DRMDTool dynamically builds download commands using metadata from .drmd files and user preferences. It ensures that only the highest quality streams are kept, removing ad periods and duplicate segments from the MPD files. Subtitles are fetched and embedded automatically. Jobs are tracked with robust state management and logs for debugging and visibility.\nRepository Code and setup instructions are hosted here: https://git.directme.in/Joren/DRMDTool\nDRMDtool For advanced usage details, customization, and API structure, refer to the README.md in the repository.\nUI Previews Index Page Select Page Progress Page ","date":"May 21, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-1/","title":"DRMDTool Project"},{"categories":["cybersecurity","event recap"],"contents":"Cyber Defence on the Digital Frontline: A Mission with NATO On a Mission with NATO: Cyber Defence on the Frontline Howest’s ongoing commitment to world-class cybersecurity training took center stage again as six lecturers from the Cyber Security program joined forces with experts from Latvia, Luxembourg and Belgium in one of NATO\u0026rsquo;s most intensive simulations: the Locked Shields exercise, hosted by the Cooperative Cyber Defence Centre of Excellence (CCDCOE). Now in its fifth year of participation, the Howest team shared their firsthand experiences at a special evening talk at Howest Bruges.\nThe Exercise: Locked Shields Locked Shields is no ordinary simulation. It is a full-scale, live-fire cyber defence exercise involving more than 6,000 machines and a narrative scenario so detailed it includes geopolitics, disinformation and even fictional countries. This year, the Blue Team 03 (our team) defended a simulated nation’s critical infrastructure including power plants, satellites, 5G networks and banking systems, all while under constant attack from a coordinated Red Team using automated scripts and over 28,000 attacks across two days.\nAnd yes, every team (Red, Blue, Yellow, White) uses Ansible. For everything.\nHigh Stakes, Real Lessons What do you do when a rogue process might be malware, or maybe just a poorly named service? What happens when your teammate refuses to act unless something is “officially malicious”? The team faced cultural clashes, communication breakdowns and stress-testing of both systems and people.\nThe exercise required more than technical fixes. It demanded communication with simulated commanders, media and public stakeholders. Reporting became just as important as patching. It taught participants how to translate technical impact into real-world consequences. Not \u0026ldquo;port 8443 unreachable\u0026rdquo;, but \u0026ldquo;our air defence system is degraded, and we cannot fly planes\u0026rdquo;.\nThe Black Team: Rapid Response in Action A new but powerful presence in the simulation was the Black Team, a rapid-response unit deployed when problems became too complex for any single team. Acting like special forces, they jumped in when incidents crossed team boundaries or demanded unconventional solutions. Their mission was to find out what was happening, assess the impact and suggest fast, creative responses. Introduced just last year, this team quickly proved its value again in 2025. They even embraced the role with style — “you can wear sunglasses inside” became their unofficial motto.\nTheir presence underlined a critical lesson: not every problem fits neatly within a team’s silo. Real-world defence requires flexibility, speed and lateral thinking.\nHighlights and Blooper Reel There were plenty of mishaps. Misfired scripts, team mix-ups, and one case where a DNS setup from a previous year was reused by mistake. Someone tried renaming cut to shutdown, breaking essential operations until it was fixed. Systems rebooted into chaos, a manual was uploaded to public GitHub, and the team had to quickly learn the difference between symbolic links and real binaries.\nHuman Factors and Growth From detecting malware with Velociraptor and Q9, to encountering teammates who took orders literally, the learning was intense. One participant noted that while Belgian and Luxembourg teams prioritized knowledge sharing, others preferred strict protocol. This highlighted cultural differences and the importance of interpersonal skills.\nThe biggest lesson? You are never fully prepared. Every iteration of Locked Shields is different. But each one sharpens not only your skills, but also your ability to function as a team under extreme conditions.\nFrom the Battlefield to the Classroom This experience directly impacts the classroom. Inspired by the exercise, Howest is introducing new hands-on courses like “Glutamine” in semester five. Students will be dropped into realistic broken networks, with misconfigurations, fake firewalls and simulated threats. It is chaos, but controlled. And that is the point.\nAs one speaker said: “You don’t win Locked Shields. You just survive it better than the rest.”\nFinal Thoughts The exercise teaches more than just cybersecurity. It builds trust. It proves that knowing your teammates can be as important as knowing the tools. Whether that comes from a shared flight or a pre-exercise barbecue, it all matters when the pressure hits.\nWant to see how cyber defence works in real life? This is it.\n","date":"May 13, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog-1_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog-1_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-1/","title":"Cyber Defence on the Digital Frontline: A Mission with NATO"},{"categories":["cybersecurity","CTF","education"],"contents":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience On March 14 and 15, I joined the Cyber Security Challenge Belgium qualifiers with three teammates. For two days, we threw ourselves at CTF challenges covering binary exploitation, Android reversing, cryptography, and more.\nWhat follows is a recap of the challenges I personally worked on—some I solved, some I didn’t—but all of them left me with new skills and new ideas.\nA Buffer Overflow to Warm Up One of the first challenges I picked involved a binary with a basic stack overflow. I used standard techniques—finding the offset, hijacking the return address, and injecting shellcode. Tools like pwntools helped automate the payload crafting. It was a great warm-up and a confidence boost once it worked.\nBinary Exploitation Flag\rCryptography and Pattern Matching Another crypto puzzle asked us to match a generated ASCII art banner to its underlying seed. Once I understood how the randomness was embedded into the banner, I brute-forced the space with a simple pattern-matching script. The exercise was clean, deterministic, and satisfying to solve.\nOurEncIsSec: Zip Bombs and OEIS Then there was a more elaborate cryptography challenge: 18 zip files, each password-protected. We cracked the first three passwords using John the Ripper and got numeric values from them. I searched the sequence in OEIS and found it matched A007408, which gave us the full pattern of passwords.\nUsing this, I could extract all zip contents automatically, reconstruct the password-protected message, and finally reveal the flag.\nPicture of the solution\rInfinite Luck: One in a Million? One challenge involved “guessing” a thousand random numbers between 1 and 10. The banner claimed it required infinite luck—but of course, the randomness was seeded. After inspecting the generator, I realized it was deterministic. By precomputing seeds and output sequences, I could match the challenge’s banner to a specific seed and regenerate the entire solution.\nChallange picture\rCorrect number order\rAndroid Reversing: FRIDA and JADX Several APKs were part of the qualifier set. I used JADX to decompile them and FRIDA to patch logic at runtime. In one challenge, I bypassed license validation by forcing key methods to return true and unlocking hidden functionality.\nThe Challenge That Stuck with Me: Rebuilding a Split DEX This one stood out.\nThe app used a 4×8 button grid. Pressing buttons loaded a sequence of blockXX files from assets. These were concatenated in-memory and passed into InMemoryDexClassLoader to load a class called be.dauntless.flag.Flag.\nClass loadClass = new InMemoryDexClassLoader(ByteBuffer.wrap(byteArrayOutputStream.toByteArray()), getClassLoader()) .loadClass(\u0026#34;be.dauntless.flag.Flag\u0026#34;); Each block was a fragment of a DEX file, but the app didn’t tell you the right order. I tried manually inspecting the fragments—identifying methods, string constants, and offsets—to infer how to reassemble the full file. I got close, but didn’t crack it in time.\nThat challenge stuck with me because it combined static analysis, runtime introspection, and logic reconstruction. It wasn’t just technical—it was creative.\nThe One That Got Away: TLS Fingerprinting Another challenge involved a Go-based TLS server that rejected all client connections unless they matched a specific fingerprint. I used Go’s tls.Config to replicate the version, cipher suites, and ALPN:\ntls.Config{ MinVersion: tls.VersionTLS13, CipherSuites: []uint16{ tls.TLS_AES_128_GCM_SHA256, // ... }, NextProtos: []string{\u0026#34;h2\u0026#34;}, } Despite that, the server still refused the connection. I suspect it was using JA4 or similar TLS fingerprinting techniques we couldn’t fully emulate. We had to move on—but I’d love to revisit that one someday.\nFinal Thoughts I didn’t solve everything. But that wasn’t the point. Every challenge was a practical puzzle—something to decode, reverse, bypass, or just understand a little better.\nWorking as a team with Evarist, Nathan, and Waut made it even more valuable. We bounced ideas off each other, divided tasks, and got a much broader set of challenges covered.\nThe Cyber Security Challenge Belgium qualifiers weren’t easy. But they were the best kind of difficult—the kind that teaches you something whether you solve the problem or not.\n","date":"March 15, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/post-2/binexpl_hu_3d36b409c72f3586.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"160\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/post-2\\/binexpl_hu_afca672637b6b98d.png';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-2/","title":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience"},{"categories":null,"contents":"I built my personal blog using Hugo and deployed it on a lightweight Alpine Linux VPS. I chose this setup to have full control, keep things simple, and avoid bloated platforms or services. Here’s how the process went from site generation to live deployment.\nCreating the Hugo Site On my development machine, I created a new Hugo site:\nhugo new site howest-blog I used the professors-hugo theme and copied its exampleSite content into my project. I customized the layout, structure, and styling by editing content files, SCSS in assets/scss/custom.scss, and partial templates in the theme directory.\nAll content lives under content/, with separate folders for blog/ and project/, each containing .md files with front matter and Markdown content.\nCustomization I edited the config/_default/hugo.toml to configure site parameters like the base URL, theme, language, and menus. SCSS and image assets go in assets/, and are processed by Hugo\u0026rsquo;s pipeline. Static files like favicons are placed in static/.\nTo preview the site locally:\nhugo server To build the static site:\nhugo This generates everything in the public/ folder.\nVPS Deployment I rented a minimal Alpine Linux VPS and installed only what I needed. After setting up SSH and a basic nginx web server, I copied the public/ folder over using scp:\nscp -r public/* user@my-vps:/var/www/html On the VPS, I installed nginx:\napk add nginx And configured /etc/nginx/conf.d/default.conf to serve files from /var/www/html. Then I enabled and started nginx:\nrc-service nginx start rc-update add nginx Now my Hugo site is live and served directly as static files—no backend, no database, just HTML, CSS, and JS.\nWhy Alpine + Hugo? Alpine Linux is minimal and fast, perfect for serving static sites with low resource usage. Combined with Hugo’s speed and flexibility, I get a complete, performant setup that I fully control. It’s secure, lightweight, and easy to update—just rebuild and re-upload the public/ folder.\nThis setup is perfect if you want full control and minimal overhead for a personal blog or portfolio.\n","date":"May 29, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-2/","title":"Building My Hugo Website on a VPS"},{"categories":null,"contents":"DRMDTool is an automation-centric utility designed to streamline the processing of .drmd files by tightly integrating with the N_m3u8DL-RE downloader. The tool offers robust automation via a watch folder and an intuitive web-based interface, significantly reducing the friction for managing and processing DRM-protected streaming content.\nWhat’s New DRMDTool has evolved into a comprehensive platform for batch downloading with enhanced support for user interaction and background processing. It features granular job tracking, dynamic download control (pause, resume, abort), and a refined WebSocket-based console for real-time command output. Subtitle handling now includes automatic downloading and conversion from VTT to SRT, and the downloader adapts based on metadata, organizing content into categorized directories.\nGoals and Use Case The primary aim is to automate .drmd file processing with minimal manual input. Users can configure download formats, specify directories, and enable real-time command broadcasting. DRMDTool is suitable for both interactive use through a web UI and headless automation in pipelines, supporting inotify or polling-based folder watching.\nHow .drmd Files Work A .drmd file is a structured JSON document that defines one or more encrypted media items to be processed by DRMDTool. It contains an Items array, with each item representing a specific media job. DRMDTool parses these entries to generate download commands for N_m3u8DL-RE.\nEach item includes:\nMPD: A DASH manifest, either a direct URL or a base64-encoded version. If base64-encoded, DRMDTool decodes and temporarily saves it before use. Keys: A comma-separated list of KID:key pairs (e.g., abcd1234ef567890:00112233445566778899aabbccddeeff). These are required for decrypting encrypted media streams and are passed directly to N_m3u8DL-RE using --key flags. Filename: The name to be used for the final output file. Subtitles: Comma-separated list of subtitle URLs in .vtt format. DRMDTool downloads and converts these to .srt, then muxes them into the final file. Metadata: A semicolon-separated string like Title;Type;Season (e.g., Example Show;serie;1) used to determine directory structure (Movies/Title or Series/Title/Season). Description and Poster: Optional fields used only for display in the web UI. Example .drmd Structure { \u0026#34;Items\u0026#34;: [ { \u0026#34;MPD\u0026#34;: \u0026#34;aHR0cHM6Ly9leGFtcGxlLmNvbS9zdHJlYW0ubXBk\u0026#34;, \u0026#34;Keys\u0026#34;: \u0026#34;abcd1234ef567890:00112233445566778899aabbccddeeff\u0026#34;, \u0026#34;Filename\u0026#34;: \u0026#34;ExampleShow.S01E01\u0026#34;, \u0026#34;Subtitles\u0026#34;: \u0026#34;https://example.com/sub1.vtt,https://example.com/sub2.vtt\u0026#34;, \u0026#34;Metadata\u0026#34;: \u0026#34;Example Show;serie;1\u0026#34;, \u0026#34;Description\u0026#34;: \u0026#34;Pilot episode\u0026#34;, \u0026#34;Poster\u0026#34;: \u0026#34;\u0026#34; } ] } Processing Steps Detection: DRMDTool either watches a folder or receives .drmd uploads through the web UI. Validation: It waits for the file to finish writing (based on file size stability), then parses its contents. MPD Handling: If base64-encoded, the MPD is decoded and written to a temp file; otherwise, the URL is fetched or passed as-is. Command Generation: Using the MPD, KID:key pairs, output paths, and subtitles, DRMDTool builds a command line for N_m3u8DL-RE. Execution: The download is launched with live progress tracking. Users can pause, resume, or abort jobs, and optionally stream console output via WebSocket. These files serve as portable job definitions. When DRMDTool detects or receives a .drmd file, it parses the items, decodes or downloads the MPD, applies the keys, and builds a download command using N_m3u8DL-RE. Files are saved in organized directories like Movies/Title or Series/Title/Season, and subtitles are embedded if available. Pausing, resuming, and aborting downloads is supported per file.\nArchitecture Overview The configuration is handled via config.toml, with environment variable overrides for containerized or dynamic deployments. Once started, the tool can either monitor a specified folder or allow file uploads through the UI. Each .drmd file is parsed, grouped by series and season (if applicable), and processed sequentially with support for job pausing and resuming.\nWeb UI \u0026amp; CLI To use:\n./drmdtool Visit http://localhost:8080 for the web interface, which supports drag-and-drop uploads, selection of episodes or movies, and real-time progress tracking. For headless operation:\n./drmdtool -f /path/to/file.drmd Jobs can be paused, resumed, or aborted through the web interface, which reflects the backend state via live updates.\nEnhanced Download Logic DRMDTool dynamically builds download commands using metadata from .drmd files and user preferences. It ensures that only the highest quality streams are kept, removing ad periods and duplicate segments from the MPD files. Subtitles are fetched and embedded automatically. Jobs are tracked with robust state management and logs for debugging and visibility.\nRepository Code and setup instructions are hosted here: https://git.directme.in/Joren/DRMDTool\nDRMDtool For advanced usage details, customization, and API structure, refer to the README.md in the repository.\nUI Previews Index Page Select Page Progress Page ","date":"May 21, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-1/","title":"DRMDTool Project"},{"categories":["cybersecurity","event recap"],"contents":"Cyber Defence on the Digital Frontline: A Mission with NATO On a Mission with NATO: Cyber Defence on the Frontline Howest’s ongoing commitment to world-class cybersecurity training took center stage again as six lecturers from the Cyber Security program joined forces with experts from Latvia, Luxembourg and Belgium in one of NATO\u0026rsquo;s most intensive simulations: the Locked Shields exercise, hosted by the Cooperative Cyber Defence Centre of Excellence (CCDCOE). Now in its fifth year of participation, the Howest team shared their firsthand experiences at a special evening talk at Howest Bruges.\nThe Exercise: Locked Shields Locked Shields is no ordinary simulation. It is a full-scale, live-fire cyber defence exercise involving more than 6,000 machines and a narrative scenario so detailed it includes geopolitics, disinformation and even fictional countries. This year, the Blue Team 03 (our team) defended a simulated nation’s critical infrastructure including power plants, satellites, 5G networks and banking systems, all while under constant attack from a coordinated Red Team using automated scripts and over 28,000 attacks across two days.\nAnd yes, every team (Red, Blue, Yellow, White) uses Ansible. For everything.\nHigh Stakes, Real Lessons What do you do when a rogue process might be malware, or maybe just a poorly named service? What happens when your teammate refuses to act unless something is “officially malicious”? The team faced cultural clashes, communication breakdowns and stress-testing of both systems and people.\nThe exercise required more than technical fixes. It demanded communication with simulated commanders, media and public stakeholders. Reporting became just as important as patching. It taught participants how to translate technical impact into real-world consequences. Not \u0026ldquo;port 8443 unreachable\u0026rdquo;, but \u0026ldquo;our air defence system is degraded, and we cannot fly planes\u0026rdquo;.\nThe Black Team: Rapid Response in Action A new but powerful presence in the simulation was the Black Team, a rapid-response unit deployed when problems became too complex for any single team. Acting like special forces, they jumped in when incidents crossed team boundaries or demanded unconventional solutions. Their mission was to find out what was happening, assess the impact and suggest fast, creative responses. Introduced just last year, this team quickly proved its value again in 2025. They even embraced the role with style — “you can wear sunglasses inside” became their unofficial motto.\nTheir presence underlined a critical lesson: not every problem fits neatly within a team’s silo. Real-world defence requires flexibility, speed and lateral thinking.\nHighlights and Blooper Reel There were plenty of mishaps. Misfired scripts, team mix-ups, and one case where a DNS setup from a previous year was reused by mistake. Someone tried renaming cut to shutdown, breaking essential operations until it was fixed. Systems rebooted into chaos, a manual was uploaded to public GitHub, and the team had to quickly learn the difference between symbolic links and real binaries.\nHuman Factors and Growth From detecting malware with Velociraptor and Q9, to encountering teammates who took orders literally, the learning was intense. One participant noted that while Belgian and Luxembourg teams prioritized knowledge sharing, others preferred strict protocol. This highlighted cultural differences and the importance of interpersonal skills.\nThe biggest lesson? You are never fully prepared. Every iteration of Locked Shields is different. But each one sharpens not only your skills, but also your ability to function as a team under extreme conditions.\nFrom the Battlefield to the Classroom This experience directly impacts the classroom. Inspired by the exercise, Howest is introducing new hands-on courses like “Glutamine” in semester five. Students will be dropped into realistic broken networks, with misconfigurations, fake firewalls and simulated threats. It is chaos, but controlled. And that is the point.\nAs one speaker said: “You don’t win Locked Shields. You just survive it better than the rest.”\nFinal Thoughts The exercise teaches more than just cybersecurity. It builds trust. It proves that knowing your teammates can be as important as knowing the tools. Whether that comes from a shared flight or a pre-exercise barbecue, it all matters when the pressure hits.\nWant to see how cyber defence works in real life? This is it.\n","date":"May 13, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog-1_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog-1_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-1/","title":"Cyber Defence on the Digital Frontline: A Mission with NATO"},{"categories":["cybersecurity","CTF","education"],"contents":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience On March 14 and 15, I joined the Cyber Security Challenge Belgium qualifiers with three teammates. For two days, we threw ourselves at CTF challenges covering binary exploitation, Android reversing, cryptography, and more.\nWhat follows is a recap of the challenges I personally worked on—some I solved, some I didn’t—but all of them left me with new skills and new ideas.\nA Buffer Overflow to Warm Up One of the first challenges I picked involved a binary with a basic stack overflow. I used standard techniques—finding the offset, hijacking the return address, and injecting shellcode. Tools like pwntools helped automate the payload crafting. It was a great warm-up and a confidence boost once it worked.\nBinary Exploitation Flag\rOurEncIsSec: Zip Bombs and OEIS Then there was a more elaborate cryptography challenge: 18 zip files, each password-protected. We cracked the first three passwords using John the Ripper and got numeric values from them. I searched the sequence in OEIS and found it matched A007408, which gave us the full pattern of passwords.\nUsing this, I could extract all zip contents automatically, reconstruct the password-protected message, and finally reveal the flag.\nPicture of the solution\rInfinite Luck: One in a Million? One challenge involved “guessing” a thousand random numbers between 1 and 10. The banner claimed it required infinite luck—but of course, the randomness was seeded. After inspecting the generator, I realized it was deterministic. By precomputing seeds and output sequences, I could match the challenge’s banner to a specific seed and regenerate the entire solution.\nChallange picture\rCorrect number order\rAndroid Reversing: FRIDA and JADX Several APKs were part of the qualifier set. I used JADX to decompile them and FRIDA to patch logic at runtime. In one challenge, I bypassed license validation by forcing key methods to return true and unlocking hidden functionality.\nThe Challenge That Stuck with Me: Rebuilding a Split DEX This one stood out.\nThe app used a 4×8 button grid. Pressing buttons loaded a sequence of blockXX files from assets. These were concatenated in-memory and passed into InMemoryDexClassLoader to load a class called be.dauntless.flag.Flag.\nClass loadClass = new InMemoryDexClassLoader(ByteBuffer.wrap(byteArrayOutputStream.toByteArray()), getClassLoader()) .loadClass(\u0026#34;be.dauntless.flag.Flag\u0026#34;); Each block was a fragment of a DEX file, but the app didn’t tell you the right order. I tried manually inspecting the fragments—identifying methods, string constants, and offsets—to infer how to reassemble the full file. I got close, but didn’t crack it in time.\nThat challenge stuck with me because it combined static analysis, runtime introspection, and logic reconstruction. It wasn’t just technical—it was creative.\nThe One That Got Away: TLS Fingerprinting Another challenge involved a Go-based TLS server that rejected all client connections unless they matched a specific fingerprint. I used Go’s tls.Config to replicate the version, cipher suites, and ALPN:\ntls.Config{ MinVersion: tls.VersionTLS13, CipherSuites: []uint16{ tls.TLS_AES_128_GCM_SHA256, // ... }, NextProtos: []string{\u0026#34;h2\u0026#34;}, } Despite that, the server still refused the connection. I suspect it was using JA4 or similar TLS fingerprinting techniques we couldn’t fully emulate. We had to move on—but I’d love to revisit that one someday.\nFinal Thoughts I didn’t solve everything. But that wasn’t the point. Every challenge was a practical puzzle—something to decode, reverse, bypass, or just understand a little better.\nWorking as a team with Evarist, Nathan, and Waut made it even more valuable. We bounced ideas off each other, divided tasks, and got a much broader set of challenges covered.\nThe Cyber Security Challenge Belgium qualifiers weren’t easy. But they were the best kind of difficult—the kind that teaches you something whether you solve the problem or not.\n","date":"March 15, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/post-2/binexpl_hu_3d36b409c72f3586.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"160\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/post-2\\/binexpl_hu_afca672637b6b98d.png';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-2/","title":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience"},{"categories":null,"contents":"I built my personal blog using Hugo and deployed it on a lightweight Alpine Linux VPS. I chose this setup to have full control, keep things simple, and avoid bloated platforms or services. Here’s how the process went from site generation to live deployment.\nCreating the Hugo Site On my development machine, I created a new Hugo site:\nhugo new site howest-blog I used the professors-hugo theme and copied its exampleSite content into my project. I customized the layout, structure, and styling by editing content files, SCSS in assets/scss/custom.scss, and partial templates in the theme directory.\nAll content lives under content/, with separate folders for blog/ and project/, each containing .md files with front matter and Markdown content.\nCustomization I edited the config/_default/hugo.toml to configure site parameters like the base URL, theme, language, and menus. SCSS and image assets go in assets/, and are processed by Hugo\u0026rsquo;s pipeline. Static files like favicons are placed in static/.\nTo preview the site locally:\nhugo server To build the static site:\nhugo This generates everything in the public/ folder.\nVPS Deployment I rented a minimal Alpine Linux VPS and installed only what I needed. After setting up SSH and a basic nginx web server, I copied the public/ folder over using scp:\nscp -r public/* user@my-vps:/var/www/html On the VPS, I installed nginx:\napk add nginx And configured /etc/nginx/conf.d/default.conf to serve files from /var/www/html. Then I enabled and started nginx:\nrc-service nginx start rc-update add nginx Now my Hugo site is live and served directly as static files—no backend, no database, just HTML, CSS, and JS.\nWhy Alpine + Hugo? Alpine Linux is minimal and fast, perfect for serving static sites with low resource usage. Combined with Hugo’s speed and flexibility, I get a complete, performant setup that I fully control. It’s secure, lightweight, and easy to update—just rebuild and re-upload the public/ folder.\nThis setup is perfect if you want full control and minimal overhead for a personal blog or portfolio.\n","date":"May 29, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-2/","title":"Building My Hugo Website on a VPS"},{"categories":null,"contents":"DRMDTool is an automation-centric utility designed to streamline the processing of .drmd files by tightly integrating with the N_m3u8DL-RE downloader. The tool offers robust automation via a watch folder and an intuitive web-based interface, significantly reducing the friction for managing and processing DRM-protected streaming content.\nWhat’s New DRMDTool has evolved into a comprehensive platform for batch downloading with enhanced support for user interaction and background processing. It features granular job tracking, dynamic download control (pause, resume, abort), and a refined WebSocket-based console for real-time command output. Subtitle handling now includes automatic downloading and conversion from VTT to SRT, and the downloader adapts based on metadata, organizing content into categorized directories.\nGoals and Use Case The primary aim is to automate .drmd file processing with minimal manual input. Users can configure download formats, specify directories, and enable real-time command broadcasting. DRMDTool is suitable for both interactive use through a web UI and headless automation in pipelines, supporting inotify or polling-based folder watching.\nHow .drmd Files Work A .drmd file is a structured JSON document that defines one or more encrypted media items to be processed by DRMDTool. It contains an Items array, with each item representing a specific media job. DRMDTool parses these entries to generate download commands for N_m3u8DL-RE.\nEach item includes:\nMPD: A DASH manifest, either a direct URL or a base64-encoded version. If base64-encoded, DRMDTool decodes and temporarily saves it before use. Keys: A comma-separated list of KID:key pairs (e.g., abcd1234ef567890:00112233445566778899aabbccddeeff). These are required for decrypting encrypted media streams and are passed directly to N_m3u8DL-RE using --key flags. Filename: The name to be used for the final output file. Subtitles: Comma-separated list of subtitle URLs in .vtt format. DRMDTool downloads and converts these to .srt, then muxes them into the final file. Metadata: A semicolon-separated string like Title;Type;Season (e.g., Example Show;serie;1) used to determine directory structure (Movies/Title or Series/Title/Season). Description and Poster: Optional fields used only for display in the web UI. Example .drmd Structure { \u0026#34;Items\u0026#34;: [ { \u0026#34;MPD\u0026#34;: \u0026#34;aHR0cHM6Ly9leGFtcGxlLmNvbS9zdHJlYW0ubXBk\u0026#34;, \u0026#34;Keys\u0026#34;: \u0026#34;abcd1234ef567890:00112233445566778899aabbccddeeff\u0026#34;, \u0026#34;Filename\u0026#34;: \u0026#34;ExampleShow.S01E01\u0026#34;, \u0026#34;Subtitles\u0026#34;: \u0026#34;https://example.com/sub1.vtt,https://example.com/sub2.vtt\u0026#34;, \u0026#34;Metadata\u0026#34;: \u0026#34;Example Show;serie;1\u0026#34;, \u0026#34;Description\u0026#34;: \u0026#34;Pilot episode\u0026#34;, \u0026#34;Poster\u0026#34;: \u0026#34;\u0026#34; } ] } Processing Steps Detection: DRMDTool either watches a folder or receives .drmd uploads through the web UI. Validation: It waits for the file to finish writing (based on file size stability), then parses its contents. MPD Handling: If base64-encoded, the MPD is decoded and written to a temp file; otherwise, the URL is fetched or passed as-is. Command Generation: Using the MPD, KID:key pairs, output paths, and subtitles, DRMDTool builds a command line for N_m3u8DL-RE. Execution: The download is launched with live progress tracking. Users can pause, resume, or abort jobs, and optionally stream console output via WebSocket. These files serve as portable job definitions. When DRMDTool detects or receives a .drmd file, it parses the items, decodes or downloads the MPD, applies the keys, and builds a download command using N_m3u8DL-RE. Files are saved in organized directories like Movies/Title or Series/Title/Season, and subtitles are embedded if available. Pausing, resuming, and aborting downloads is supported per file.\nArchitecture Overview The configuration is handled via config.toml, with environment variable overrides for containerized or dynamic deployments. Once started, the tool can either monitor a specified folder or allow file uploads through the UI. Each .drmd file is parsed, grouped by series and season (if applicable), and processed sequentially with support for job pausing and resuming.\nWeb UI \u0026amp; CLI To use:\n./drmdtool Visit http://localhost:8080 for the web interface, which supports drag-and-drop uploads, selection of episodes or movies, and real-time progress tracking. For headless operation:\n./drmdtool -f /path/to/file.drmd Jobs can be paused, resumed, or aborted through the web interface, which reflects the backend state via live updates.\nEnhanced Download Logic DRMDTool dynamically builds download commands using metadata from .drmd files and user preferences. It ensures that only the highest quality streams are kept, removing ad periods and duplicate segments from the MPD files. Subtitles are fetched and embedded automatically. Jobs are tracked with robust state management and logs for debugging and visibility.\nRepository Code and setup instructions are hosted here: https://git.directme.in/Joren/DRMDTool\nDRMDtool For advanced usage details, customization, and API structure, refer to the README.md in the repository.\nUI Previews Index Page Select Page Progress Page ","date":"May 21, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-1/","title":"DRMDTool Project"},{"categories":["cybersecurity","event recap"],"contents":"Cyber Defence on the Digital Frontline: A Mission with NATO On a Mission with NATO: Cyber Defence on the Frontline Howest’s ongoing commitment to world-class cybersecurity training took center stage again as six lecturers from the Cyber Security program joined forces with experts from Latvia, Luxembourg and Belgium in one of NATO\u0026rsquo;s most intensive simulations: the Locked Shields exercise, hosted by the Cooperative Cyber Defence Centre of Excellence (CCDCOE). Now in its fifth year of participation, the Howest team shared their firsthand experiences at a special evening talk at Howest Bruges.\nThe Exercise: Locked Shields Locked Shields is no ordinary simulation. It is a full-scale, live-fire cyber defence exercise involving more than 6,000 machines and a narrative scenario so detailed it includes geopolitics, disinformation and even fictional countries. This year, the Blue Team 03 (our team) defended a simulated nation’s critical infrastructure including power plants, satellites, 5G networks and banking systems, all while under constant attack from a coordinated Red Team using automated scripts and over 28,000 attacks across two days.\nAnd yes, every team (Red, Blue, Yellow, White) uses Ansible. For everything.\nHigh Stakes, Real Lessons What do you do when a rogue process might be malware, or maybe just a poorly named service? What happens when your teammate refuses to act unless something is “officially malicious”? The team faced cultural clashes, communication breakdowns and stress-testing of both systems and people.\nThe exercise required more than technical fixes. It demanded communication with simulated commanders, media and public stakeholders. Reporting became just as important as patching. It taught participants how to translate technical impact into real-world consequences. Not \u0026ldquo;port 8443 unreachable\u0026rdquo;, but \u0026ldquo;our air defence system is degraded, and we cannot fly planes\u0026rdquo;.\nThe Black Team: Rapid Response in Action A new but powerful presence in the simulation was the Black Team, a rapid-response unit deployed when problems became too complex for any single team. Acting like special forces, they jumped in when incidents crossed team boundaries or demanded unconventional solutions. Their mission was to find out what was happening, assess the impact and suggest fast, creative responses. Introduced just last year, this team quickly proved its value again in 2025. They even embraced the role with style — “you can wear sunglasses inside” became their unofficial motto.\nTheir presence underlined a critical lesson: not every problem fits neatly within a team’s silo. Real-world defence requires flexibility, speed and lateral thinking.\nHighlights and Blooper Reel There were plenty of mishaps. Misfired scripts, team mix-ups, and one case where a DNS setup from a previous year was reused by mistake. Someone tried renaming cut to shutdown, breaking essential operations until it was fixed. Systems rebooted into chaos, a manual was uploaded to public GitHub, and the team had to quickly learn the difference between symbolic links and real binaries.\nHuman Factors and Growth From detecting malware with Velociraptor and Q9, to encountering teammates who took orders literally, the learning was intense. One participant noted that while Belgian and Luxembourg teams prioritized knowledge sharing, others preferred strict protocol. This highlighted cultural differences and the importance of interpersonal skills.\nThe biggest lesson? You are never fully prepared. Every iteration of Locked Shields is different. But each one sharpens not only your skills, but also your ability to function as a team under extreme conditions.\nFrom the Battlefield to the Classroom This experience directly impacts the classroom. Inspired by the exercise, Howest is introducing new hands-on courses like “Glutamine” in semester five. Students will be dropped into realistic broken networks, with misconfigurations, fake firewalls and simulated threats. It is chaos, but controlled. And that is the point.\nAs one speaker said: “You don’t win Locked Shields. You just survive it better than the rest.”\nFinal Thoughts The exercise teaches more than just cybersecurity. It builds trust. It proves that knowing your teammates can be as important as knowing the tools. Whether that comes from a shared flight or a pre-exercise barbecue, it all matters when the pressure hits.\nWant to see how cyber defence works in real life? This is it.\n","date":"May 13, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog-1_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog-1_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-1/","title":"Cyber Defence on the Digital Frontline: A Mission with NATO"},{"categories":["cybersecurity","CTF","education"],"contents":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience On March 14 and 15, I joined the Cyber Security Challenge Belgium qualifiers with three teammates. For two days, we threw ourselves at CTF challenges covering binary exploitation, Android reversing, cryptography, and more.\nWhat follows is a recap of the challenges I personally worked on—some I solved, some I didn’t—but all of them left me with new skills and new ideas.\nA Buffer Overflow to Warm Up One of the first challenges I picked involved a binary with a basic stack overflow. I used standard techniques—finding the offset, hijacking the return address, and injecting shellcode. Tools like pwntools helped automate the payload crafting. It was a great warm-up and a confidence boost once it worked.\nBinary Exploitation Flag\rOurEncIsSec: Zip Bombs and OEIS Then there was a more elaborate cryptography challenge: 18 zip files, each password-protected. We cracked the first three passwords using John the Ripper and got numeric values from them. I searched the sequence in OEIS and found it matched A007408, which gave us the full pattern of passwords.\nUsing this, I could extract all zip contents automatically, reconstruct the password-protected message, and finally reveal the flag.\nPicture of the solution\rInfinite Luck: One in a Million? One challenge involved “guessing” a thousand random numbers between 1 and 10. The banner claimed it required infinite luck—but of course, the randomness was seeded. After inspecting the generator, I realized it was deterministic. By precomputing seeds and output sequences, I could match the challenge’s banner to a specific seed and regenerate the entire solution.\nChallange picture\rCorrect number order\rAndroid Reversing: FRIDA and JADX Several APKs were part of the qualifier set. I used JADX to decompile them and FRIDA to patch logic at runtime. In one challenge, I bypassed license validation by forcing key methods to return true and unlocking hidden functionality.\nThe Challenge That Stuck with Me: Rebuilding a Split DEX This one stood out.\nThe app used a 4×8 button grid. Pressing buttons loaded a sequence of blockXX files from assets. These were concatenated in-memory and passed into InMemoryDexClassLoader to load a class called be.dauntless.flag.Flag.\nClass loadClass = new InMemoryDexClassLoader(ByteBuffer.wrap(byteArrayOutputStream.toByteArray()), getClassLoader()) .loadClass(\u0026#34;be.dauntless.flag.Flag\u0026#34;); Each block was a fragment of a DEX file, but the app didn’t tell you the right order. I tried manually inspecting the fragments—identifying methods, string constants, and offsets—to infer how to reassemble the full file. I got close, but didn’t crack it in time.\nThat challenge stuck with me because it combined static analysis, runtime introspection, and logic reconstruction. It wasn’t just technical—it was creative.\nThe One That Got Away: TLS Fingerprinting Another challenge involved a Go-based TLS server that rejected all client connections unless they matched a specific fingerprint. I used Go’s tls.Config to replicate the version, cipher suites, and ALPN:\ntls.Config{ MinVersion: tls.VersionTLS13, CipherSuites: []uint16{ tls.TLS_AES_128_GCM_SHA256, // ... }, NextProtos: []string{\u0026#34;h2\u0026#34;}, } Despite that, the server still refused the connection. I suspect it was using JA4 or similar TLS fingerprinting techniques we couldn’t fully emulate. We had to move on—but I’d love to revisit that one someday.\nFinal Thoughts I didn’t solve everything. But that wasn’t the point. Every challenge was a practical puzzle—something to decode, reverse, bypass, or just understand a little better.\nWorking as a team with Evarist, Nathan, and Waut made it even more valuable. We bounced ideas off each other, divided tasks, and got a much broader set of challenges covered.\nThe Cyber Security Challenge Belgium qualifiers weren’t easy. But they were the best kind of difficult, the kind that teaches you something whether you solve the problem or not.\n","date":"March 15, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/post-2/binexpl_hu_3d36b409c72f3586.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"160\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/post-2\\/binexpl_hu_afca672637b6b98d.png';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-2/","title":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience"},{"categories":null,"contents":"I built my personal blog using Hugo and deployed it on a lightweight Alpine Linux VPS. I chose this setup to have full control, keep things simple, and avoid bloated platforms or services. Here’s how the process went from site generation to live deployment.\nCreating the Hugo Site On my development machine, I created a new Hugo site:\nhugo new site howest-blog I used the professors-hugo theme and copied its exampleSite content into my project. I customized the layout, structure, and styling by editing content files, SCSS in assets/scss/custom.scss, and partial templates in the theme directory.\nAll content lives under content/, with separate folders for blog/ and project/, each containing .md files with front matter and Markdown content.\nCustomization I edited the config/_default/hugo.toml to configure site parameters like the base URL, theme, language, and menus. SCSS and image assets go in assets/, and are processed by Hugo\u0026rsquo;s pipeline. Static files like favicons are placed in static/.\nTo preview the site locally:\nhugo server To build the static site:\nhugo This generates everything in the public/ folder.\nVPS Deployment I rented a minimal Alpine Linux VPS and installed only what I needed. After setting up SSH and a basic nginx web server, I copied the public/ folder over using scp:\nscp -r public/* user@my-vps:/var/www/html On the VPS, I installed nginx:\napk add nginx And configured /etc/nginx/conf.d/default.conf to serve files from /var/www/html. Then I enabled and started nginx:\nrc-service nginx start rc-update add nginx Now my Hugo site is live and served directly as static files—no backend, no database, just HTML, CSS, and JS.\nWhy Alpine + Hugo? Alpine Linux is minimal and fast, perfect for serving static sites with low resource usage. Combined with Hugo’s speed and flexibility, I get a complete, performant setup that I fully control. It’s secure, lightweight, and easy to update—just rebuild and re-upload the public/ folder.\nThis setup is perfect if you want full control and minimal overhead for a personal blog or portfolio.\n","date":"May 29, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-2/","title":"Building My Hugo Website on a VPS"},{"categories":null,"contents":"DRMDTool is an automation-centric utility designed to streamline the processing of .drmd files by tightly integrating with the N_m3u8DL-RE downloader. The tool offers robust automation via a watch folder and an intuitive web-based interface, significantly reducing the friction for managing and processing DRM-protected streaming content.\nWhat’s New DRMDTool has evolved into a comprehensive platform for batch downloading with enhanced support for user interaction and background processing. It features granular job tracking, dynamic download control (pause, resume, abort), and a refined WebSocket-based console for real-time command output. Subtitle handling now includes automatic downloading and conversion from VTT to SRT, and the downloader adapts based on metadata, organizing content into categorized directories.\nGoals and Use Case The primary aim is to automate .drmd file processing with minimal manual input. Users can configure download formats, specify directories, and enable real-time command broadcasting. DRMDTool is suitable for both interactive use through a web UI and headless automation in pipelines, supporting inotify or polling-based folder watching.\nHow .drmd Files Work A .drmd file is a structured JSON document that defines one or more encrypted media items to be processed by DRMDTool. It contains an Items array, with each item representing a specific media job. DRMDTool parses these entries to generate download commands for N_m3u8DL-RE.\nEach item includes:\nMPD: A DASH manifest, either a direct URL or a base64-encoded version. If base64-encoded, DRMDTool decodes and temporarily saves it before use. Keys: A comma-separated list of KID:key pairs (e.g., abcd1234ef567890:00112233445566778899aabbccddeeff). These are required for decrypting encrypted media streams and are passed directly to N_m3u8DL-RE using --key flags. Filename: The name to be used for the final output file. Subtitles: Comma-separated list of subtitle URLs in .vtt format. DRMDTool downloads and converts these to .srt, then muxes them into the final file. Metadata: A semicolon-separated string like Title;Type;Season (e.g., Example Show;serie;1) used to determine directory structure (Movies/Title or Series/Title/Season). Description and Poster: Optional fields used only for display in the web UI. Example .drmd Structure { \u0026#34;Items\u0026#34;: [ { \u0026#34;MPD\u0026#34;: \u0026#34;aHR0cHM6Ly9leGFtcGxlLmNvbS9zdHJlYW0ubXBk\u0026#34;, \u0026#34;Keys\u0026#34;: \u0026#34;abcd1234ef567890:00112233445566778899aabbccddeeff\u0026#34;, \u0026#34;Filename\u0026#34;: \u0026#34;ExampleShow.S01E01\u0026#34;, \u0026#34;Subtitles\u0026#34;: \u0026#34;https://example.com/sub1.vtt,https://example.com/sub2.vtt\u0026#34;, \u0026#34;Metadata\u0026#34;: \u0026#34;Example Show;serie;1\u0026#34;, \u0026#34;Description\u0026#34;: \u0026#34;Pilot episode\u0026#34;, \u0026#34;Poster\u0026#34;: \u0026#34;\u0026#34; } ] } Processing Steps Detection: DRMDTool either watches a folder or receives .drmd uploads through the web UI. Validation: It waits for the file to finish writing (based on file size stability), then parses its contents. MPD Handling: If base64-encoded, the MPD is decoded and written to a temp file; otherwise, the URL is fetched or passed as-is. Command Generation: Using the MPD, KID:key pairs, output paths, and subtitles, DRMDTool builds a command line for N_m3u8DL-RE. Execution: The download is launched with live progress tracking. Users can pause, resume, or abort jobs, and optionally stream console output via WebSocket. These files serve as portable job definitions. When DRMDTool detects or receives a .drmd file, it parses the items, decodes or downloads the MPD, applies the keys, and builds a download command using N_m3u8DL-RE. Files are saved in organized directories like Movies/Title or Series/Title/Season, and subtitles are embedded if available. Pausing, resuming, and aborting downloads is supported per file.\nArchitecture Overview The configuration is handled via config.toml, with environment variable overrides for containerized or dynamic deployments. Once started, the tool can either monitor a specified folder or allow file uploads through the UI. Each .drmd file is parsed, grouped by series and season (if applicable), and processed sequentially with support for job pausing and resuming.\nWeb UI \u0026amp; CLI To use:\n./drmdtool Visit http://localhost:8080 for the web interface, which supports drag-and-drop uploads, selection of episodes or movies, and real-time progress tracking. For headless operation:\n./drmdtool -f /path/to/file.drmd Jobs can be paused, resumed, or aborted through the web interface, which reflects the backend state via live updates.\nEnhanced Download Logic DRMDTool dynamically builds download commands using metadata from .drmd files and user preferences. It ensures that only the highest quality streams are kept, removing ad periods and duplicate segments from the MPD files. Subtitles are fetched and embedded automatically. Jobs are tracked with robust state management and logs for debugging and visibility.\nRepository Code and setup instructions are hosted here: https://git.directme.in/Joren/DRMDTool\nDRMDtool For advanced usage details, customization, and API structure, refer to the README.md in the repository.\nUI Previews Index Page Select Page Progress Page ","date":"May 21, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-1/","title":"DRMDTool Project"},{"categories":["cybersecurity","event recap"],"contents":"Cyber Defence on the Digital Frontline: A Mission with NATO On a Mission with NATO: Cyber Defence on the Frontline Howest’s ongoing commitment to world-class cybersecurity training took center stage again as six lecturers from the Cyber Security program joined forces with experts from Latvia, Luxembourg and Belgium in one of NATO\u0026rsquo;s most intensive simulations: the Locked Shields exercise, hosted by the Cooperative Cyber Defence Centre of Excellence (CCDCOE). Now in its fifth year of participation, the Howest team shared their firsthand experiences at a special evening talk at Howest Bruges.\nThe Exercise: Locked Shields Locked Shields is no ordinary simulation. It is a full-scale, live-fire cyber defence exercise involving more than 6,000 machines and a narrative scenario so detailed it includes geopolitics, disinformation and even fictional countries. This year, the Blue Team 03 (our team) defended a simulated nation’s critical infrastructure including power plants, satellites, 5G networks and banking systems, all while under constant attack from a coordinated Red Team using automated scripts and over 28,000 attacks across two days.\nAnd yes, every team (Red, Blue, Yellow, White) uses Ansible. For everything.\nHigh Stakes, Real Lessons What do you do when a rogue process might be malware, or maybe just a poorly named service? What happens when your teammate refuses to act unless something is “officially malicious”? The team faced cultural clashes, communication breakdowns and stress-testing of both systems and people.\nThe exercise required more than technical fixes. It demanded communication with simulated commanders, media and public stakeholders. Reporting became just as important as patching. It taught participants how to translate technical impact into real-world consequences. Not \u0026ldquo;port 8443 unreachable\u0026rdquo;, but \u0026ldquo;our air defence system is degraded, and we cannot fly planes\u0026rdquo;.\nThe Black Team: Rapid Response in Action A new but powerful presence in the simulation was the Black Team, a rapid-response unit deployed when problems became too complex for any single team. Acting like special forces, they jumped in when incidents crossed team boundaries or demanded unconventional solutions. Their mission was to find out what was happening, assess the impact and suggest fast, creative responses. Introduced just last year, this team quickly proved its value again in 2025. They even embraced the role with style — “you can wear sunglasses inside” became their unofficial motto.\nTheir presence underlined a critical lesson: not every problem fits neatly within a team’s silo. Real-world defence requires flexibility, speed and lateral thinking.\nHighlights and Blooper Reel There were plenty of mishaps. Misfired scripts, team mix-ups, and one case where a DNS setup from a previous year was reused by mistake. Someone tried renaming cut to shutdown, breaking essential operations until it was fixed. Systems rebooted into chaos, a manual was uploaded to public GitHub, and the team had to quickly learn the difference between symbolic links and real binaries.\nHuman Factors and Growth From detecting malware with Velociraptor and Q9, to encountering teammates who took orders literally, the learning was intense. One participant noted that while Belgian and Luxembourg teams prioritized knowledge sharing, others preferred strict protocol. This highlighted cultural differences and the importance of interpersonal skills.\nThe biggest lesson? You are never fully prepared. Every iteration of Locked Shields is different. But each one sharpens not only your skills, but also your ability to function as a team under extreme conditions.\nFrom the Battlefield to the Classroom This experience directly impacts the classroom. Inspired by the exercise, Howest is introducing new hands-on courses like “Glutamine” in semester five. Students will be dropped into realistic broken networks, with misconfigurations, fake firewalls and simulated threats. It is chaos, but controlled. And that is the point.\nAs one speaker said: “You don’t win Locked Shields. You just survive it better than the rest.”\nFinal Thoughts The exercise teaches more than just cybersecurity. It builds trust. It proves that knowing your teammates can be as important as knowing the tools. Whether that comes from a shared flight or a pre-exercise barbecue, it all matters when the pressure hits.\nWant to see how cyber defence works in real life? This is it.\n","date":"May 13, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog-1_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog-1_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-1/","title":"Cyber Defence on the Digital Frontline: A Mission with NATO"},{"categories":null,"contents":"I built my personal blog using Hugo and deployed it on a lightweight Alpine Linux VPS. I chose this setup to have full control, keep things simple, and avoid bloated platforms or services. Here’s how the process went from site generation to live deployment.\nCreating the Hugo Site On my development machine, I created a new Hugo site:\nhugo new site howest-blog I used the professors-hugo theme and copied its exampleSite content into my project. I customized the layout, structure, and styling by editing content files, SCSS in assets/scss/custom.scss, and partial templates in the theme directory.\nAll content lives under content/, with separate folders for blog/ and project/, each containing .md files with front matter and Markdown content.\nCustomization I edited the config/_default/hugo.toml to configure site parameters like the base URL, theme, language, and menus. SCSS and image assets go in assets/, and are processed by Hugo\u0026rsquo;s pipeline. Static files like favicons are placed in static/.\nTo preview the site locally:\nhugo server To build the static site:\nhugo This generates everything in the public/ folder.\nVPS Deployment I rented a minimal Alpine Linux VPS and installed only what I needed. After setting up SSH and a basic nginx web server, I copied the public/ folder over using scp:\nscp -r public/* user@my-vps:/var/www/html On the VPS, I installed nginx:\napk add nginx And configured /etc/nginx/conf.d/default.conf to serve files from /var/www/html. Then I enabled and started nginx:\nrc-service nginx start rc-update add nginx Now my Hugo site is live and served directly as static files—no backend, no database, just HTML, CSS, and JS.\nWhy Alpine + Hugo? Alpine Linux is minimal and fast, perfect for serving static sites with low resource usage. Combined with Hugo’s speed and flexibility, I get a complete, performant setup that I fully control. It’s secure, lightweight, and easy to update—just rebuild and re-upload the public/ folder.\nThis setup is perfect if you want full control and minimal overhead for a personal blog or portfolio.\n","date":"May 29, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-2/","title":"Building My Hugo Website on a VPS"},{"categories":null,"contents":"DRMDTool is an automation-centric utility designed to streamline the processing of .drmd files by tightly integrating with the N_m3u8DL-RE downloader. The tool offers robust automation via a watch folder and an intuitive web-based interface, significantly reducing the friction for managing and processing DRM-protected streaming content.\nWhat’s New DRMDTool has evolved into a comprehensive platform for batch downloading with enhanced support for user interaction and background processing. It features granular job tracking, dynamic download control (pause, resume, abort), and a refined WebSocket-based console for real-time command output. Subtitle handling now includes automatic downloading and conversion from VTT to SRT, and the downloader adapts based on metadata, organizing content into categorized directories.\nGoals and Use Case The primary aim is to automate .drmd file processing with minimal manual input. Users can configure download formats, specify directories, and enable real-time command broadcasting. DRMDTool is suitable for both interactive use through a web UI and headless automation in pipelines, supporting inotify or polling-based folder watching.\nHow .drmd Files Work A .drmd file is a structured JSON document that defines one or more encrypted media items to be processed by DRMDTool. It contains an Items array, with each item representing a specific media job. DRMDTool parses these entries to generate download commands for N_m3u8DL-RE.\nEach item includes:\nMPD: A DASH manifest, either a direct URL or a base64-encoded version. If base64-encoded, DRMDTool decodes and temporarily saves it before use. Keys: A comma-separated list of KID:key pairs (e.g., abcd1234ef567890:00112233445566778899aabbccddeeff). These are required for decrypting encrypted media streams and are passed directly to N_m3u8DL-RE using --key flags. Filename: The name to be used for the final output file. Subtitles: Comma-separated list of subtitle URLs in .vtt format. DRMDTool downloads and converts these to .srt, then muxes them into the final file. Metadata: A semicolon-separated string like Title;Type;Season (e.g., Example Show;serie;1) used to determine directory structure (Movies/Title or Series/Title/Season). Description and Poster: Optional fields used only for display in the web UI. Example .drmd Structure { \u0026#34;Items\u0026#34;: [ { \u0026#34;MPD\u0026#34;: \u0026#34;aHR0cHM6Ly9leGFtcGxlLmNvbS9zdHJlYW0ubXBk\u0026#34;, \u0026#34;Keys\u0026#34;: \u0026#34;abcd1234ef567890:00112233445566778899aabbccddeeff\u0026#34;, \u0026#34;Filename\u0026#34;: \u0026#34;ExampleShow.S01E01\u0026#34;, \u0026#34;Subtitles\u0026#34;: \u0026#34;https://example.com/sub1.vtt,https://example.com/sub2.vtt\u0026#34;, \u0026#34;Metadata\u0026#34;: \u0026#34;Example Show;serie;1\u0026#34;, \u0026#34;Description\u0026#34;: \u0026#34;Pilot episode\u0026#34;, \u0026#34;Poster\u0026#34;: \u0026#34;\u0026#34; } ] } Processing Steps Detection: DRMDTool either watches a folder or receives .drmd uploads through the web UI. Validation: It waits for the file to finish writing (based on file size stability), then parses its contents. MPD Handling: If base64-encoded, the MPD is decoded and written to a temp file; otherwise, the URL is fetched or passed as-is. Command Generation: Using the MPD, KID:key pairs, output paths, and subtitles, DRMDTool builds a command line for N_m3u8DL-RE. Execution: The download is launched with live progress tracking. Users can pause, resume, or abort jobs, and optionally stream console output via WebSocket. These files serve as portable job definitions. When DRMDTool detects or receives a .drmd file, it parses the items, decodes or downloads the MPD, applies the keys, and builds a download command using N_m3u8DL-RE. Files are saved in organized directories like Movies/Title or Series/Title/Season, and subtitles are embedded if available. Pausing, resuming, and aborting downloads is supported per file.\nArchitecture Overview The configuration is handled via config.toml, with environment variable overrides for containerized or dynamic deployments. Once started, the tool can either monitor a specified folder or allow file uploads through the UI. Each .drmd file is parsed, grouped by series and season (if applicable), and processed sequentially with support for job pausing and resuming.\nWeb UI \u0026amp; CLI To use:\n./drmdtool Visit http://localhost:8080 for the web interface, which supports drag-and-drop uploads, selection of episodes or movies, and real-time progress tracking. For headless operation:\n./drmdtool -f /path/to/file.drmd Jobs can be paused, resumed, or aborted through the web interface, which reflects the backend state via live updates.\nEnhanced Download Logic DRMDTool dynamically builds download commands using metadata from .drmd files and user preferences. It ensures that only the highest quality streams are kept, removing ad periods and duplicate segments from the MPD files. Subtitles are fetched and embedded automatically. Jobs are tracked with robust state management and logs for debugging and visibility.\nRepository Code and setup instructions are hosted here: https://git.directme.in/Joren/DRMDTool\nDRMDtool For advanced usage details, customization, and API structure, refer to the README.md in the repository.\nUI Previews Index Page Select Page Progress Page ","date":"May 21, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-1/","title":"DRMDTool Project"},{"categories":["cybersecurity","event recap"],"contents":"Cyber Defence on the Digital Frontline: A Mission with NATO On a Mission with NATO: Cyber Defence on the Frontline Howest’s ongoing commitment to world-class cybersecurity training took center stage again as six lecturers from the Cyber Security program joined forces with experts from Latvia, Luxembourg and Belgium in one of NATO\u0026rsquo;s most intensive simulations: the Locked Shields exercise, hosted by the Cooperative Cyber Defence Centre of Excellence (CCDCOE). Now in its fifth year of participation, the Howest team shared their firsthand experiences at a special evening talk at Howest Bruges.\nThe Exercise: Locked Shields Locked Shields is no ordinary simulation. It is a full-scale, live-fire cyber defence exercise involving more than 6,000 machines and a narrative scenario so detailed it includes geopolitics, disinformation and even fictional countries. This year, the Blue Team 03 (our team) defended a simulated nation’s critical infrastructure including power plants, satellites, 5G networks and banking systems, all while under constant attack from a coordinated Red Team using automated scripts and over 28,000 attacks across two days.\nAnd yes, every team (Red, Blue, Yellow, White) uses Ansible. For everything.\nHigh Stakes, Real Lessons What do you do when a rogue process might be malware, or maybe just a poorly named service? What happens when your teammate refuses to act unless something is “officially malicious”? The team faced cultural clashes, communication breakdowns and stress-testing of both systems and people.\nThe exercise required more than technical fixes. It demanded communication with simulated commanders, media and public stakeholders. Reporting became just as important as patching. It taught participants how to translate technical impact into real-world consequences. Not \u0026ldquo;port 8443 unreachable\u0026rdquo;, but \u0026ldquo;our air defence system is degraded, and we cannot fly planes\u0026rdquo;.\nThe Black Team: Rapid Response in Action A new but powerful presence in the simulation was the Black Team, a rapid-response unit deployed when problems became too complex for any single team. Acting like special forces, they jumped in when incidents crossed team boundaries or demanded unconventional solutions. Their mission was to find out what was happening, assess the impact and suggest fast, creative responses. Introduced just last year, this team quickly proved its value again in 2025. They even embraced the role with style — “you can wear sunglasses inside” became their unofficial motto.\nTheir presence underlined a critical lesson: not every problem fits neatly within a team’s silo. Real-world defence requires flexibility, speed and lateral thinking.\nHighlights and Blooper Reel There were plenty of mishaps. Misfired scripts, team mix-ups, and one case where a DNS setup from a previous year was reused by mistake. Someone tried renaming cut to shutdown, breaking essential operations until it was fixed. Systems rebooted into chaos, a manual was uploaded to public GitHub, and the team had to quickly learn the difference between symbolic links and real binaries.\nHuman Factors and Growth From detecting malware with Velociraptor and Q9, to encountering teammates who took orders literally, the learning was intense. One participant noted that while Belgian and Luxembourg teams prioritized knowledge sharing, others preferred strict protocol. This highlighted cultural differences and the importance of interpersonal skills.\nThe biggest lesson? You are never fully prepared. Every iteration of Locked Shields is different. But each one sharpens not only your skills, but also your ability to function as a team under extreme conditions.\nFrom the Battlefield to the Classroom This experience directly impacts the classroom. Inspired by the exercise, Howest is introducing new hands-on courses like “Glutamine” in semester five. Students will be dropped into realistic broken networks, with misconfigurations, fake firewalls and simulated threats. It is chaos, but controlled. And that is the point.\nAs one speaker said: “You don’t win Locked Shields. You just survive it better than the rest.”\nFinal Thoughts The exercise teaches more than just cybersecurity. It builds trust. It proves that knowing your teammates can be as important as knowing the tools. Whether that comes from a shared flight or a pre-exercise barbecue, it all matters when the pressure hits.\nWant to see how cyber defence works in real life? This is it.\n","date":"May 13, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog-1_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog-1_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-1/","title":"Cyber Defence on the Digital Frontline: A Mission with NATO"},{"categories":["cybersecurity","CTF","education"],"contents":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience On March 14 and 15, I joined the Cyber Security Challenge Belgium qualifiers with three teammates. For two days, we threw ourselves at CTF challenges covering binary exploitation, Android reversing, cryptography, and more.\nWhat follows is a recap of the challenges I personally worked on—some I solved, some I didn’t—but all of them left me with new skills and new ideas.\nA Buffer Overflow to Warm Up One of the first challenges I picked involved a binary with a basic stack overflow. I used standard techniques—finding the offset, hijacking the return address, and injecting shellcode. Tools like pwntools helped automate the payload crafting. It was a great warm-up and a confidence boost once it worked.\nBinary Exploitation Flag\rOurEncIsSec: Zip Bombs and OEIS Then there was a more elaborate cryptography challenge: 18 zip files, each password-protected. We cracked the first three passwords using John the Ripper and got numeric values from them. I searched the sequence in OEIS and found it matched A007408, which gave us the full pattern of passwords.\nUsing this, I could extract all zip contents automatically, reconstruct the password-protected message, and finally reveal the flag.\nPicture of the solution\rInfinite Luck: One in a Million? One challenge involved “guessing” a thousand random numbers between 1 and 10. The banner claimed it required infinite luck—but of course, the randomness was seeded. After inspecting the generator, I realized it was deterministic. By precomputing seeds and output sequences, I could match the challenge’s banner to a specific seed and regenerate the entire solution.\nChallange picture\rCorrect number order\rAndroid Reversing: FRIDA and JADX Several APKs were part of the qualifier set. I used JADX to decompile them and FRIDA to patch logic at runtime. In one challenge, I bypassed license validation by forcing key methods to return true and unlocking hidden functionality.\nThe Challenge That Stuck with Me: Rebuilding a Split DEX This one stood out.\nThe app used a 4×8 button grid. Pressing buttons loaded a sequence of blockXX files from assets. These were concatenated in-memory and passed into InMemoryDexClassLoader to load a class called be.dauntless.flag.Flag.\nClass loadClass = new InMemoryDexClassLoader(ByteBuffer.wrap(byteArrayOutputStream.toByteArray()), getClassLoader()) .loadClass(\u0026#34;be.dauntless.flag.Flag\u0026#34;); Each block was a fragment of a DEX file, but the app didn’t tell you the right order. I tried manually inspecting the fragments—identifying methods, string constants, and offsets—to infer how to reassemble the full file. I got close, but didn’t crack it in time.\nThat challenge stuck with me because it combined static analysis, runtime introspection, and logic reconstruction. It wasn’t just technical—it was creative.\nThe One That Got Away: TLS Fingerprinting Another challenge involved a Go-based TLS server that rejected all client connections unless they matched a specific fingerprint. I used Go’s tls.Config to replicate the version, cipher suites, and ALPN:\ntls.Config{ MinVersion: tls.VersionTLS13, CipherSuites: []uint16{ tls.TLS_AES_128_GCM_SHA256, // ... }, NextProtos: []string{\u0026#34;h2\u0026#34;}, } Despite that, the server still refused the connection. I suspect it was using JA4 or similar TLS fingerprinting techniques we couldn’t fully emulate. We had to move on—but I’d love to revisit that one someday.\nFinal Thoughts I didn’t solve everything. But that wasn’t the point. Every challenge was a practical puzzle something to decode, reverse, bypass, or just understand a little better.\nWorking as a team with Evarist, Nathan, and Waut made it even more valuable. We bounced ideas off each other, divided tasks, and got a much broader set of challenges covered.\nThe Cyber Security Challenge Belgium qualifiers weren’t easy. But they were the best kind of difficult, the kind that teaches you something whether you solve the problem or not.\n","date":"March 15, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/post-2/binexpl_hu_3d36b409c72f3586.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"160\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/post-2\\/binexpl_hu_afca672637b6b98d.png';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-2/","title":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience"},{"categories":null,"contents":"I built my personal blog using Hugo and deployed it on a lightweight Alpine Linux VPS. I chose this setup to have full control, keep things simple, and avoid bloated platforms or services. Here’s how the process went from site generation to live deployment.\nCreating the Hugo Site On my development machine, I created a new Hugo site:\nhugo new site howest-blog I used the professors-hugo theme and copied its exampleSite content into my project. I customized the layout, structure, and styling by editing content files, SCSS in assets/scss/custom.scss, and partial templates in the theme directory.\nAll content lives under content/, with separate folders for blog/ and project/, each containing .md files with front matter and Markdown content.\nCustomization I edited the config/_default/hugo.toml to configure site parameters like the base URL, theme, language, and menus. SCSS and image assets go in assets/, and are processed by Hugo\u0026rsquo;s pipeline. Static files like favicons are placed in static/.\nTo preview the site locally:\nhugo server To build the static site:\nhugo This generates everything in the public/ folder.\nVPS Deployment I rented a minimal Alpine Linux VPS and installed only what I needed. After setting up SSH and a basic nginx web server, I copied the public/ folder over using scp:\nscp -r public/* user@my-vps:/var/www/html On the VPS, I installed nginx:\napk add nginx And configured /etc/nginx/conf.d/default.conf to serve files from /var/www/html. Then I enabled and started nginx:\nrc-service nginx start rc-update add nginx Now my Hugo site is live and served directly as static files—no backend, no database, just HTML, CSS, and JS.\nWhy Alpine + Hugo? Alpine Linux is minimal and fast, perfect for serving static sites with low resource usage. Combined with Hugo’s speed and flexibility, I get a complete, performant setup that I fully control. It’s secure, lightweight, and easy to update—just rebuild and re-upload the public/ folder.\nThis setup is perfect if you want full control and minimal overhead for a personal blog or portfolio.\n","date":"May 29, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-2/","title":"Building My Hugo Website on a VPS"},{"categories":null,"contents":"DRMDTool is an automation-centric utility designed to streamline the processing of .drmd files by tightly integrating with the N_m3u8DL-RE downloader. The tool offers robust automation via a watch folder and an intuitive web-based interface, significantly reducing the friction for managing and processing DRM-protected streaming content.\nWhat’s New DRMDTool has evolved into a comprehensive platform for batch downloading with enhanced support for user interaction and background processing. It features granular job tracking, dynamic download control (pause, resume, abort), and a refined WebSocket-based console for real-time command output. Subtitle handling now includes automatic downloading and conversion from VTT to SRT, and the downloader adapts based on metadata, organizing content into categorized directories.\nGoals and Use Case The primary aim is to automate .drmd file processing with minimal manual input. Users can configure download formats, specify directories, and enable real-time command broadcasting. DRMDTool is suitable for both interactive use through a web UI and headless automation in pipelines, supporting inotify or polling-based folder watching.\nHow .drmd Files Work A .drmd file is a structured JSON document that defines one or more encrypted media items to be processed by DRMDTool. It contains an Items array, with each item representing a specific media job. DRMDTool parses these entries to generate download commands for N_m3u8DL-RE.\nEach item includes:\nMPD: A DASH manifest, either a direct URL or a base64-encoded version. If base64-encoded, DRMDTool decodes and temporarily saves it before use. Keys: A comma-separated list of KID:key pairs (e.g., abcd1234ef567890:00112233445566778899aabbccddeeff). These are required for decrypting encrypted media streams and are passed directly to N_m3u8DL-RE using --key flags. Filename: The name to be used for the final output file. Subtitles: Comma-separated list of subtitle URLs in .vtt format. DRMDTool downloads and converts these to .srt, then muxes them into the final file. Metadata: A semicolon-separated string like Title;Type;Season (e.g., Example Show;serie;1) used to determine directory structure (Movies/Title or Series/Title/Season). Description and Poster: Optional fields used only for display in the web UI. Example .drmd Structure { \u0026#34;Items\u0026#34;: [ { \u0026#34;MPD\u0026#34;: \u0026#34;aHR0cHM6Ly9leGFtcGxlLmNvbS9zdHJlYW0ubXBk\u0026#34;, \u0026#34;Keys\u0026#34;: \u0026#34;abcd1234ef567890:00112233445566778899aabbccddeeff\u0026#34;, \u0026#34;Filename\u0026#34;: \u0026#34;ExampleShow.S01E01\u0026#34;, \u0026#34;Subtitles\u0026#34;: \u0026#34;https://example.com/sub1.vtt,https://example.com/sub2.vtt\u0026#34;, \u0026#34;Metadata\u0026#34;: \u0026#34;Example Show;serie;1\u0026#34;, \u0026#34;Description\u0026#34;: \u0026#34;Pilot episode\u0026#34;, \u0026#34;Poster\u0026#34;: \u0026#34;\u0026#34; } ] } Processing Steps Detection: DRMDTool either watches a folder or receives .drmd uploads through the web UI. Validation: It waits for the file to finish writing (based on file size stability), then parses its contents. MPD Handling: If base64-encoded, the MPD is decoded and written to a temp file; otherwise, the URL is fetched or passed as-is. Command Generation: Using the MPD, KID:key pairs, output paths, and subtitles, DRMDTool builds a command line for N_m3u8DL-RE. Execution: The download is launched with live progress tracking. Users can pause, resume, or abort jobs, and optionally stream console output via WebSocket. These files serve as portable job definitions. When DRMDTool detects or receives a .drmd file, it parses the items, decodes or downloads the MPD, applies the keys, and builds a download command using N_m3u8DL-RE. Files are saved in organized directories like Movies/Title or Series/Title/Season, and subtitles are embedded if available. Pausing, resuming, and aborting downloads is supported per file.\nArchitecture Overview The configuration is handled via config.toml, with environment variable overrides for containerized or dynamic deployments. Once started, the tool can either monitor a specified folder or allow file uploads through the UI. Each .drmd file is parsed, grouped by series and season (if applicable), and processed sequentially with support for job pausing and resuming.\nWeb UI \u0026amp; CLI To use:\n./drmdtool Visit http://localhost:8080 for the web interface, which supports drag-and-drop uploads, selection of episodes or movies, and real-time progress tracking. For headless operation:\n./drmdtool -f /path/to/file.drmd Jobs can be paused, resumed, or aborted through the web interface, which reflects the backend state via live updates.\nEnhanced Download Logic DRMDTool dynamically builds download commands using metadata from .drmd files and user preferences. It ensures that only the highest quality streams are kept, removing ad periods and duplicate segments from the MPD files. Subtitles are fetched and embedded automatically. Jobs are tracked with robust state management and logs for debugging and visibility.\nRepository Code and setup instructions are hosted here: https://git.directme.in/Joren/DRMDTool\nDRMDtool For advanced usage details, customization, and API structure, refer to the README.md in the repository.\nUI Previews Index Page Select Page Progress Page ","date":"May 21, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-1/","title":"DRMDTool Project"},{"categories":["cybersecurity","event recap"],"contents":"Cyber Defence on the Digital Frontline: A Mission with NATO On a Mission with NATO: Cyber Defence on the Frontline Howest’s ongoing commitment to world-class cybersecurity training took center stage again as six lecturers from the Cyber Security program joined forces with experts from Latvia, Luxembourg and Belgium in one of NATO\u0026rsquo;s most intensive simulations: the Locked Shields exercise, hosted by the Cooperative Cyber Defence Centre of Excellence (CCDCOE). Now in its fifth year of participation, the Howest team shared their firsthand experiences at a special evening talk at Howest Bruges.\nThe Exercise: Locked Shields Locked Shields is no ordinary simulation. It is a full-scale, live-fire cyber defence exercise involving more than 6,000 machines and a narrative scenario so detailed it includes geopolitics, disinformation and even fictional countries. This year, the Blue Team 03 (our team) defended a simulated nation’s critical infrastructure including power plants, satellites, 5G networks and banking systems, all while under constant attack from a coordinated Red Team using automated scripts and over 28,000 attacks across two days.\nAnd yes, every team (Red, Blue, Yellow, White) uses Ansible. For everything.\nHigh Stakes, Real Lessons What do you do when a rogue process might be malware, or maybe just a poorly named service? What happens when your teammate refuses to act unless something is “officially malicious”? The team faced cultural clashes, communication breakdowns and stress-testing of both systems and people.\nThe exercise required more than technical fixes. It demanded communication with simulated commanders, media and public stakeholders. Reporting became just as important as patching. It taught participants how to translate technical impact into real-world consequences. Not \u0026ldquo;port 8443 unreachable\u0026rdquo;, but \u0026ldquo;our air defence system is degraded, and we cannot fly planes\u0026rdquo;.\nThe Black Team: Rapid Response in Action A new but powerful presence in the simulation was the Black Team, a rapid-response unit deployed when problems became too complex for any single team. Acting like special forces, they jumped in when incidents crossed team boundaries or demanded unconventional solutions. Their mission was to find out what was happening, assess the impact and suggest fast, creative responses. Introduced just last year, this team quickly proved its value again in 2025. They even embraced the role with style — “you can wear sunglasses inside” became their unofficial motto.\nTheir presence underlined a critical lesson: not every problem fits neatly within a team’s silo. Real-world defence requires flexibility, speed and lateral thinking.\nHighlights and Blooper Reel There were plenty of mishaps. Misfired scripts, team mix-ups, and one case where a DNS setup from a previous year was reused by mistake. Someone tried renaming cut to shutdown, breaking essential operations until it was fixed. Systems rebooted into chaos, a manual was uploaded to public GitHub, and the team had to quickly learn the difference between symbolic links and real binaries.\nHuman Factors and Growth From detecting malware with Velociraptor and Q9, to encountering teammates who took orders literally, the learning was intense. One participant noted that while Belgian and Luxembourg teams prioritized knowledge sharing, others preferred strict protocol. This highlighted cultural differences and the importance of interpersonal skills.\nThe biggest lesson? You are never fully prepared. Every iteration of Locked Shields is different. But each one sharpens not only your skills, but also your ability to function as a team under extreme conditions.\nFrom the Battlefield to the Classroom This experience directly impacts the classroom. Inspired by the exercise, Howest is introducing new hands-on courses like “Glutamine” in semester five. Students will be dropped into realistic broken networks, with misconfigurations, fake firewalls and simulated threats. It is chaos, but controlled. And that is the point.\nAs one speaker said: “You don’t win Locked Shields. You just survive it better than the rest.”\nFinal Thoughts The exercise teaches more than just cybersecurity. It builds trust. It proves that knowing your teammates can be as important as knowing the tools. Whether that comes from a shared flight or a pre-exercise barbecue, it all matters when the pressure hits.\nWant to see how cyber defence works in real life? This is it.\n","date":"May 13, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog-1_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog-1_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-1/","title":"Cyber Defence on the Digital Frontline: A Mission with NATO"},{"categories":["cybersecurity","CTF","education"],"contents":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience On March 14 and 15, I joined the Cyber Security Challenge Belgium qualifiers with three teammates. For two days, we threw ourselves at CTF challenges covering binary exploitation, Android reversing, cryptography, and more.\nWhat follows is a recap of the challenges I personally worked on—some I solved, some I didn’t—but all of them left me with new skills and new ideas.\nA Buffer Overflow to Warm Up One of the first challenges I picked involved a binary with a basic stack overflow. I used standard techniques—finding the offset, hijacking the return address, and injecting shellcode. Tools like pwntools helped automate the payload crafting. It was a great warm-up and a confidence boost once it worked.\nBinary Exploitation Flag\rOurEncIsSec: Zip Bombs and OEIS Then there was a more elaborate cryptography challenge: 18 zip files, each password-protected. We cracked the first three passwords using John the Ripper and got numeric values from them. I searched the sequence in OEIS and found it matched A007408, which gave us the full pattern of passwords.\nUsing this, I could extract all zip contents automatically, reconstruct the password-protected message, and finally reveal the flag.\nPicture of the solution\rInfinite Luck: One in a Million? One challenge involved “guessing” a thousand random numbers between 1 and 10. The banner claimed it required infinite luck—but of course, the randomness was seeded. After inspecting the generator, I realized it was deterministic. By precomputing seeds and output sequences, I could match the challenge’s banner to a specific seed and regenerate the entire solution.\nChallange picture\rCorrect number order\rAndroid Reversing: FRIDA and JADX Several APKs were part of the qualifier set. I used JADX to decompile them and FRIDA to patch logic at runtime. In one challenge, I bypassed license validation by forcing key methods to return true and unlocking hidden functionality.\nThe Challenge That Stuck with Me: Rebuilding a Split DEX This one stood out.\nThe app used a 4×8 button grid. Pressing buttons loaded a sequence of blockXX files from assets. These were concatenated in-memory and passed into InMemoryDexClassLoader to load a class called be.dauntless.flag.Flag.\nClass loadClass = new InMemoryDexClassLoader(ByteBuffer.wrap(byteArrayOutputStream.toByteArray()), getClassLoader()) .loadClass(\u0026#34;be.dauntless.flag.Flag\u0026#34;); Each block was a fragment of a DEX file, but the app didn’t tell you the right order. I tried manually inspecting the fragments—identifying methods, string constants, and offsets—to infer how to reassemble the full file. I got close, but didn’t crack it in time.\nThat challenge stuck with me because it combined static analysis, runtime introspection, and logic reconstruction. It wasn’t just technical—it was creative.\nThe One That Got Away: TLS Fingerprinting Another challenge involved a Go-based TLS server that rejected all client connections unless they matched a specific fingerprint. I used Go’s tls.Config to replicate the version, cipher suites, and ALPN:\ntls.Config{ MinVersion: tls.VersionTLS13, CipherSuites: []uint16{ tls.TLS_AES_128_GCM_SHA256, // ... }, NextProtos: []string{\u0026#34;h2\u0026#34;}, } Despite that, the server still refused the connection. I suspect it was using JA4 or similar TLS fingerprinting techniques we couldn’t fully emulate. We had to move on—but I’d love to revisit that one someday.\nFinal Thoughts I didn’t solve everything. But that wasn’t the point. Every challenge was a practical puzzle, something to decode, reverse, bypass, or just understand a little better.\nWorking as a team with Evarist, Nathan, and Waut made it even more valuable. We bounced ideas off each other, divided tasks, and got a much broader set of challenges covered.\nThe Cyber Security Challenge Belgium qualifiers weren’t easy. But they were the best kind of difficult, the kind that teaches you something whether you solve the problem or not.\n","date":"March 15, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/post-2/binexpl_hu_3d36b409c72f3586.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"160\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/post-2\\/binexpl_hu_afca672637b6b98d.png';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-2/","title":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience"},{"categories":null,"contents":"I built my personal blog using Hugo and deployed it on a lightweight Alpine Linux VPS. I chose this setup to have full control, keep things simple, and avoid bloated platforms or services. Here’s how the process went from site generation to live deployment.\nCreating the Hugo Site On my development machine, I created a new Hugo site:\nhugo new site howest-blog I used the professors-hugo theme and copied its exampleSite content into my project. I customized the layout, structure, and styling by editing content files, SCSS in assets/scss/custom.scss, and partial templates in the theme directory.\nAll content lives under content/, with separate folders for blog/ and project/, each containing .md files with front matter and Markdown content.\nCustomization I edited the config/_default/hugo.toml to configure site parameters like the base URL, theme, language, and menus. SCSS and image assets go in assets/, and are processed by Hugo\u0026rsquo;s pipeline. Static files like favicons are placed in static/.\nTo preview the site locally:\nhugo server To build the static site:\nhugo This generates everything in the public/ folder.\nVPS Deployment I rented a minimal Alpine Linux VPS and installed only what I needed. After setting up SSH and a basic nginx web server, I copied the public/ folder over using scp:\nscp -r public/* user@my-vps:/var/www/html On the VPS, I installed nginx:\napk add nginx And configured /etc/nginx/conf.d/default.conf to serve files from /var/www/html. Then I enabled and started nginx:\nrc-service nginx start rc-update add nginx Now my Hugo site is live and served directly as static files—no backend, no database, just HTML, CSS, and JS.\nWhy Alpine + Hugo? Alpine Linux is minimal and fast, perfect for serving static sites with low resource usage. Combined with Hugo’s speed and flexibility, I get a complete, performant setup that I fully control. It’s secure, lightweight, and easy to update—just rebuild and re-upload the public/ folder.\nThis setup is perfect if you want full control and minimal overhead for a personal blog or portfolio.\n","date":"May 29, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-2/","title":"Building My Hugo Website on a VPS"},{"categories":null,"contents":"DRMDTool is an automation-centric utility designed to streamline the processing of .drmd files by tightly integrating with the N_m3u8DL-RE downloader. The tool offers robust automation via a watch folder and an intuitive web-based interface, significantly reducing the friction for managing and processing DRM-protected streaming content.\nWhat’s New DRMDTool has evolved into a comprehensive platform for batch downloading with enhanced support for user interaction and background processing. It features granular job tracking, dynamic download control (pause, resume, abort), and a refined WebSocket-based console for real-time command output. Subtitle handling now includes automatic downloading and conversion from VTT to SRT, and the downloader adapts based on metadata, organizing content into categorized directories.\nGoals and Use Case The primary aim is to automate .drmd file processing with minimal manual input. Users can configure download formats, specify directories, and enable real-time command broadcasting. DRMDTool is suitable for both interactive use through a web UI and headless automation in pipelines, supporting inotify or polling-based folder watching.\nHow .drmd Files Work A .drmd file is a structured JSON document that defines one or more encrypted media items to be processed by DRMDTool. It contains an Items array, with each item representing a specific media job. DRMDTool parses these entries to generate download commands for N_m3u8DL-RE.\nEach item includes:\nMPD: A DASH manifest, either a direct URL or a base64-encoded version. If base64-encoded, DRMDTool decodes and temporarily saves it before use. Keys: A comma-separated list of KID:key pairs (e.g., abcd1234ef567890:00112233445566778899aabbccddeeff). These are required for decrypting encrypted media streams and are passed directly to N_m3u8DL-RE using --key flags. Filename: The name to be used for the final output file. Subtitles: Comma-separated list of subtitle URLs in .vtt format. DRMDTool downloads and converts these to .srt, then muxes them into the final file. Metadata: A semicolon-separated string like Title;Type;Season (e.g., Example Show;serie;1) used to determine directory structure (Movies/Title or Series/Title/Season). Description and Poster: Optional fields used only for display in the web UI. Example .drmd Structure { \u0026#34;Items\u0026#34;: [ { \u0026#34;MPD\u0026#34;: \u0026#34;aHR0cHM6Ly9leGFtcGxlLmNvbS9zdHJlYW0ubXBk\u0026#34;, \u0026#34;Keys\u0026#34;: \u0026#34;abcd1234ef567890:00112233445566778899aabbccddeeff\u0026#34;, \u0026#34;Filename\u0026#34;: \u0026#34;ExampleShow.S01E01\u0026#34;, \u0026#34;Subtitles\u0026#34;: \u0026#34;https://example.com/sub1.vtt,https://example.com/sub2.vtt\u0026#34;, \u0026#34;Metadata\u0026#34;: \u0026#34;Example Show;serie;1\u0026#34;, \u0026#34;Description\u0026#34;: \u0026#34;Pilot episode\u0026#34;, \u0026#34;Poster\u0026#34;: \u0026#34;\u0026#34; } ] } Processing Steps Detection: DRMDTool either watches a folder or receives .drmd uploads through the web UI. Validation: It waits for the file to finish writing (based on file size stability), then parses its contents. MPD Handling: If base64-encoded, the MPD is decoded and written to a temp file; otherwise, the URL is fetched or passed as-is. Command Generation: Using the MPD, KID:key pairs, output paths, and subtitles, DRMDTool builds a command line for N_m3u8DL-RE. Execution: The download is launched with live progress tracking. Users can pause, resume, or abort jobs, and optionally stream console output via WebSocket. These files serve as portable job definitions. When DRMDTool detects or receives a .drmd file, it parses the items, decodes or downloads the MPD, applies the keys, and builds a download command using N_m3u8DL-RE. Files are saved in organized directories like Movies/Title or Series/Title/Season, and subtitles are embedded if available. Pausing, resuming, and aborting downloads is supported per file.\nArchitecture Overview The configuration is handled via config.toml, with environment variable overrides for containerized or dynamic deployments. Once started, the tool can either monitor a specified folder or allow file uploads through the UI. Each .drmd file is parsed, grouped by series and season (if applicable), and processed sequentially with support for job pausing and resuming.\nWeb UI \u0026amp; CLI To use:\n./drmdtool Visit http://localhost:8080 for the web interface, which supports drag-and-drop uploads, selection of episodes or movies, and real-time progress tracking. For headless operation:\n./drmdtool -f /path/to/file.drmd Jobs can be paused, resumed, or aborted through the web interface, which reflects the backend state via live updates.\nEnhanced Download Logic DRMDTool dynamically builds download commands using metadata from .drmd files and user preferences. It ensures that only the highest quality streams are kept, removing ad periods and duplicate segments from the MPD files. Subtitles are fetched and embedded automatically. Jobs are tracked with robust state management and logs for debugging and visibility.\nRepository Code and setup instructions are hosted here: https://git.directme.in/Joren/DRMDTool\nDRMDtool For advanced usage details, customization, and API structure, refer to the README.md in the repository.\nUI Previews Index Page Select Page Progress Page ","date":"May 21, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-1/","title":"DRMDTool Project"},{"categories":["cybersecurity","event recap"],"contents":"Cyber Defence on the Digital Frontline: A Mission with NATO On a Mission with NATO: Cyber Defence on the Frontline Howest’s ongoing commitment to world-class cybersecurity training took center stage again as six lecturers from the Cyber Security program joined forces with experts from Latvia, Luxembourg and Belgium in one of NATO\u0026rsquo;s most intensive simulations: the Locked Shields exercise, hosted by the Cooperative Cyber Defence Centre of Excellence (CCDCOE). Now in its fifth year of participation, the Howest team shared their firsthand experiences at a special evening talk at Howest Bruges.\nThe Exercise: Locked Shields Locked Shields is no ordinary simulation. It is a full-scale, live-fire cyber defence exercise involving more than 6,000 machines and a narrative scenario so detailed it includes geopolitics, disinformation and even fictional countries. This year, the Blue Team 03 (our team) defended a simulated nation’s critical infrastructure including power plants, satellites, 5G networks and banking systems, all while under constant attack from a coordinated Red Team using automated scripts and over 28,000 attacks across two days.\nAnd yes, every team (Red, Blue, Yellow, White) uses Ansible. For everything.\nHigh Stakes, Real Lessons What do you do when a rogue process might be malware, or maybe just a poorly named service? What happens when your teammate refuses to act unless something is “officially malicious”? The team faced cultural clashes, communication breakdowns and stress-testing of both systems and people.\nThe exercise required more than technical fixes. It demanded communication with simulated commanders, media and public stakeholders. Reporting became just as important as patching. It taught participants how to translate technical impact into real-world consequences. Not \u0026ldquo;port 8443 unreachable\u0026rdquo;, but \u0026ldquo;our air defence system is degraded, and we cannot fly planes\u0026rdquo;.\nThe Black Team: Rapid Response in Action A new but powerful presence in the simulation was the Black Team, a rapid-response unit deployed when problems became too complex for any single team. Acting like special forces, they jumped in when incidents crossed team boundaries or demanded unconventional solutions. Their mission was to find out what was happening, assess the impact and suggest fast, creative responses. Introduced just last year, this team quickly proved its value again in 2025. They even embraced the role with style — “you can wear sunglasses inside” became their unofficial motto.\nTheir presence underlined a critical lesson: not every problem fits neatly within a team’s silo. Real-world defence requires flexibility, speed and lateral thinking.\nHighlights and Blooper Reel There were plenty of mishaps. Misfired scripts, team mix-ups, and one case where a DNS setup from a previous year was reused by mistake. Someone tried renaming cut to shutdown, breaking essential operations until it was fixed. Systems rebooted into chaos, a manual was uploaded to public GitHub, and the team had to quickly learn the difference between symbolic links and real binaries.\nHuman Factors and Growth From detecting malware with Velociraptor and Q9, to encountering teammates who took orders literally, the learning was intense. One participant noted that while Belgian and Luxembourg teams prioritized knowledge sharing, others preferred strict protocol. This highlighted cultural differences and the importance of interpersonal skills.\nThe biggest lesson? You are never fully prepared. Every iteration of Locked Shields is different. But each one sharpens not only your skills, but also your ability to function as a team under extreme conditions.\nFrom the Battlefield to the Classroom This experience directly impacts the classroom. Inspired by the exercise, Howest is introducing new hands-on courses like “Glutamine” in semester five. Students will be dropped into realistic broken networks, with misconfigurations, fake firewalls and simulated threats. It is chaos, but controlled. And that is the point.\nAs one speaker said: “You don’t win Locked Shields. You just survive it better than the rest.”\nFinal Thoughts The exercise teaches more than just cybersecurity. It builds trust. It proves that knowing your teammates can be as important as knowing the tools. Whether that comes from a shared flight or a pre-exercise barbecue, it all matters when the pressure hits.\nWant to see how cyber defence works in real life? This is it.\n","date":"May 13, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog-1_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog-1_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-1/","title":"Cyber Defence on the Digital Frontline: A Mission with NATO"},{"categories":["cybersecurity","CTF","education"],"contents":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience On March 14 and 15, I joined the Cyber Security Challenge Belgium qualifiers with three teammates. For two days, we threw ourselves at CTF challenges covering binary exploitation, Android reversing, cryptography, and more.\nWhat follows is a recap of the challenges I personally worked on, some I solved, some I didn’t—but all of them left me with new skills and new ideas.\nA Buffer Overflow to Warm Up One of the first challenges I picked involved a binary with a basic stack overflow. I used standard techniques, finding the offset, hijacking the return address, and injecting shellcode. Tools like pwntools helped automate the payload crafting. It was a great warm-up and a confidence boost once it worked.\nBinary Exploitation Flag\rOurEncIsSec: Zip Bombs and OEIS Then there was a more elaborate cryptography challenge: 18 zip files, each password-protected. We cracked the first three passwords using John the Ripper and got numeric values from them. I searched the sequence in OEIS and found it matched A007408, which gave us the full pattern of passwords.\nUsing this, I could extract all zip contents automatically, reconstruct the password-protected message, and finally reveal the flag.\nPicture of the solution\rInfinite Luck: One in a Million? One challenge involved “guessing” a thousand random numbers between 1 and 10. The banner claimed it required infinite luck, but of course, the randomness was seeded. After inspecting the generator, I realized it was deterministic. By precomputing seeds and output sequences, I could match the challenge’s banner to a specific seed and regenerate the entire solution.\nChallange picture\rCorrect number order\rAndroid Reversing: FRIDA and JADX Several APKs were part of the qualifier set. I used JADX to decompile them and FRIDA to patch logic at runtime. In one challenge, I bypassed license validation by forcing key methods to return true and unlocking hidden functionality.\nThe Challenge That Stuck with Me: Rebuilding a Split DEX This one stood out.\nThe app used a 4×8 button grid. Pressing buttons loaded a sequence of blockXX files from assets. These were concatenated in-memory and passed into InMemoryDexClassLoader to load a class called be.dauntless.flag.Flag.\nClass loadClass = new InMemoryDexClassLoader(ByteBuffer.wrap(byteArrayOutputStream.toByteArray()), getClassLoader()) .loadClass(\u0026#34;be.dauntless.flag.Flag\u0026#34;); Each block was a fragment of a DEX file, but the app didn’t tell you the right order. I tried manually inspecting the fragments, identifying methods, string constants, and offsets—to infer how to reassemble the full file. I got close, but didn’t crack it in time.\nThat challenge stuck with me because it combined static analysis, runtime introspection, and logic reconstruction. It wasn’t just technical, it was creative.\nThe One That Got Away: TLS Fingerprinting Another challenge involved a Go-based TLS server that rejected all client connections unless they matched a specific fingerprint. I used Go’s tls.Config to replicate the version, cipher suites, and ALPN:\ntls.Config{ MinVersion: tls.VersionTLS13, CipherSuites: []uint16{ tls.TLS_AES_128_GCM_SHA256, // ... }, NextProtos: []string{\u0026#34;h2\u0026#34;}, } Despite that, the server still refused the connection. I suspect it was using JA4 or similar TLS fingerprinting techniques we couldn’t fully emulate. We had to move on, but I’d love to revisit that one someday.\nFinal Thoughts I didn’t solve everything. But that wasn’t the point. Every challenge was a practical puzzle, something to decode, reverse, bypass, or just understand a little better.\nWorking as a team with Evarist, Nathan, and Waut made it even more valuable. We bounced ideas off each other, divided tasks, and got a much broader set of challenges covered.\nThe Cyber Security Challenge Belgium qualifiers weren’t easy. But they were the best kind of difficult, the kind that teaches you something whether you solve the problem or not.\n","date":"March 15, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/post-2/binexpl_hu_3d36b409c72f3586.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"160\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/post-2\\/binexpl_hu_afca672637b6b98d.png';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-2/","title":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience"},{"categories":null,"contents":"I built my personal blog using Hugo and deployed it on a lightweight Alpine Linux VPS. I chose this setup to have full control, keep things simple, and avoid bloated platforms or services. Here’s how the process went from site generation to live deployment.\nCreating the Hugo Site On my development machine, I created a new Hugo site:\nhugo new site howest-blog I used the professors-hugo theme and copied its exampleSite content into my project. I customized the layout, structure, and styling by editing content files, SCSS in assets/scss/custom.scss, and partial templates in the theme directory.\nAll content lives under content/, with separate folders for blog/ and project/, each containing .md files with front matter and Markdown content.\nCustomization I edited the config/_default/hugo.toml to configure site parameters like the base URL, theme, language, and menus. SCSS and image assets go in assets/, and are processed by Hugo\u0026rsquo;s pipeline. Static files like favicons are placed in static/.\nTo preview the site locally:\nhugo server To build the static site:\nhugo This generates everything in the public/ folder.\nVPS Deployment I rented a minimal Alpine Linux VPS and installed only what I needed. After setting up SSH and a basic nginx web server, I copied the public/ folder over using scp:\nscp -r public/* user@my-vps:/var/www/html On the VPS, I installed nginx:\napk add nginx And configured /etc/nginx/conf.d/default.conf to serve files from /var/www/html. Then I enabled and started nginx:\nrc-service nginx start rc-update add nginx Now my Hugo site is live and served directly as static files—no backend, no database, just HTML, CSS, and JS.\nWhy Alpine + Hugo? Alpine Linux is minimal and fast, perfect for serving static sites with low resource usage. Combined with Hugo’s speed and flexibility, I get a complete, performant setup that I fully control. It’s secure, lightweight, and easy to update—just rebuild and re-upload the public/ folder.\nThis setup is perfect if you want full control and minimal overhead for a personal blog or portfolio.\n","date":"May 29, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-2/","title":"Building My Hugo Website on a VPS"},{"categories":null,"contents":"DRMDTool is an automation-centric utility designed to streamline the processing of .drmd files by tightly integrating with the N_m3u8DL-RE downloader. The tool offers robust automation via a watch folder and an intuitive web-based interface, significantly reducing the friction for managing and processing DRM-protected streaming content.\nWhat’s New DRMDTool has evolved into a comprehensive platform for batch downloading with enhanced support for user interaction and background processing. It features granular job tracking, dynamic download control (pause, resume, abort), and a refined WebSocket-based console for real-time command output. Subtitle handling now includes automatic downloading and conversion from VTT to SRT, and the downloader adapts based on metadata, organizing content into categorized directories.\nGoals and Use Case The primary aim is to automate .drmd file processing with minimal manual input. Users can configure download formats, specify directories, and enable real-time command broadcasting. DRMDTool is suitable for both interactive use through a web UI and headless automation in pipelines, supporting inotify or polling-based folder watching.\nHow .drmd Files Work A .drmd file is a structured JSON document that defines one or more encrypted media items to be processed by DRMDTool. It contains an Items array, with each item representing a specific media job. DRMDTool parses these entries to generate download commands for N_m3u8DL-RE.\nEach item includes:\nMPD: A DASH manifest, either a direct URL or a base64-encoded version. If base64-encoded, DRMDTool decodes and temporarily saves it before use. Keys: A comma-separated list of KID:key pairs (e.g., abcd1234ef567890:00112233445566778899aabbccddeeff). These are required for decrypting encrypted media streams and are passed directly to N_m3u8DL-RE using --key flags. Filename: The name to be used for the final output file. Subtitles: Comma-separated list of subtitle URLs in .vtt format. DRMDTool downloads and converts these to .srt, then muxes them into the final file. Metadata: A semicolon-separated string like Title;Type;Season (e.g., Example Show;serie;1) used to determine directory structure (Movies/Title or Series/Title/Season). Description and Poster: Optional fields used only for display in the web UI. Example .drmd Structure { \u0026#34;Items\u0026#34;: [ { \u0026#34;MPD\u0026#34;: \u0026#34;aHR0cHM6Ly9leGFtcGxlLmNvbS9zdHJlYW0ubXBk\u0026#34;, \u0026#34;Keys\u0026#34;: \u0026#34;abcd1234ef567890:00112233445566778899aabbccddeeff\u0026#34;, \u0026#34;Filename\u0026#34;: \u0026#34;ExampleShow.S01E01\u0026#34;, \u0026#34;Subtitles\u0026#34;: \u0026#34;https://example.com/sub1.vtt,https://example.com/sub2.vtt\u0026#34;, \u0026#34;Metadata\u0026#34;: \u0026#34;Example Show;serie;1\u0026#34;, \u0026#34;Description\u0026#34;: \u0026#34;Pilot episode\u0026#34;, \u0026#34;Poster\u0026#34;: \u0026#34;\u0026#34; } ] } Processing Steps Detection: DRMDTool either watches a folder or receives .drmd uploads through the web UI. Validation: It waits for the file to finish writing (based on file size stability), then parses its contents. MPD Handling: If base64-encoded, the MPD is decoded and written to a temp file; otherwise, the URL is fetched or passed as-is. Command Generation: Using the MPD, KID:key pairs, output paths, and subtitles, DRMDTool builds a command line for N_m3u8DL-RE. Execution: The download is launched with live progress tracking. Users can pause, resume, or abort jobs, and optionally stream console output via WebSocket. These files serve as portable job definitions. When DRMDTool detects or receives a .drmd file, it parses the items, decodes or downloads the MPD, applies the keys, and builds a download command using N_m3u8DL-RE. Files are saved in organized directories like Movies/Title or Series/Title/Season, and subtitles are embedded if available. Pausing, resuming, and aborting downloads is supported per file.\nArchitecture Overview The configuration is handled via config.toml, with environment variable overrides for containerized or dynamic deployments. Once started, the tool can either monitor a specified folder or allow file uploads through the UI. Each .drmd file is parsed, grouped by series and season (if applicable), and processed sequentially with support for job pausing and resuming.\nWeb UI \u0026amp; CLI To use:\n./drmdtool Visit http://localhost:8080 for the web interface, which supports drag-and-drop uploads, selection of episodes or movies, and real-time progress tracking. For headless operation:\n./drmdtool -f /path/to/file.drmd Jobs can be paused, resumed, or aborted through the web interface, which reflects the backend state via live updates.\nEnhanced Download Logic DRMDTool dynamically builds download commands using metadata from .drmd files and user preferences. It ensures that only the highest quality streams are kept, removing ad periods and duplicate segments from the MPD files. Subtitles are fetched and embedded automatically. Jobs are tracked with robust state management and logs for debugging and visibility.\nRepository Code and setup instructions are hosted here: https://git.directme.in/Joren/DRMDTool\nDRMDtool For advanced usage details, customization, and API structure, refer to the README.md in the repository.\nUI Previews Index Page Select Page Progress Page ","date":"May 21, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-1/","title":"DRMDTool Project"},{"categories":["cybersecurity","event recap"],"contents":"Cyber Defence on the Digital Frontline: A Mission with NATO On a Mission with NATO: Cyber Defence on the Frontline Howest’s ongoing commitment to world-class cybersecurity training took center stage again as six lecturers from the Cyber Security program joined forces with experts from Latvia, Luxembourg and Belgium in one of NATO\u0026rsquo;s most intensive simulations: the Locked Shields exercise, hosted by the Cooperative Cyber Defence Centre of Excellence (CCDCOE). Now in its fifth year of participation, the Howest team shared their firsthand experiences at a special evening talk at Howest Bruges.\nThe Exercise: Locked Shields Locked Shields is no ordinary simulation. It is a full-scale, live-fire cyber defence exercise involving more than 6,000 machines and a narrative scenario so detailed it includes geopolitics, disinformation and even fictional countries. This year, the Blue Team 03 (our team) defended a simulated nation’s critical infrastructure including power plants, satellites, 5G networks and banking systems, all while under constant attack from a coordinated Red Team using automated scripts and over 28,000 attacks across two days.\nAnd yes, every team (Red, Blue, Yellow, White) uses Ansible. For everything.\nHigh Stakes, Real Lessons What do you do when a rogue process might be malware, or maybe just a poorly named service? What happens when your teammate refuses to act unless something is “officially malicious”? The team faced cultural clashes, communication breakdowns and stress-testing of both systems and people.\nThe exercise required more than technical fixes. It demanded communication with simulated commanders, media and public stakeholders. Reporting became just as important as patching. It taught participants how to translate technical impact into real-world consequences. Not \u0026ldquo;port 8443 unreachable\u0026rdquo;, but \u0026ldquo;our air defence system is degraded, and we cannot fly planes\u0026rdquo;.\nThe Black Team: Rapid Response in Action A new but powerful presence in the simulation was the Black Team, a rapid-response unit deployed when problems became too complex for any single team. Acting like special forces, they jumped in when incidents crossed team boundaries or demanded unconventional solutions. Their mission was to find out what was happening, assess the impact and suggest fast, creative responses. Introduced just last year, this team quickly proved its value again in 2025. They even embraced the role with style “you can wear sunglasses inside” became their unofficial motto.\nTheir presence underlined a critical lesson: not every problem fits neatly within a team’s silo. Real-world defence requires flexibility, speed and lateral thinking.\nHighlights and Blooper Reel There were plenty of mishaps. Misfired scripts, team mix-ups, and one case where a DNS setup from a previous year was reused by mistake. Someone tried renaming cut to shutdown, breaking essential operations until it was fixed. Systems rebooted into chaos, a manual was uploaded to public GitHub, and the team had to quickly learn the difference between symbolic links and real binaries.\nHuman Factors and Growth From detecting malware with Velociraptor and Q9, to encountering teammates who took orders literally, the learning was intense. One participant noted that while Belgian and Luxembourg teams prioritized knowledge sharing, others preferred strict protocol. This highlighted cultural differences and the importance of interpersonal skills.\nThe biggest lesson? You are never fully prepared. Every iteration of Locked Shields is different. But each one sharpens not only your skills, but also your ability to function as a team under extreme conditions.\nFrom the Battlefield to the Classroom This experience directly impacts the classroom. Inspired by the exercise, Howest is introducing new hands-on courses like “Glutamine” in semester five. Students will be dropped into realistic broken networks, with misconfigurations, fake firewalls and simulated threats. It is chaos, but controlled. And that is the point.\nAs one speaker said: “You don’t win Locked Shields. You just survive it better than the rest.”\nFinal Thoughts The exercise teaches more than just cybersecurity. It builds trust. It proves that knowing your teammates can be as important as knowing the tools. Whether that comes from a shared flight or a pre-exercise barbecue, it all matters when the pressure hits.\nWant to see how cyber defence works in real life? This is it.\n","date":"May 13, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog-1_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog-1_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-1/","title":"Cyber Defence on the Digital Frontline: A Mission with NATO"},{"categories":["cybersecurity","CTF","education"],"contents":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience On March 14 and 15, I joined the Cyber Security Challenge Belgium qualifiers with three teammates. For two days, we threw ourselves at CTF challenges covering binary exploitation, Android reversing, cryptography, and more.\nWhat follows is a recap of the challenges I personally worked on, some I solved, some I didn’t—but all of them left me with new skills and new ideas.\nA Buffer Overflow to Warm Up One of the first challenges I picked involved a binary with a basic stack overflow. I used standard techniques, finding the offset, hijacking the return address, and injecting shellcode. Tools like pwntools helped automate the payload crafting. It was a great warm-up and a confidence boost once it worked.\nBinary Exploitation Flag\rOurEncIsSec: Zip Bombs and OEIS Then there was a more elaborate cryptography challenge: 18 zip files, each password-protected. We cracked the first three passwords using John the Ripper and got numeric values from them. I searched the sequence in OEIS and found it matched A007408, which gave us the full pattern of passwords.\nUsing this, I could extract all zip contents automatically, reconstruct the password-protected message, and finally reveal the flag.\nPicture of the solution\rInfinite Luck: One in a Million? One challenge involved “guessing” a thousand random numbers between 1 and 10. The banner claimed it required infinite luck, but of course, the randomness was seeded. After inspecting the generator, I realized it was deterministic. By precomputing seeds and output sequences, I could match the challenge’s banner to a specific seed and regenerate the entire solution.\nChallange picture\rCorrect number order\rAndroid Reversing: FRIDA and JADX Several APKs were part of the qualifier set. I used JADX to decompile them and FRIDA to patch logic at runtime. In one challenge, I bypassed license validation by forcing key methods to return true and unlocking hidden functionality.\nThe Challenge That Stuck with Me: Rebuilding a Split DEX This one stood out.\nThe app used a 4×8 button grid. Pressing buttons loaded a sequence of blockXX files from assets. These were concatenated in-memory and passed into InMemoryDexClassLoader to load a class called be.dauntless.flag.Flag.\nClass loadClass = new InMemoryDexClassLoader(ByteBuffer.wrap(byteArrayOutputStream.toByteArray()), getClassLoader()) .loadClass(\u0026#34;be.dauntless.flag.Flag\u0026#34;); Each block was a fragment of a DEX file, but the app didn’t tell you the right order. I tried manually inspecting the fragments, identifying methods, string constants, and offsets—to infer how to reassemble the full file. I got close, but didn’t crack it in time.\nThat challenge stuck with me because it combined static analysis, runtime introspection, and logic reconstruction. It wasn’t just technical, it was creative.\nThe One That Got Away: TLS Fingerprinting Another challenge involved a Go-based TLS server that rejected all client connections unless they matched a specific fingerprint. I used Go’s tls.Config to replicate the version, cipher suites, and ALPN:\ntls.Config{ MinVersion: tls.VersionTLS13, CipherSuites: []uint16{ tls.TLS_AES_128_GCM_SHA256, // ... }, NextProtos: []string{\u0026#34;h2\u0026#34;}, } Despite that, the server still refused the connection. I suspect it was using JA4 or similar TLS fingerprinting techniques we couldn’t fully emulate. We had to move on, but I’d love to revisit that one someday.\nFinal Thoughts I didn’t solve everything. But that wasn’t the point. Every challenge was a practical puzzle, something to decode, reverse, bypass, or just understand a little better.\nWorking as a team with Evarist, Nathan, and Waut made it even more valuable. We bounced ideas off each other, divided tasks, and got a much broader set of challenges covered.\nThe Cyber Security Challenge Belgium qualifiers weren’t easy. But they were the best kind of difficult, the kind that teaches you something whether you solve the problem or not.\n","date":"March 15, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/post-2/binexpl_hu_3d36b409c72f3586.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"160\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/post-2\\/binexpl_hu_afca672637b6b98d.png';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-2/","title":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience"},{"categories":null,"contents":"I built my personal blog using Hugo and deployed it on a lightweight Alpine Linux VPS. I chose this setup to have full control, keep things simple, and avoid bloated platforms or services. Here’s how the process went from site generation to live deployment.\nCreating the Hugo Site On my development machine, I created a new Hugo site:\nhugo new site howest-blog I used the professors-hugo theme and copied its exampleSite content into my project. I customized the layout, structure, and styling by editing content files, SCSS in assets/scss/custom.scss, and partial templates in the theme directory.\nAll content lives under content/, with separate folders for blog/ and project/, each containing .md files with front matter and Markdown content.\nCustomization I edited the config/_default/hugo.toml to configure site parameters like the base URL, theme, language, and menus. SCSS and image assets go in assets/, and are processed by Hugo\u0026rsquo;s pipeline. Static files like favicons are placed in static/.\nTo preview the site locally:\nhugo server To build the static site:\nhugo This generates everything in the public/ folder.\nVPS Deployment I rented a minimal Alpine Linux VPS and installed only what I needed. After setting up SSH and a basic nginx web server, I copied the public/ folder over using scp:\nscp -r public/* user@my-vps:/var/www/html On the VPS, I installed nginx:\napk add nginx And configured /etc/nginx/conf.d/default.conf to serve files from /var/www/html. Then I enabled and started nginx:\nrc-service nginx start rc-update add nginx Now my Hugo site is live and served directly as static files, no backend, no database, just HTML, CSS, and JS.\nWhy Alpine + Hugo? Alpine Linux is minimal and fast, perfect for serving static sites with low resource usage. Combined with Hugo’s speed and flexibility, I get a complete, performant setup that I fully control. It’s secure, lightweight, and easy to update, just rebuild and re-upload the public/ folder.\nThis setup is perfect if you want full control and minimal overhead for a personal blog or portfolio.\n","date":"May 29, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-2/","title":"Building My Hugo Website on a VPS"},{"categories":null,"contents":"DRMDTool is an automation-centric utility designed to streamline the processing of .drmd files by tightly integrating with the N_m3u8DL-RE downloader. The tool offers robust automation via a watch folder and an intuitive web-based interface, significantly reducing the friction for managing and processing DRM-protected streaming content.\nWhat’s New DRMDTool has evolved into a comprehensive platform for batch downloading with enhanced support for user interaction and background processing. It features granular job tracking, dynamic download control (pause, resume, abort), and a refined WebSocket-based console for real-time command output. Subtitle handling now includes automatic downloading and conversion from VTT to SRT, and the downloader adapts based on metadata, organizing content into categorized directories.\nGoals and Use Case The primary aim is to automate .drmd file processing with minimal manual input. Users can configure download formats, specify directories, and enable real-time command broadcasting. DRMDTool is suitable for both interactive use through a web UI and headless automation in pipelines, supporting inotify or polling-based folder watching.\nHow .drmd Files Work A .drmd file is a structured JSON document that defines one or more encrypted media items to be processed by DRMDTool. It contains an Items array, with each item representing a specific media job. DRMDTool parses these entries to generate download commands for N_m3u8DL-RE.\nEach item includes:\nMPD: A DASH manifest, either a direct URL or a base64-encoded version. If base64-encoded, DRMDTool decodes and temporarily saves it before use. Keys: A comma-separated list of KID:key pairs (e.g., abcd1234ef567890:00112233445566778899aabbccddeeff). These are required for decrypting encrypted media streams and are passed directly to N_m3u8DL-RE using --key flags. Filename: The name to be used for the final output file. Subtitles: Comma-separated list of subtitle URLs in .vtt format. DRMDTool downloads and converts these to .srt, then muxes them into the final file. Metadata: A semicolon-separated string like Title;Type;Season (e.g., Example Show;serie;1) used to determine directory structure (Movies/Title or Series/Title/Season). Description and Poster: Optional fields used only for display in the web UI. Example .drmd Structure { \u0026#34;Items\u0026#34;: [ { \u0026#34;MPD\u0026#34;: \u0026#34;aHR0cHM6Ly9leGFtcGxlLmNvbS9zdHJlYW0ubXBk\u0026#34;, \u0026#34;Keys\u0026#34;: \u0026#34;abcd1234ef567890:00112233445566778899aabbccddeeff\u0026#34;, \u0026#34;Filename\u0026#34;: \u0026#34;ExampleShow.S01E01\u0026#34;, \u0026#34;Subtitles\u0026#34;: \u0026#34;https://example.com/sub1.vtt,https://example.com/sub2.vtt\u0026#34;, \u0026#34;Metadata\u0026#34;: \u0026#34;Example Show;serie;1\u0026#34;, \u0026#34;Description\u0026#34;: \u0026#34;Pilot episode\u0026#34;, \u0026#34;Poster\u0026#34;: \u0026#34;\u0026#34; } ] } Processing Steps Detection: DRMDTool either watches a folder or receives .drmd uploads through the web UI. Validation: It waits for the file to finish writing (based on file size stability), then parses its contents. MPD Handling: If base64-encoded, the MPD is decoded and written to a temp file; otherwise, the URL is fetched or passed as-is. Command Generation: Using the MPD, KID:key pairs, output paths, and subtitles, DRMDTool builds a command line for N_m3u8DL-RE. Execution: The download is launched with live progress tracking. Users can pause, resume, or abort jobs, and optionally stream console output via WebSocket. These files serve as portable job definitions. When DRMDTool detects or receives a .drmd file, it parses the items, decodes or downloads the MPD, applies the keys, and builds a download command using N_m3u8DL-RE. Files are saved in organized directories like Movies/Title or Series/Title/Season, and subtitles are embedded if available. Pausing, resuming, and aborting downloads is supported per file.\nArchitecture Overview The configuration is handled via config.toml, with environment variable overrides for containerized or dynamic deployments. Once started, the tool can either monitor a specified folder or allow file uploads through the UI. Each .drmd file is parsed, grouped by series and season (if applicable), and processed sequentially with support for job pausing and resuming.\nWeb UI \u0026amp; CLI To use:\n./drmdtool Visit http://localhost:8080 for the web interface, which supports drag-and-drop uploads, selection of episodes or movies, and real-time progress tracking. For headless operation:\n./drmdtool -f /path/to/file.drmd Jobs can be paused, resumed, or aborted through the web interface, which reflects the backend state via live updates.\nEnhanced Download Logic DRMDTool dynamically builds download commands using metadata from .drmd files and user preferences. It ensures that only the highest quality streams are kept, removing ad periods and duplicate segments from the MPD files. Subtitles are fetched and embedded automatically. Jobs are tracked with robust state management and logs for debugging and visibility.\nRepository Code and setup instructions are hosted here: https://git.directme.in/Joren/DRMDTool\nDRMDtool For advanced usage details, customization, and API structure, refer to the README.md in the repository.\nUI Previews Index Page Select Page Progress Page ","date":"May 21, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/project/project-1_hu_ed243079fe23fbea.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"482\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/project\\/project-1_hu_d3e8330418e90c0f.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/project/project-1/","title":"DRMDTool Project"},{"categories":["cybersecurity","event recap"],"contents":"Cyber Defence on the Digital Frontline: A Mission with NATO On a Mission with NATO: Cyber Defence on the Frontline Howest’s ongoing commitment to world-class cybersecurity training took center stage again as six lecturers from the Cyber Security program joined forces with experts from Latvia, Luxembourg and Belgium in one of NATO\u0026rsquo;s most intensive simulations: the Locked Shields exercise, hosted by the Cooperative Cyber Defence Centre of Excellence (CCDCOE). Now in its fifth year of participation, the Howest team shared their firsthand experiences at a special evening talk at Howest Bruges.\nThe Exercise: Locked Shields Locked Shields is no ordinary simulation. It is a full-scale, live-fire cyber defence exercise involving more than 6,000 machines and a narrative scenario so detailed it includes geopolitics, disinformation and even fictional countries. This year, the Blue Team 03 (our team) defended a simulated nation’s critical infrastructure including power plants, satellites, 5G networks and banking systems, all while under constant attack from a coordinated Red Team using automated scripts and over 28,000 attacks across two days.\nAnd yes, every team (Red, Blue, Yellow, White) uses Ansible. For everything.\nHigh Stakes, Real Lessons What do you do when a rogue process might be malware, or maybe just a poorly named service? What happens when your teammate refuses to act unless something is “officially malicious”? The team faced cultural clashes, communication breakdowns and stress-testing of both systems and people.\nThe exercise required more than technical fixes. It demanded communication with simulated commanders, media and public stakeholders. Reporting became just as important as patching. It taught participants how to translate technical impact into real-world consequences. Not \u0026ldquo;port 8443 unreachable\u0026rdquo;, but \u0026ldquo;our air defence system is degraded, and we cannot fly planes\u0026rdquo;.\nThe Black Team: Rapid Response in Action A new but powerful presence in the simulation was the Black Team, a rapid-response unit deployed when problems became too complex for any single team. Acting like special forces, they jumped in when incidents crossed team boundaries or demanded unconventional solutions. Their mission was to find out what was happening, assess the impact and suggest fast, creative responses. Introduced just last year, this team quickly proved its value again in 2025. They even embraced the role with style “you can wear sunglasses inside” became their unofficial motto.\nTheir presence underlined a critical lesson: not every problem fits neatly within a team’s silo. Real-world defence requires flexibility, speed and lateral thinking.\nHighlights and Blooper Reel There were plenty of mishaps. Misfired scripts, team mix-ups, and one case where a DNS setup from a previous year was reused by mistake. Someone tried renaming cut to shutdown, breaking essential operations until it was fixed. Systems rebooted into chaos, a manual was uploaded to public GitHub, and the team had to quickly learn the difference between symbolic links and real binaries.\nHuman Factors and Growth From detecting malware with Velociraptor and Q9, to encountering teammates who took orders literally, the learning was intense. One participant noted that while Belgian and Luxembourg teams prioritized knowledge sharing, others preferred strict protocol. This highlighted cultural differences and the importance of interpersonal skills.\nThe biggest lesson? You are never fully prepared. Every iteration of Locked Shields is different. But each one sharpens not only your skills, but also your ability to function as a team under extreme conditions.\nFrom the Battlefield to the Classroom This experience directly impacts the classroom. Inspired by the exercise, Howest is introducing new hands-on courses like “Glutamine” in semester five. Students will be dropped into realistic broken networks, with misconfigurations, fake firewalls and simulated threats. It is chaos, but controlled. And that is the point.\nAs one speaker said: “You don’t win Locked Shields. You just survive it better than the rest.”\nFinal Thoughts The exercise teaches more than just cybersecurity. It builds trust. It proves that knowing your teammates can be as important as knowing the tools. Whether that comes from a shared flight or a pre-exercise barbecue, it all matters when the pressure hits.\nWant to see how cyber defence works in real life? This is it.\n","date":"May 13, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/blog-1_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/blog-1_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-1/","title":"Cyber Defence on the Digital Frontline: A Mission with NATO"},{"categories":["cybersecurity","CTF","education"],"contents":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience On March 14 and 15, I joined the Cyber Security Challenge Belgium qualifiers with three teammates. For two days, we threw ourselves at CTF challenges covering binary exploitation, Android reversing, cryptography, and more.\nWhat follows is a recap of the challenges I personally worked on, some I solved, some I didn’t—but all of them left me with new skills and new ideas.\nA Buffer Overflow to Warm Up One of the first challenges I picked involved a binary with a basic stack overflow. I used standard techniques, finding the offset, hijacking the return address, and injecting shellcode. Tools like pwntools helped automate the payload crafting. It was a great warm-up and a confidence boost once it worked.\nBinary Exploitation Flag\rOurEncIsSec: Zip Bombs and OEIS Then there was a more elaborate cryptography challenge: 18 zip files, each password-protected. We cracked the first three passwords using John the Ripper and got numeric values from them. I searched the sequence in OEIS and found it matched A007408, which gave us the full pattern of passwords.\nUsing this, I could extract all zip contents automatically, reconstruct the password-protected message, and finally reveal the flag.\nPicture of the solution\rInfinite Luck: One in a Million? One challenge involved “guessing” a thousand random numbers between 1 and 10. The banner claimed it required infinite luck, but of course, the randomness was seeded. After inspecting the generator, I realized it was deterministic. By precomputing seeds and output sequences, I could match the challenge’s banner to a specific seed and regenerate the entire solution.\nChallange picture\rCorrect number order\rAndroid Reversing: FRIDA and JADX Several APKs were part of the qualifier set. I used JADX to decompile them and FRIDA to patch logic at runtime. In one challenge, I bypassed license validation by forcing key methods to return true and unlocking hidden functionality.\nThe Challenge That Stuck with Me: Rebuilding a Split DEX This one stood out.\nThe app used a 4×8 button grid. Pressing buttons loaded a sequence of blockXX files from assets. These were concatenated in-memory and passed into InMemoryDexClassLoader to load a class called be.dauntless.flag.Flag.\nClass loadClass = new InMemoryDexClassLoader(ByteBuffer.wrap(byteArrayOutputStream.toByteArray()), getClassLoader()) .loadClass(\u0026#34;be.dauntless.flag.Flag\u0026#34;); Each block was a fragment of a DEX file, but the app didn’t tell you the right order. I tried manually inspecting the fragments, identifying methods, string constants, and offsets—to infer how to reassemble the full file. I got close, but didn’t crack it in time.\nThat challenge stuck with me because it combined static analysis, runtime introspection, and logic reconstruction. It wasn’t just technical, it was creative.\nThe One That Got Away: TLS Fingerprinting Another challenge involved a Go-based TLS server that rejected all client connections unless they matched a specific fingerprint. I used Go’s tls.Config to replicate the version, cipher suites, and ALPN:\ntls.Config{ MinVersion: tls.VersionTLS13, CipherSuites: []uint16{ tls.TLS_AES_128_GCM_SHA256, // ... }, NextProtos: []string{\u0026#34;h2\u0026#34;}, } Despite that, the server still refused the connection. I suspect it was using JA4 or similar TLS fingerprinting techniques we couldn’t fully emulate. We had to move on, but I’d love to revisit that one someday.\nFinal Thoughts I didn’t solve everything. But that wasn’t the point. Every challenge was a practical puzzle, something to decode, reverse, bypass, or just understand a little better.\nWorking as a team with Evarist, Nathan, and Waut made it even more valuable. We bounced ideas off each other, divided tasks, and got a much broader set of challenges covered.\nThe Cyber Security Challenge Belgium qualifiers weren’t easy. But they were the best kind of difficult, the kind that teaches you something whether you solve the problem or not.\n","date":"March 15, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/images/blog/post-2/binexpl_hu_3d36b409c72f3586.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"160\"\n onerror=\"this.onerror='null';\n this.src='\\/images\\/blog\\/post-2\\/binexpl_hu_afca672637b6b98d.png';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/blog/post-2/","title":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience"}]
\ No newline at end of file
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+[{"categories":null,"contents":"I built my personal blog using Hugo and deployed it on a lightweight Alpine Linux VPS. I chose this setup to have full control, keep things simple, and avoid bloated platforms or services. Here’s how the process went from site generation to live deployment.\nCreating the Hugo Site On my development machine, I created a new Hugo site:\nhugo new site howest-blog I used the professors-hugo theme and copied its exampleSite content into my project. I customized the layout, structure, and styling by editing content files, SCSS in assets/scss/custom.scss, and partial templates in the theme directory.\nAll content lives under content/, with separate folders for blog/ and project/, each containing .md files with front matter and Markdown content.\nCustomization I edited the config/_default/hugo.toml to configure site parameters like the base URL, theme, language, and menus. SCSS and image assets go in assets/, and are processed by Hugo\u0026rsquo;s pipeline. Static files like favicons are placed in static/.\nTo preview the site locally:\nhugo server To build the static site:\nhugo This generates everything in the public/ folder.\nVPS Deployment I rented a minimal Alpine Linux VPS and installed only what I needed. After setting up SSH and a basic nginx web server, I copied the public/ folder over using scp:\nscp -r public/* user@my-vps:/var/www/html On the VPS, I installed nginx:\napk add nginx And configured /etc/nginx/conf.d/default.conf to serve files from /var/www/html. Then I enabled and started nginx:\nrc-service nginx start rc-update add nginx Now my Hugo site is live and served directly as static files, no backend, no database, just HTML, CSS, and JS.\nWhy Alpine + Hugo? Alpine Linux is minimal and fast, perfect for serving static sites with low resource usage. Combined with Hugo’s speed and flexibility, I get a complete, performant setup that I fully control. It’s secure, lightweight, and easy to update, just rebuild and re-upload the public/ folder.\nThis setup is perfect if you want full control and minimal overhead for a personal blog or portfolio.\n","date":"May 29, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/professors/site/images/project/project-2_hu_b10de0491c6514dc.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"278\"\n onerror=\"this.onerror='null';\n this.src='\\/professors\\/site\\/images\\/project\\/project-2_hu_3550dd40bf159427.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/professors/site/project/project-2/","title":"Building My Hugo Website on a VPS"},{"categories":null,"contents":"DRMDTool is an automation-centric utility designed to streamline the processing of .drmd files by tightly integrating with the N_m3u8DL-RE downloader. The tool offers robust automation via a watch folder and an intuitive web-based interface, significantly reducing the friction for managing and processing DRM-protected streaming content.\nWhat’s New DRMDTool has evolved into a comprehensive platform for batch downloading with enhanced support for user interaction and background processing. It features granular job tracking, dynamic download control (pause, resume, abort), and a refined WebSocket-based console for real-time command output. Subtitle handling now includes automatic downloading and conversion from VTT to SRT, and the downloader adapts based on metadata, organizing content into categorized directories.\nGoals and Use Case The primary aim is to automate .drmd file processing with minimal manual input. Users can configure download formats, specify directories, and enable real-time command broadcasting. DRMDTool is suitable for both interactive use through a web UI and headless automation in pipelines, supporting inotify or polling-based folder watching.\nHow .drmd Files Work A .drmd file is a structured JSON document that defines one or more encrypted media items to be processed by DRMDTool. It contains an Items array, with each item representing a specific media job. DRMDTool parses these entries to generate download commands for N_m3u8DL-RE.\nEach item includes:\nMPD: A DASH manifest, either a direct URL or a base64-encoded version. If base64-encoded, DRMDTool decodes and temporarily saves it before use. Keys: A comma-separated list of KID:key pairs (e.g., abcd1234ef567890:00112233445566778899aabbccddeeff). These are required for decrypting encrypted media streams and are passed directly to N_m3u8DL-RE using --key flags. Filename: The name to be used for the final output file. Subtitles: Comma-separated list of subtitle URLs in .vtt format. DRMDTool downloads and converts these to .srt, then muxes them into the final file. Metadata: A semicolon-separated string like Title;Type;Season (e.g., Example Show;serie;1) used to determine directory structure (Movies/Title or Series/Title/Season). Description and Poster: Optional fields used only for display in the web UI. Example .drmd Structure { \u0026#34;Items\u0026#34;: [ { \u0026#34;MPD\u0026#34;: \u0026#34;aHR0cHM6Ly9leGFtcGxlLmNvbS9zdHJlYW0ubXBk\u0026#34;, \u0026#34;Keys\u0026#34;: \u0026#34;abcd1234ef567890:00112233445566778899aabbccddeeff\u0026#34;, \u0026#34;Filename\u0026#34;: \u0026#34;ExampleShow.S01E01\u0026#34;, \u0026#34;Subtitles\u0026#34;: \u0026#34;https://example.com/sub1.vtt,https://example.com/sub2.vtt\u0026#34;, \u0026#34;Metadata\u0026#34;: \u0026#34;Example Show;serie;1\u0026#34;, \u0026#34;Description\u0026#34;: \u0026#34;Pilot episode\u0026#34;, \u0026#34;Poster\u0026#34;: \u0026#34;\u0026#34; } ] } Processing Steps Detection: DRMDTool either watches a folder or receives .drmd uploads through the web UI. Validation: It waits for the file to finish writing (based on file size stability), then parses its contents. MPD Handling: If base64-encoded, the MPD is decoded and written to a temp file; otherwise, the URL is fetched or passed as-is. Command Generation: Using the MPD, KID:key pairs, output paths, and subtitles, DRMDTool builds a command line for N_m3u8DL-RE. Execution: The download is launched with live progress tracking. Users can pause, resume, or abort jobs, and optionally stream console output via WebSocket. These files serve as portable job definitions. When DRMDTool detects or receives a .drmd file, it parses the items, decodes or downloads the MPD, applies the keys, and builds a download command using N_m3u8DL-RE. Files are saved in organized directories like Movies/Title or Series/Title/Season, and subtitles are embedded if available. Pausing, resuming, and aborting downloads is supported per file.\nArchitecture Overview The configuration is handled via config.toml, with environment variable overrides for containerized or dynamic deployments. Once started, the tool can either monitor a specified folder or allow file uploads through the UI. Each .drmd file is parsed, grouped by series and season (if applicable), and processed sequentially with support for job pausing and resuming.\nWeb UI \u0026amp; CLI To use:\n./drmdtool Visit http://localhost:8080 for the web interface, which supports drag-and-drop uploads, selection of episodes or movies, and real-time progress tracking. For headless operation:\n./drmdtool -f /path/to/file.drmd Jobs can be paused, resumed, or aborted through the web interface, which reflects the backend state via live updates.\nEnhanced Download Logic DRMDTool dynamically builds download commands using metadata from .drmd files and user preferences. It ensures that only the highest quality streams are kept, removing ad periods and duplicate segments from the MPD files. Subtitles are fetched and embedded automatically. Jobs are tracked with robust state management and logs for debugging and visibility.\nRepository Code and setup instructions are hosted here: https://git.directme.in/Joren/DRMDTool\nDRMDtool For advanced usage details, customization, and API structure, refer to the README.md in the repository.\n","date":"May 21, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/professors/site/images/project/project-1_hu_3db5ce4165d1b6f3.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"396\"\n onerror=\"this.onerror='null';\n this.src='\\/professors\\/site\\/images\\/project\\/project-1_hu_7691192a371c30a3.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/professors/site/project/project-1/","title":"DRMDTool Project"},{"categories":["cybersecurity","podcast","interview"],"contents":"Red Team Talk: Een Blik Achter de Schermen bij Offensive Security In deze eerste aflevering van Red Team Talk nemen wij, Joren Schipman en Mattia Punjwani, studenten Cybersecurity aan Howest, jullie mee in een gesprek met Thomas Castronovo, ethical hacker en consultant bij Deloitte. Samen duiken we in de wereld van offensieve security, red teaming, en de realiteit van een carrière als pentester.\nVan Interesse tot Loopbaan Thomas deelt hoe zijn interesse in cybersecurity begon tijdens zijn opleiding, met hands-on projecten zoals het hacken van virtuele machines. Een stage bij Deloitte in 2019 zette hem op het pad naar een voltijdse functie binnen het Offensive Security Team. Vandaag werkt hij al drie jaar bij Deloitte België en specialiseert hij zich in offensieve testen.\nOffensive vs. Defensive Security Hoewel zijn hart bij offensieve security ligt, kreeg hij recent ook ervaring aan de defensieve kant. Het leverde hem een breder perspectief op: “Het geeft een heel ander zicht op hoe aanvallen eruitzien vanuit de andere kant.” Toch blijft het red team werk zijn voorkeur behouden.\nWat doet een pentester nu echt? Thomas legt uit hoe een typische pentest verloopt: van het ontvangen van de scope, over het scannen van het netwerk en het zoeken naar kwetsbaarheden, tot het rapporteren van bevindingen. Tools zoals Nessus, BloodHound en PingCastle worden ingezet, vaak gecombineerd met zelfgebouwde scripts die de output analyseren en structureren.\nKwetsbaarheden in Active Directory Een groot deel van zijn werk focust op Active Directory (AD), waar hij telkens weer dezelfde pijnpunten tegenkomt: legacy-instellingen, onvoldoende gepatchte systemen, en misconfiguraties die vaak pas worden rechtgezet na een echte aanval. Twee voorbeelden die hij aanhaalt:\nLLMNR/MDNS/NetBIOS poisoning om credentials te verkrijgen DNS wildcard records die leiden tot man-in-the-middle aanvallen Tools, Tips en Oefenen Voor wie zelf wil beginnen raadt hij aan om zelf een AD op te zetten en tools als PingCastle en BloodHound uit te proberen. De meeste kennis verwerf je volgens Thomas door zelf te oefenen, dingen stuk te maken, en vooral: blijven proberen.\nDe Praktijk vs. Certificaten Hoewel certificaten nuttig zijn (zoals WPT voor webapp testing), benadrukt Thomas dat de echte leerschool het werkveld is. “90% van wat ik weet, heb ik geleerd door het gewoon te doen,” zegt hij. Oefenen op Hack The Box, zelf een netwerk opzetten, en leren van collega’s zijn voor hem essentieel.\nAfsluiter De aflevering toont hoe breed het vakgebied offensive security is: van interne pentests tot phishingcampagnes, van legacy exploits tot zero-days. Maar vooral: het is een vak waar creativiteit en nieuwsgierigheid centraal staan.\n","date":"May 20, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/professors/site/images/blog/blog-1_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/professors\\/site\\/images\\/blog\\/blog-1_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/professors/site/blog/post-4/","title":"Red Team Talk: Een Blik Achter de Schermen bij Offensive Security"},{"categories":["cybersecurity","event recap"],"contents":"Cyber Defence on the Digital Frontline: A Mission with NATO On a Mission with NATO: Cyber Defence on the Frontline Howest’s ongoing commitment to world-class cybersecurity training took center stage again as six lecturers from the Cyber Security program joined forces with experts from Latvia, Luxembourg and Belgium in one of NATO\u0026rsquo;s most intensive simulations: the Locked Shields exercise, hosted by the Cooperative Cyber Defence Centre of Excellence (CCDCOE). Now in its fifth year of participation, the Howest team shared their firsthand experiences at a special evening talk at Howest Bruges.\nThe Exercise: Locked Shields Locked Shields is no ordinary simulation. It is a full-scale, live-fire cyber defence exercise involving more than 6,000 machines and a narrative scenario so detailed it includes geopolitics, disinformation and even fictional countries. This year, the Blue Team 03 (our team) defended a simulated nation’s critical infrastructure including power plants, satellites, 5G networks and banking systems, all while under constant attack from a coordinated Red Team using automated scripts and over 28,000 attacks across two days.\nAnd yes, every team (Red, Blue, Yellow, White) uses Ansible. For everything.\nHigh Stakes, Real Lessons What do you do when a rogue process might be malware, or maybe just a poorly named service? What happens when your teammate refuses to act unless something is “officially malicious”? The team faced cultural clashes, communication breakdowns and stress-testing of both systems and people.\nThe exercise required more than technical fixes. It demanded communication with simulated commanders, media and public stakeholders. Reporting became just as important as patching. It taught participants how to translate technical impact into real-world consequences. Not \u0026ldquo;port 8443 unreachable\u0026rdquo;, but \u0026ldquo;our air defence system is degraded, and we cannot fly planes\u0026rdquo;.\nThe Black Team: Rapid Response in Action A new but powerful presence in the simulation was the Black Team, a rapid-response unit deployed when problems became too complex for any single team. Acting like special forces, they jumped in when incidents crossed team boundaries or demanded unconventional solutions. Their mission was to find out what was happening, assess the impact and suggest fast, creative responses. Introduced just last year, this team quickly proved its value again in 2025. They even embraced the role with style “you can wear sunglasses inside” became their unofficial motto.\nTheir presence underlined a critical lesson: not every problem fits neatly within a team’s silo. Real-world defence requires flexibility, speed and lateral thinking.\nHighlights and Blooper Reel There were plenty of mishaps. Misfired scripts, team mix-ups, and one case where a DNS setup from a previous year was reused by mistake. Someone tried renaming cut to shutdown, breaking essential operations until it was fixed. Systems rebooted into chaos, a manual was uploaded to public GitHub, and the team had to quickly learn the difference between symbolic links and real binaries.\nHuman Factors and Growth From detecting malware with Velociraptor and Q9, to encountering teammates who took orders literally, the learning was intense. One participant noted that while Belgian and Luxembourg teams prioritized knowledge sharing, others preferred strict protocol. This highlighted cultural differences and the importance of interpersonal skills.\nThe biggest lesson? You are never fully prepared. Every iteration of Locked Shields is different. But each one sharpens not only your skills, but also your ability to function as a team under extreme conditions.\nFrom the Battlefield to the Classroom This experience directly impacts the classroom. Inspired by the exercise, Howest is introducing new hands-on courses like “Glutamine” in semester five. Students will be dropped into realistic broken networks, with misconfigurations, fake firewalls and simulated threats. It is chaos, but controlled. And that is the point.\nAs one speaker said: “You don’t win Locked Shields. You just survive it better than the rest.”\nFinal Thoughts The exercise teaches more than just cybersecurity. It builds trust. It proves that knowing your teammates can be as important as knowing the tools. Whether that comes from a shared flight or a pre-exercise barbecue, it all matters when the pressure hits.\nWant to see how cyber defence works in real life? This is it.\n","date":"May 13, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/professors/site/images/blog/blog-1_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/professors\\/site\\/images\\/blog\\/blog-1_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/professors/site/blog/post-1/","title":"Cyber Defence on the Digital Frontline: A Mission with NATO"},{"categories":["cybersecurity","CTF","education"],"contents":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience On March 14 and 15, I joined the Cyber Security Challenge Belgium qualifiers with three teammates. For two days, we threw ourselves at CTF challenges covering binary exploitation, Android reversing, cryptography, and more.\nWhat follows is a recap of the challenges I personally worked on, some I solved, some I didn’t—but all of them left me with new skills and new ideas.\nA Buffer Overflow to Warm Up One of the first challenges I picked involved a binary with a basic stack overflow. I used standard techniques, finding the offset, hijacking the return address, and injecting shellcode. Tools like pwntools helped automate the payload crafting. It was a great warm-up and a confidence boost once it worked.\nBinary Exploitation Flag\rOurEncIsSec: Zip Bombs and OEIS Then there was a more elaborate cryptography challenge: 18 zip files, each password-protected. We cracked the first three passwords using John the Ripper and got numeric values from them. I searched the sequence in OEIS and found it matched A007408, which gave us the full pattern of passwords.\nUsing this, I could extract all zip contents automatically, reconstruct the password-protected message, and finally reveal the flag.\nPicture of the solution\rInfinite Luck: One in a Million? One challenge involved “guessing” a thousand random numbers between 1 and 10. The banner claimed it required infinite luck, but of course, the randomness was seeded. After inspecting the generator, I realized it was deterministic. By precomputing seeds and output sequences, I could match the challenge’s banner to a specific seed and regenerate the entire solution.\nChallange picture\rCorrect number order\rAndroid Reversing: FRIDA and JADX Several APKs were part of the qualifier set. I used JADX to decompile them and FRIDA to patch logic at runtime. In one challenge, I bypassed license validation by forcing key methods to return true and unlocking hidden functionality.\nThe Challenge That Stuck with Me: Rebuilding a Split DEX This one stood out.\nThe app used a 4×8 button grid. Pressing buttons loaded a sequence of blockXX files from assets. These were concatenated in-memory and passed into InMemoryDexClassLoader to load a class called be.dauntless.flag.Flag.\nClass loadClass = new InMemoryDexClassLoader(ByteBuffer.wrap(byteArrayOutputStream.toByteArray()), getClassLoader()) .loadClass(\u0026#34;be.dauntless.flag.Flag\u0026#34;); Each block was a fragment of a DEX file, but the app didn’t tell you the right order. I tried manually inspecting the fragments, identifying methods, string constants, and offsets—to infer how to reassemble the full file. I got close, but didn’t crack it in time.\nThat challenge stuck with me because it combined static analysis, runtime introspection, and logic reconstruction. It wasn’t just technical, it was creative.\nThe One That Got Away: TLS Fingerprinting Another challenge involved a Go-based TLS server that rejected all client connections unless they matched a specific fingerprint. I used Go’s tls.Config to replicate the version, cipher suites, and ALPN:\ntls.Config{ MinVersion: tls.VersionTLS13, CipherSuites: []uint16{ tls.TLS_AES_128_GCM_SHA256, // ... }, NextProtos: []string{\u0026#34;h2\u0026#34;}, } Despite that, the server still refused the connection. I suspect it was using JA4 or similar TLS fingerprinting techniques we couldn’t fully emulate. We had to move on, but I’d love to revisit that one someday.\nFinal Thoughts I didn’t solve everything. But that wasn’t the point. Every challenge was a practical puzzle, something to decode, reverse, bypass, or just understand a little better.\nWorking as a team with Evarist, Nathan, and Waut made it even more valuable. We bounced ideas off each other, divided tasks, and got a much broader set of challenges covered.\nThe Cyber Security Challenge Belgium qualifiers weren’t easy. But they were the best kind of difficult, the kind that teaches you something whether you solve the problem or not.\n","date":"March 15, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/professors/site/images/blog/post-2/binexpl_hu_3d36b409c72f3586.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"160\"\n onerror=\"this.onerror='null';\n this.src='\\/professors\\/site\\/images\\/blog\\/post-2\\/binexpl_hu_afca672637b6b98d.png';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/professors/site/blog/post-2/","title":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience"},{"categories":["cybersecurity","event","defense"],"contents":"Securing Cyberspace: Belgian Cyber Command at Howest On November 12, we had the opportunity to attend a Tech\u0026amp;Meet session unlike any other. The speaker was Colonel Gunther Godefridis, Director for Development \u0026amp; Readiness at Belgian Cyber Command, and the topic: safeguarding our country in the digital domain.\nHeld at Howest Campus Brugge Station, the event drew students, researchers, and professionals eager to understand how military-grade cybersecurity operations are run, and why they matter more than ever.\nDefending in the Digital Age Colonel Godefridis began by outlining the core mission of Belgian Cyber Command: protecting Defense’s networks and weapon systems, supporting intelligence operations (ADIV), and conducting defensive and offensive operations in cyberspace. In short, Cyber Command isn’t just watching traffic, it’s actively shaping Belgium’s digital resilience.\nWith society’s increasing reliance on digital infrastructure, the risks of espionage, disinformation, and attacks on critical systems are no longer theoretical. Godefridis highlighted the urgency of being able to respond to, not just detect, those threats.\nWorking Together: Academia, Industry, Government One theme that stood out was collaboration. Cyber Command doesn’t operate in a vacuum. It works closely with national agencies, NATO partners, academic institutions, and the private sector. The colonel emphasized that defending cyberspace requires broad cooperation, and Belgium’s approach is to engage across domains, military, civil, and industrial.\nHe also made it clear that this isn’t just about defense systems or classified data. As the line between civil and military digital infrastructure blurs, vulnerabilities in civilian systems can become national security issues. That’s where cooperation becomes essential.\nLeading with Innovation With over 20 years in military service, Colonel Godefridis brings a unique perspective. From artillery innovation to defense technology strategy, and now to cyber development, his background reflects the evolving nature of conflict and the military\u0026rsquo;s response.\nHe discussed how innovation, including artificial intelligence, is becoming central to cyber defense. Cyber Command is investing in tools and skills to automate threat detection, analyze large datasets, and simulate attack scenarios. It’s not just about building walls, it’s about staying several moves ahead.\nA Transparent, Human Conversation The Q\u0026amp;A session at the end made the evening especially memorable. Questions ranged from technical details of cyber defense capabilities to the human side of cyber careers: how people are trained, what skills are valued, and how students might contribute.\nColonel Godefridis was honest about the challenges. Cyber operations evolve quickly, and so do adversaries. But he was equally clear about the opportunity: Belgium is building a capability that matters, and it needs talent.\nFinal Thoughts If you walked into this talk expecting a dry presentation on military infrastructure, you were wrong. This session was a deep, realistic, and engaging look into how Belgium is preparing for cyber conflict, and how students like us could be a part of that mission.\nWhether you’re in cybersecurity, software development, or systems engineering, there’s a growing role to play. And as Colonel Godefridis made clear: it’s not just a job. It’s part of defending a society that’s more vulnerable, and more connected, than ever before.\nTip\nWant to learn more about Cyber Command? Visit the official website at mil.be\n","date":"November 12, 2024","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/professors/site/images/blog/blog-3_hu_fdd9e13d0370b160.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/professors\\/site\\/images\\/blog\\/blog-3_hu_c932299ff2fa7067.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/professors/site/blog/post-3/","title":"Securing Cyberspace: Belgian Cyber Command at Howest"},{"categories":null,"contents":"I built my personal blog using Hugo and deployed it on a lightweight Alpine Linux VPS. I chose this setup to have full control, keep things simple, and avoid bloated platforms or services. Here’s how the process went from site generation to live deployment.\nCreating the Hugo Site On my development machine, I created a new Hugo site:\nhugo new site howest-blog I used the professors-hugo theme and copied its exampleSite content into my project. I customized the layout, structure, and styling by editing content files, SCSS in assets/scss/custom.scss, and partial templates in the theme directory.\nAll content lives under content/, with separate folders for blog/ and project/, each containing .md files with front matter and Markdown content.\nCustomization I edited the config/_default/hugo.toml to configure site parameters like the base URL, theme, language, and menus. SCSS and image assets go in assets/, and are processed by Hugo\u0026rsquo;s pipeline. Static files like favicons are placed in static/.\nTo preview the site locally:\nhugo server To build the static site:\nhugo This generates everything in the public/ folder.\nVPS Deployment I rented a minimal Alpine Linux VPS and installed only what I needed. After setting up SSH and a basic nginx web server, I copied the public/ folder over using scp:\nscp -r public/* user@my-vps:/var/www/html On the VPS, I installed nginx:\napk add nginx And configured /etc/nginx/conf.d/default.conf to serve files from /var/www/html. Then I enabled and started nginx:\nrc-service nginx start rc-update add nginx Now my Hugo site is live and served directly as static files, no backend, no database, just HTML, CSS, and JS.\nWhy Alpine + Hugo? Alpine Linux is minimal and fast, perfect for serving static sites with low resource usage. Combined with Hugo’s speed and flexibility, I get a complete, performant setup that I fully control. It’s secure, lightweight, and easy to update, just rebuild and re-upload the public/ folder.\nThis setup is perfect if you want full control and minimal overhead for a personal blog or portfolio.\n","date":"May 29, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/professors/site/images/project/project-2_hu_b10de0491c6514dc.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"278\"\n onerror=\"this.onerror='null';\n this.src='\\/professors\\/site\\/images\\/project\\/project-2_hu_3550dd40bf159427.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/professors/site/project/project-2/","title":"Building My Hugo Website on a VPS"},{"categories":null,"contents":"DRMDTool is an automation-centric utility designed to streamline the processing of .drmd files by tightly integrating with the N_m3u8DL-RE downloader. The tool offers robust automation via a watch folder and an intuitive web-based interface, significantly reducing the friction for managing and processing DRM-protected streaming content.\nWhat’s New DRMDTool has evolved into a comprehensive platform for batch downloading with enhanced support for user interaction and background processing. It features granular job tracking, dynamic download control (pause, resume, abort), and a refined WebSocket-based console for real-time command output. Subtitle handling now includes automatic downloading and conversion from VTT to SRT, and the downloader adapts based on metadata, organizing content into categorized directories.\nGoals and Use Case The primary aim is to automate .drmd file processing with minimal manual input. Users can configure download formats, specify directories, and enable real-time command broadcasting. DRMDTool is suitable for both interactive use through a web UI and headless automation in pipelines, supporting inotify or polling-based folder watching.\nHow .drmd Files Work A .drmd file is a structured JSON document that defines one or more encrypted media items to be processed by DRMDTool. It contains an Items array, with each item representing a specific media job. DRMDTool parses these entries to generate download commands for N_m3u8DL-RE.\nEach item includes:\nMPD: A DASH manifest, either a direct URL or a base64-encoded version. If base64-encoded, DRMDTool decodes and temporarily saves it before use. Keys: A comma-separated list of KID:key pairs (e.g., abcd1234ef567890:00112233445566778899aabbccddeeff). These are required for decrypting encrypted media streams and are passed directly to N_m3u8DL-RE using --key flags. Filename: The name to be used for the final output file. Subtitles: Comma-separated list of subtitle URLs in .vtt format. DRMDTool downloads and converts these to .srt, then muxes them into the final file. Metadata: A semicolon-separated string like Title;Type;Season (e.g., Example Show;serie;1) used to determine directory structure (Movies/Title or Series/Title/Season). Description and Poster: Optional fields used only for display in the web UI. Example .drmd Structure { \u0026#34;Items\u0026#34;: [ { \u0026#34;MPD\u0026#34;: \u0026#34;aHR0cHM6Ly9leGFtcGxlLmNvbS9zdHJlYW0ubXBk\u0026#34;, \u0026#34;Keys\u0026#34;: \u0026#34;abcd1234ef567890:00112233445566778899aabbccddeeff\u0026#34;, \u0026#34;Filename\u0026#34;: \u0026#34;ExampleShow.S01E01\u0026#34;, \u0026#34;Subtitles\u0026#34;: \u0026#34;https://example.com/sub1.vtt,https://example.com/sub2.vtt\u0026#34;, \u0026#34;Metadata\u0026#34;: \u0026#34;Example Show;serie;1\u0026#34;, \u0026#34;Description\u0026#34;: \u0026#34;Pilot episode\u0026#34;, \u0026#34;Poster\u0026#34;: \u0026#34;\u0026#34; } ] } Processing Steps Detection: DRMDTool either watches a folder or receives .drmd uploads through the web UI. Validation: It waits for the file to finish writing (based on file size stability), then parses its contents. MPD Handling: If base64-encoded, the MPD is decoded and written to a temp file; otherwise, the URL is fetched or passed as-is. Command Generation: Using the MPD, KID:key pairs, output paths, and subtitles, DRMDTool builds a command line for N_m3u8DL-RE. Execution: The download is launched with live progress tracking. Users can pause, resume, or abort jobs, and optionally stream console output via WebSocket. These files serve as portable job definitions. When DRMDTool detects or receives a .drmd file, it parses the items, decodes or downloads the MPD, applies the keys, and builds a download command using N_m3u8DL-RE. Files are saved in organized directories like Movies/Title or Series/Title/Season, and subtitles are embedded if available. Pausing, resuming, and aborting downloads is supported per file.\nArchitecture Overview The configuration is handled via config.toml, with environment variable overrides for containerized or dynamic deployments. Once started, the tool can either monitor a specified folder or allow file uploads through the UI. Each .drmd file is parsed, grouped by series and season (if applicable), and processed sequentially with support for job pausing and resuming.\nWeb UI \u0026amp; CLI To use:\n./drmdtool Visit http://localhost:8080 for the web interface, which supports drag-and-drop uploads, selection of episodes or movies, and real-time progress tracking. For headless operation:\n./drmdtool -f /path/to/file.drmd Jobs can be paused, resumed, or aborted through the web interface, which reflects the backend state via live updates.\nEnhanced Download Logic DRMDTool dynamically builds download commands using metadata from .drmd files and user preferences. It ensures that only the highest quality streams are kept, removing ad periods and duplicate segments from the MPD files. Subtitles are fetched and embedded automatically. Jobs are tracked with robust state management and logs for debugging and visibility.\nRepository Code and setup instructions are hosted here: https://git.directme.in/Joren/DRMDTool\nDRMDtool For advanced usage details, customization, and API structure, refer to the README.md in the repository.\n","date":"May 21, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/professors/site/images/project/project-1_hu_3db5ce4165d1b6f3.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"396\"\n onerror=\"this.onerror='null';\n this.src='\\/professors\\/site\\/images\\/project\\/project-1_hu_7691192a371c30a3.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/professors/site/project/project-1/","title":"DRMDTool Project"},{"categories":["cybersecurity","podcast","interview"],"contents":"Red Team Talk: Een Blik Achter de Schermen bij Offensive Security In deze eerste aflevering van Red Team Talk nemen wij, Joren Schipman en Mattia Punjwani, studenten Cybersecurity aan Howest, jullie mee in een gesprek met Thomas Castronovo, ethical hacker en consultant bij Deloitte. Samen duiken we in de wereld van offensieve security, red teaming, en de realiteit van een carrière als pentester.\nVan Interesse tot Loopbaan Thomas deelt hoe zijn interesse in cybersecurity begon tijdens zijn opleiding, met hands-on projecten zoals het hacken van virtuele machines. Een stage bij Deloitte in 2019 zette hem op het pad naar een voltijdse functie binnen het Offensive Security Team. Vandaag werkt hij al drie jaar bij Deloitte België en specialiseert hij zich in offensieve testen.\nOffensive vs. Defensive Security Hoewel zijn hart bij offensieve security ligt, kreeg hij recent ook ervaring aan de defensieve kant. Het leverde hem een breder perspectief op: “Het geeft een heel ander zicht op hoe aanvallen eruitzien vanuit de andere kant.” Toch blijft het red team werk zijn voorkeur behouden.\nWat doet een pentester nu echt? Thomas legt uit hoe een typische pentest verloopt: van het ontvangen van de scope, over het scannen van het netwerk en het zoeken naar kwetsbaarheden, tot het rapporteren van bevindingen. Tools zoals Nessus, BloodHound en PingCastle worden ingezet, vaak gecombineerd met zelfgebouwde scripts die de output analyseren en structureren.\nKwetsbaarheden in Active Directory Een groot deel van zijn werk focust op Active Directory (AD), waar hij telkens weer dezelfde pijnpunten tegenkomt: legacy-instellingen, onvoldoende gepatchte systemen, en misconfiguraties die vaak pas worden rechtgezet na een echte aanval. Twee voorbeelden die hij aanhaalt:\nLLMNR/MDNS/NetBIOS poisoning om credentials te verkrijgen DNS wildcard records die leiden tot man-in-the-middle aanvallen Tools, Tips en Oefenen Voor wie zelf wil beginnen raadt hij aan om zelf een AD op te zetten en tools als PingCastle en BloodHound uit te proberen. De meeste kennis verwerf je volgens Thomas door zelf te oefenen, dingen stuk te maken, en vooral: blijven proberen.\nDe Praktijk vs. Certificaten Hoewel certificaten nuttig zijn (zoals WPT voor webapp testing), benadrukt Thomas dat de echte leerschool het werkveld is. “90% van wat ik weet, heb ik geleerd door het gewoon te doen,” zegt hij. Oefenen op Hack The Box, zelf een netwerk opzetten, en leren van collega’s zijn voor hem essentieel.\nAfsluiter De aflevering toont hoe breed het vakgebied offensive security is: van interne pentests tot phishingcampagnes, van legacy exploits tot zero-days. Maar vooral: het is een vak waar creativiteit en nieuwsgierigheid centraal staan.\n","date":"May 20, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/professors/site/images/blog/blog-4_hu_8ddea2f052660626.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/professors\\/site\\/images\\/blog\\/blog-4_hu_96cadc46e7508592.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/professors/site/blog/post-4/","title":"Red Team Talk: Een Blik Achter de Schermen bij Offensive Security"},{"categories":["cybersecurity","event recap"],"contents":"Cyber Defence on the Digital Frontline: A Mission with NATO On a Mission with NATO: Cyber Defence on the Frontline Howest’s ongoing commitment to world-class cybersecurity training took center stage again as six lecturers from the Cyber Security program joined forces with experts from Latvia, Luxembourg and Belgium in one of NATO\u0026rsquo;s most intensive simulations: the Locked Shields exercise, hosted by the Cooperative Cyber Defence Centre of Excellence (CCDCOE). Now in its fifth year of participation, the Howest team shared their firsthand experiences at a special evening talk at Howest Bruges.\nThe Exercise: Locked Shields Locked Shields is no ordinary simulation. It is a full-scale, live-fire cyber defence exercise involving more than 6,000 machines and a narrative scenario so detailed it includes geopolitics, disinformation and even fictional countries. This year, the Blue Team 03 (our team) defended a simulated nation’s critical infrastructure including power plants, satellites, 5G networks and banking systems, all while under constant attack from a coordinated Red Team using automated scripts and over 28,000 attacks across two days.\nAnd yes, every team (Red, Blue, Yellow, White) uses Ansible. For everything.\nHigh Stakes, Real Lessons What do you do when a rogue process might be malware, or maybe just a poorly named service? What happens when your teammate refuses to act unless something is “officially malicious”? The team faced cultural clashes, communication breakdowns and stress-testing of both systems and people.\nThe exercise required more than technical fixes. It demanded communication with simulated commanders, media and public stakeholders. Reporting became just as important as patching. It taught participants how to translate technical impact into real-world consequences. Not \u0026ldquo;port 8443 unreachable\u0026rdquo;, but \u0026ldquo;our air defence system is degraded, and we cannot fly planes\u0026rdquo;.\nThe Black Team: Rapid Response in Action A new but powerful presence in the simulation was the Black Team, a rapid-response unit deployed when problems became too complex for any single team. Acting like special forces, they jumped in when incidents crossed team boundaries or demanded unconventional solutions. Their mission was to find out what was happening, assess the impact and suggest fast, creative responses. Introduced just last year, this team quickly proved its value again in 2025. They even embraced the role with style “you can wear sunglasses inside” became their unofficial motto.\nTheir presence underlined a critical lesson: not every problem fits neatly within a team’s silo. Real-world defence requires flexibility, speed and lateral thinking.\nHighlights and Blooper Reel There were plenty of mishaps. Misfired scripts, team mix-ups, and one case where a DNS setup from a previous year was reused by mistake. Someone tried renaming cut to shutdown, breaking essential operations until it was fixed. Systems rebooted into chaos, a manual was uploaded to public GitHub, and the team had to quickly learn the difference between symbolic links and real binaries.\nHuman Factors and Growth From detecting malware with Velociraptor and Q9, to encountering teammates who took orders literally, the learning was intense. One participant noted that while Belgian and Luxembourg teams prioritized knowledge sharing, others preferred strict protocol. This highlighted cultural differences and the importance of interpersonal skills.\nThe biggest lesson? You are never fully prepared. Every iteration of Locked Shields is different. But each one sharpens not only your skills, but also your ability to function as a team under extreme conditions.\nFrom the Battlefield to the Classroom This experience directly impacts the classroom. Inspired by the exercise, Howest is introducing new hands-on courses like “Glutamine” in semester five. Students will be dropped into realistic broken networks, with misconfigurations, fake firewalls and simulated threats. It is chaos, but controlled. And that is the point.\nAs one speaker said: “You don’t win Locked Shields. You just survive it better than the rest.”\nFinal Thoughts The exercise teaches more than just cybersecurity. It builds trust. It proves that knowing your teammates can be as important as knowing the tools. Whether that comes from a shared flight or a pre-exercise barbecue, it all matters when the pressure hits.\nWant to see how cyber defence works in real life? This is it.\n","date":"May 13, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/professors/site/images/blog/blog-1_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/professors\\/site\\/images\\/blog\\/blog-1_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/professors/site/blog/post-1/","title":"Cyber Defence on the Digital Frontline: A Mission with NATO"},{"categories":["cybersecurity","CTF","education"],"contents":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience On March 14 and 15, I joined the Cyber Security Challenge Belgium qualifiers with three teammates. For two days, we threw ourselves at CTF challenges covering binary exploitation, Android reversing, cryptography, and more.\nWhat follows is a recap of the challenges I personally worked on, some I solved, some I didn’t—but all of them left me with new skills and new ideas.\nA Buffer Overflow to Warm Up One of the first challenges I picked involved a binary with a basic stack overflow. I used standard techniques, finding the offset, hijacking the return address, and injecting shellcode. Tools like pwntools helped automate the payload crafting. It was a great warm-up and a confidence boost once it worked.\nBinary Exploitation Flag\rOurEncIsSec: Zip Bombs and OEIS Then there was a more elaborate cryptography challenge: 18 zip files, each password-protected. We cracked the first three passwords using John the Ripper and got numeric values from them. I searched the sequence in OEIS and found it matched A007408, which gave us the full pattern of passwords.\nUsing this, I could extract all zip contents automatically, reconstruct the password-protected message, and finally reveal the flag.\nPicture of the solution\rInfinite Luck: One in a Million? One challenge involved “guessing” a thousand random numbers between 1 and 10. The banner claimed it required infinite luck, but of course, the randomness was seeded. After inspecting the generator, I realized it was deterministic. By precomputing seeds and output sequences, I could match the challenge’s banner to a specific seed and regenerate the entire solution.\nChallange picture\rCorrect number order\rAndroid Reversing: FRIDA and JADX Several APKs were part of the qualifier set. I used JADX to decompile them and FRIDA to patch logic at runtime. In one challenge, I bypassed license validation by forcing key methods to return true and unlocking hidden functionality.\nThe Challenge That Stuck with Me: Rebuilding a Split DEX This one stood out.\nThe app used a 4×8 button grid. Pressing buttons loaded a sequence of blockXX files from assets. These were concatenated in-memory and passed into InMemoryDexClassLoader to load a class called be.dauntless.flag.Flag.\nClass loadClass = new InMemoryDexClassLoader(ByteBuffer.wrap(byteArrayOutputStream.toByteArray()), getClassLoader()) .loadClass(\u0026#34;be.dauntless.flag.Flag\u0026#34;); Each block was a fragment of a DEX file, but the app didn’t tell you the right order. I tried manually inspecting the fragments, identifying methods, string constants, and offsets—to infer how to reassemble the full file. I got close, but didn’t crack it in time.\nThat challenge stuck with me because it combined static analysis, runtime introspection, and logic reconstruction. It wasn’t just technical, it was creative.\nThe One That Got Away: TLS Fingerprinting Another challenge involved a Go-based TLS server that rejected all client connections unless they matched a specific fingerprint. I used Go’s tls.Config to replicate the version, cipher suites, and ALPN:\ntls.Config{ MinVersion: tls.VersionTLS13, CipherSuites: []uint16{ tls.TLS_AES_128_GCM_SHA256, // ... }, NextProtos: []string{\u0026#34;h2\u0026#34;}, } Despite that, the server still refused the connection. I suspect it was using JA4 or similar TLS fingerprinting techniques we couldn’t fully emulate. We had to move on, but I’d love to revisit that one someday.\nFinal Thoughts I didn’t solve everything. But that wasn’t the point. Every challenge was a practical puzzle, something to decode, reverse, bypass, or just understand a little better.\nWorking as a team with Evarist, Nathan, and Waut made it even more valuable. We bounced ideas off each other, divided tasks, and got a much broader set of challenges covered.\nThe Cyber Security Challenge Belgium qualifiers weren’t easy. But they were the best kind of difficult, the kind that teaches you something whether you solve the problem or not.\n","date":"March 15, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/professors/site/images/blog/post-2/binexpl_hu_3d36b409c72f3586.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"160\"\n onerror=\"this.onerror='null';\n this.src='\\/professors\\/site\\/images\\/blog\\/post-2\\/binexpl_hu_afca672637b6b98d.png';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/professors/site/blog/post-2/","title":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience"},{"categories":["cybersecurity","event","defense"],"contents":"Securing Cyberspace: Belgian Cyber Command at Howest On November 12, we had the opportunity to attend a Tech\u0026amp;Meet session unlike any other. The speaker was Colonel Gunther Godefridis, Director for Development \u0026amp; Readiness at Belgian Cyber Command, and the topic: safeguarding our country in the digital domain.\nHeld at Howest Campus Brugge Station, the event drew students, researchers, and professionals eager to understand how military-grade cybersecurity operations are run, and why they matter more than ever.\nDefending in the Digital Age Colonel Godefridis began by outlining the core mission of Belgian Cyber Command: protecting Defense’s networks and weapon systems, supporting intelligence operations (ADIV), and conducting defensive and offensive operations in cyberspace. In short, Cyber Command isn’t just watching traffic, it’s actively shaping Belgium’s digital resilience.\nWith society’s increasing reliance on digital infrastructure, the risks of espionage, disinformation, and attacks on critical systems are no longer theoretical. Godefridis highlighted the urgency of being able to respond to, not just detect, those threats.\nWorking Together: Academia, Industry, Government One theme that stood out was collaboration. Cyber Command doesn’t operate in a vacuum. It works closely with national agencies, NATO partners, academic institutions, and the private sector. The colonel emphasized that defending cyberspace requires broad cooperation, and Belgium’s approach is to engage across domains, military, civil, and industrial.\nHe also made it clear that this isn’t just about defense systems or classified data. As the line between civil and military digital infrastructure blurs, vulnerabilities in civilian systems can become national security issues. That’s where cooperation becomes essential.\nLeading with Innovation With over 20 years in military service, Colonel Godefridis brings a unique perspective. From artillery innovation to defense technology strategy, and now to cyber development, his background reflects the evolving nature of conflict and the military\u0026rsquo;s response.\nHe discussed how innovation, including artificial intelligence, is becoming central to cyber defense. Cyber Command is investing in tools and skills to automate threat detection, analyze large datasets, and simulate attack scenarios. It’s not just about building walls, it’s about staying several moves ahead.\nA Transparent, Human Conversation The Q\u0026amp;A session at the end made the evening especially memorable. Questions ranged from technical details of cyber defense capabilities to the human side of cyber careers: how people are trained, what skills are valued, and how students might contribute.\nColonel Godefridis was honest about the challenges. Cyber operations evolve quickly, and so do adversaries. But he was equally clear about the opportunity: Belgium is building a capability that matters, and it needs talent.\nFinal Thoughts If you walked into this talk expecting a dry presentation on military infrastructure, you were wrong. This session was a deep, realistic, and engaging look into how Belgium is preparing for cyber conflict, and how students like us could be a part of that mission.\nWhether you’re in cybersecurity, software development, or systems engineering, there’s a growing role to play. And as Colonel Godefridis made clear: it’s not just a job. It’s part of defending a society that’s more vulnerable, and more connected, than ever before.\nTip\nWant to learn more about Cyber Command? Visit the official website at mil.be\n","date":"November 12, 2024","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/professors/site/images/blog/blog-3_hu_fdd9e13d0370b160.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/professors\\/site\\/images\\/blog\\/blog-3_hu_c932299ff2fa7067.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/professors/site/blog/post-3/","title":"Securing Cyberspace: Belgian Cyber Command at Howest"},{"categories":null,"contents":"I built my personal blog using Hugo and deployed it on a lightweight Alpine Linux VPS. I chose this setup to have full control, keep things simple, and avoid bloated platforms or services. Here’s how the process went from site generation to live deployment.\nCreating the Hugo Site On my development machine, I created a new Hugo site:\nhugo new site howest-blog I used the professors-hugo theme and copied its exampleSite content into my project. I customized the layout, structure, and styling by editing content files, SCSS in assets/scss/custom.scss, and partial templates in the theme directory.\nAll content lives under content/, with separate folders for blog/ and project/, each containing .md files with front matter and Markdown content.\nCustomization I edited the config/_default/hugo.toml to configure site parameters like the base URL, theme, language, and menus. SCSS and image assets go in assets/, and are processed by Hugo\u0026rsquo;s pipeline. Static files like favicons are placed in static/.\nTo preview the site locally:\nhugo server To build the static site:\nhugo This generates everything in the public/ folder.\nVPS Deployment I rented a minimal Alpine Linux VPS and installed only what I needed. After setting up SSH and a basic nginx web server, I copied the public/ folder over using scp:\nscp -r public/* user@my-vps:/var/www/html On the VPS, I installed nginx:\napk add nginx And configured /etc/nginx/conf.d/default.conf to serve files from /var/www/html. Then I enabled and started nginx:\nrc-service nginx start rc-update add nginx Now my Hugo site is live and served directly as static files, no backend, no database, just HTML, CSS, and JS.\nWhy Alpine + Hugo? Alpine Linux is minimal and fast, perfect for serving static sites with low resource usage. Combined with Hugo’s speed and flexibility, I get a complete, performant setup that I fully control. It’s secure, lightweight, and easy to update, just rebuild and re-upload the public/ folder.\nThis setup is perfect if you want full control and minimal overhead for a personal blog or portfolio.\n","date":"May 29, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/professors/site/images/project/project-2_hu_b10de0491c6514dc.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"278\"\n onerror=\"this.onerror='null';\n this.src='\\/professors\\/site\\/images\\/project\\/project-2_hu_3550dd40bf159427.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/professors/site/project/project-2/","title":"Building My Hugo Website on a VPS"},{"categories":null,"contents":"DRMDTool is an automation-centric utility designed to streamline the processing of .drmd files by tightly integrating with the N_m3u8DL-RE downloader. The tool offers robust automation via a watch folder and an intuitive web-based interface, significantly reducing the friction for managing and processing DRM-protected streaming content.\nWhat’s New DRMDTool has evolved into a comprehensive platform for batch downloading with enhanced support for user interaction and background processing. It features granular job tracking, dynamic download control (pause, resume, abort), and a refined WebSocket-based console for real-time command output. Subtitle handling now includes automatic downloading and conversion from VTT to SRT, and the downloader adapts based on metadata, organizing content into categorized directories.\nGoals and Use Case The primary aim is to automate .drmd file processing with minimal manual input. Users can configure download formats, specify directories, and enable real-time command broadcasting. DRMDTool is suitable for both interactive use through a web UI and headless automation in pipelines, supporting inotify or polling-based folder watching.\nHow .drmd Files Work A .drmd file is a structured JSON document that defines one or more encrypted media items to be processed by DRMDTool. It contains an Items array, with each item representing a specific media job. DRMDTool parses these entries to generate download commands for N_m3u8DL-RE.\nEach item includes:\nMPD: A DASH manifest, either a direct URL or a base64-encoded version. If base64-encoded, DRMDTool decodes and temporarily saves it before use. Keys: A comma-separated list of KID:key pairs (e.g., abcd1234ef567890:00112233445566778899aabbccddeeff). These are required for decrypting encrypted media streams and are passed directly to N_m3u8DL-RE using --key flags. Filename: The name to be used for the final output file. Subtitles: Comma-separated list of subtitle URLs in .vtt format. DRMDTool downloads and converts these to .srt, then muxes them into the final file. Metadata: A semicolon-separated string like Title;Type;Season (e.g., Example Show;serie;1) used to determine directory structure (Movies/Title or Series/Title/Season). Description and Poster: Optional fields used only for display in the web UI. Example .drmd Structure { \u0026#34;Items\u0026#34;: [ { \u0026#34;MPD\u0026#34;: \u0026#34;aHR0cHM6Ly9leGFtcGxlLmNvbS9zdHJlYW0ubXBk\u0026#34;, \u0026#34;Keys\u0026#34;: \u0026#34;abcd1234ef567890:00112233445566778899aabbccddeeff\u0026#34;, \u0026#34;Filename\u0026#34;: \u0026#34;ExampleShow.S01E01\u0026#34;, \u0026#34;Subtitles\u0026#34;: \u0026#34;https://example.com/sub1.vtt,https://example.com/sub2.vtt\u0026#34;, \u0026#34;Metadata\u0026#34;: \u0026#34;Example Show;serie;1\u0026#34;, \u0026#34;Description\u0026#34;: \u0026#34;Pilot episode\u0026#34;, \u0026#34;Poster\u0026#34;: \u0026#34;\u0026#34; } ] } Processing Steps Detection: DRMDTool either watches a folder or receives .drmd uploads through the web UI. Validation: It waits for the file to finish writing (based on file size stability), then parses its contents. MPD Handling: If base64-encoded, the MPD is decoded and written to a temp file; otherwise, the URL is fetched or passed as-is. Command Generation: Using the MPD, KID:key pairs, output paths, and subtitles, DRMDTool builds a command line for N_m3u8DL-RE. Execution: The download is launched with live progress tracking. Users can pause, resume, or abort jobs, and optionally stream console output via WebSocket. These files serve as portable job definitions. When DRMDTool detects or receives a .drmd file, it parses the items, decodes or downloads the MPD, applies the keys, and builds a download command using N_m3u8DL-RE. Files are saved in organized directories like Movies/Title or Series/Title/Season, and subtitles are embedded if available. Pausing, resuming, and aborting downloads is supported per file.\nArchitecture Overview The configuration is handled via config.toml, with environment variable overrides for containerized or dynamic deployments. Once started, the tool can either monitor a specified folder or allow file uploads through the UI. Each .drmd file is parsed, grouped by series and season (if applicable), and processed sequentially with support for job pausing and resuming.\nWeb UI \u0026amp; CLI To use:\n./drmdtool Visit http://localhost:8080 for the web interface, which supports drag-and-drop uploads, selection of episodes or movies, and real-time progress tracking. For headless operation:\n./drmdtool -f /path/to/file.drmd Jobs can be paused, resumed, or aborted through the web interface, which reflects the backend state via live updates.\nEnhanced Download Logic DRMDTool dynamically builds download commands using metadata from .drmd files and user preferences. It ensures that only the highest quality streams are kept, removing ad periods and duplicate segments from the MPD files. Subtitles are fetched and embedded automatically. Jobs are tracked with robust state management and logs for debugging and visibility.\nRepository Code and setup instructions are hosted here: https://git.directme.in/Joren/DRMDTool\nDRMDtool For advanced usage details, customization, and API structure, refer to the README.md in the repository.\n","date":"May 21, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/professors/site/images/project/project-1_hu_3db5ce4165d1b6f3.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"396\"\n onerror=\"this.onerror='null';\n this.src='\\/professors\\/site\\/images\\/project\\/project-1_hu_7691192a371c30a3.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/professors/site/project/project-1/","title":"DRMDTool Project"},{"categories":["cybersecurity","podcast","interview"],"contents":"Red Team Talk: Een Blik Achter de Schermen bij Offensive Security In deze eerste aflevering van Red Team Talk nemen wij, Joren Schipman en Mattia Punjwani, studenten Cybersecurity aan Howest, jullie mee in een gesprek met Thomas Castronovo, ethical hacker en consultant bij Deloitte. Samen duiken we in de wereld van offensieve security, red teaming, en de realiteit van een carrière als pentester.\nVan Interesse tot Loopbaan Thomas deelt hoe zijn interesse in cybersecurity begon tijdens zijn opleiding, met hands-on projecten zoals het hacken van virtuele machines. Een stage bij Deloitte in 2019 zette hem op het pad naar een voltijdse functie binnen het Offensive Security Team. Vandaag werkt hij al drie jaar bij Deloitte België en specialiseert hij zich in offensieve testen.\nOffensive vs. Defensive Security Hoewel zijn hart bij offensieve security ligt, kreeg hij recent ook ervaring aan de defensieve kant. Het leverde hem een breder perspectief op: “Het geeft een heel ander zicht op hoe aanvallen eruitzien vanuit de andere kant.” Toch blijft het red team werk zijn voorkeur behouden.\nWat doet een pentester nu echt? Thomas legt uit hoe een typische pentest verloopt: van het ontvangen van de scope, over het scannen van het netwerk en het zoeken naar kwetsbaarheden, tot het rapporteren van bevindingen. Tools zoals Nessus, BloodHound en PingCastle worden ingezet, vaak gecombineerd met zelfgebouwde scripts die de output analyseren en structureren.\nKwetsbaarheden in Active Directory Een groot deel van zijn werk focust op Active Directory (AD), waar hij telkens weer dezelfde pijnpunten tegenkomt: legacy-instellingen, onvoldoende gepatchte systemen, en misconfiguraties die vaak pas worden rechtgezet na een echte aanval. Twee voorbeelden die hij aanhaalt:\nLLMNR/MDNS/NetBIOS poisoning om credentials te verkrijgen DNS wildcard records die leiden tot man-in-the-middle aanvallen Tools, Tips en Oefenen Voor wie zelf wil beginnen raadt hij aan om zelf een AD op te zetten en tools als PingCastle en BloodHound uit te proberen. De meeste kennis verwerf je volgens Thomas door zelf te oefenen, dingen stuk te maken, en vooral: blijven proberen.\nDe Praktijk vs. Certificaten Hoewel certificaten nuttig zijn (zoals WPT voor webapp testing), benadrukt Thomas dat de echte leerschool het werkveld is. “90% van wat ik weet, heb ik geleerd door het gewoon te doen,” zegt hij. Oefenen op Hack The Box, zelf een netwerk opzetten, en leren van collega’s zijn voor hem essentieel.\nAfsluiter De aflevering toont hoe breed het vakgebied offensive security is: van interne pentests tot phishingcampagnes, van legacy exploits tot zero-days. Maar vooral: het is een vak waar creativiteit en nieuwsgierigheid centraal staan.\n","date":"May 20, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/professors/site/images/blog/blog-4_hu_8ddea2f052660626.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/professors\\/site\\/images\\/blog\\/blog-4_hu_96cadc46e7508592.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/professors/site/blog/post-4/","title":"Red Team Talk: Een Blik Achter de Schermen bij Offensive Security"},{"categories":["cybersecurity","event recap"],"contents":"Cyber Defence on the Digital Frontline: A Mission with NATO On a Mission with NATO: Cyber Defence on the Frontline Howest’s ongoing commitment to world-class cybersecurity training took center stage again as six lecturers from the Cyber Security program joined forces with experts from Latvia, Luxembourg and Belgium in one of NATO\u0026rsquo;s most intensive simulations: the Locked Shields exercise, hosted by the Cooperative Cyber Defence Centre of Excellence (CCDCOE). Now in its fifth year of participation, the Howest team shared their firsthand experiences at a special evening talk at Howest Bruges.\nThe Exercise: Locked Shields Locked Shields is no ordinary simulation. It is a full-scale, live-fire cyber defence exercise involving more than 6,000 machines and a narrative scenario so detailed it includes geopolitics, disinformation and even fictional countries. This year, the Blue Team 03 (our team) defended a simulated nation’s critical infrastructure including power plants, satellites, 5G networks and banking systems, all while under constant attack from a coordinated Red Team using automated scripts and over 28,000 attacks across two days.\nAnd yes, every team (Red, Blue, Yellow, White) uses Ansible. For everything.\nHigh Stakes, Real Lessons What do you do when a rogue process might be malware, or maybe just a poorly named service? What happens when your teammate refuses to act unless something is “officially malicious”? The team faced cultural clashes, communication breakdowns and stress-testing of both systems and people.\nThe exercise required more than technical fixes. It demanded communication with simulated commanders, media and public stakeholders. Reporting became just as important as patching. It taught participants how to translate technical impact into real-world consequences. Not \u0026ldquo;port 8443 unreachable\u0026rdquo;, but \u0026ldquo;our air defence system is degraded, and we cannot fly planes\u0026rdquo;.\nThe Black Team: Rapid Response in Action A new but powerful presence in the simulation was the Black Team, a rapid-response unit deployed when problems became too complex for any single team. Acting like special forces, they jumped in when incidents crossed team boundaries or demanded unconventional solutions. Their mission was to find out what was happening, assess the impact and suggest fast, creative responses. Introduced just last year, this team quickly proved its value again in 2025. They even embraced the role with style “you can wear sunglasses inside” became their unofficial motto.\nTheir presence underlined a critical lesson: not every problem fits neatly within a team’s silo. Real-world defence requires flexibility, speed and lateral thinking.\nHighlights and Blooper Reel There were plenty of mishaps. Misfired scripts, team mix-ups, and one case where a DNS setup from a previous year was reused by mistake. Someone tried renaming cut to shutdown, breaking essential operations until it was fixed. Systems rebooted into chaos, a manual was uploaded to public GitHub, and the team had to quickly learn the difference between symbolic links and real binaries.\nHuman Factors and Growth From detecting malware with Velociraptor and Q9, to encountering teammates who took orders literally, the learning was intense. One participant noted that while Belgian and Luxembourg teams prioritized knowledge sharing, others preferred strict protocol. This highlighted cultural differences and the importance of interpersonal skills.\nThe biggest lesson? You are never fully prepared. Every iteration of Locked Shields is different. But each one sharpens not only your skills, but also your ability to function as a team under extreme conditions.\nFrom the Battlefield to the Classroom This experience directly impacts the classroom. Inspired by the exercise, Howest is introducing new hands-on courses like “Glutamine” in semester five. Students will be dropped into realistic broken networks, with misconfigurations, fake firewalls and simulated threats. It is chaos, but controlled. And that is the point.\nAs one speaker said: “You don’t win Locked Shields. You just survive it better than the rest.”\nFinal Thoughts The exercise teaches more than just cybersecurity. It builds trust. It proves that knowing your teammates can be as important as knowing the tools. Whether that comes from a shared flight or a pre-exercise barbecue, it all matters when the pressure hits.\nWant to see how cyber defence works in real life? This is it.\n","date":"May 13, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/professors/site/images/blog/blog-1_hu_8def6289c64a2dc8.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/professors\\/site\\/images\\/blog\\/blog-1_hu_d77be45b273e444.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/professors/site/blog/post-1/","title":"Cyber Defence on the Digital Frontline: A Mission with NATO"},{"categories":["cybersecurity","CTF","education"],"contents":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience On March 14 and 15, I joined the Cyber Security Challenge Belgium qualifiers with three teammates. For two days, we threw ourselves at CTF challenges covering binary exploitation, Android reversing, cryptography, and more.\nWhat follows is a recap of the challenges I personally worked on, some I solved, some I didn’t—but all of them left me with new skills and new ideas.\nA Buffer Overflow to Warm Up One of the first challenges I picked involved a binary with a basic stack overflow. I used standard techniques, finding the offset, hijacking the return address, and injecting shellcode. Tools like pwntools helped automate the payload crafting. It was a great warm-up and a confidence boost once it worked.\nBinary Exploitation Flag\rOurEncIsSec: Zip Bombs and OEIS Then there was a more elaborate cryptography challenge: 18 zip files, each password-protected. We cracked the first three passwords using John the Ripper and got numeric values from them. I searched the sequence in OEIS and found it matched A007408, which gave us the full pattern of passwords.\nUsing this, I could extract all zip contents automatically, reconstruct the password-protected message, and finally reveal the flag.\nPicture of the solution\rInfinite Luck: One in a Million? One challenge involved “guessing” a thousand random numbers between 1 and 10. The banner claimed it required infinite luck, but of course, the randomness was seeded. After inspecting the generator, I realized it was deterministic. By precomputing seeds and output sequences, I could match the challenge’s banner to a specific seed and regenerate the entire solution.\nChallange picture\rCorrect number order\rAndroid Reversing: FRIDA and JADX Several APKs were part of the qualifier set. I used JADX to decompile them and FRIDA to patch logic at runtime. In one challenge, I bypassed license validation by forcing key methods to return true and unlocking hidden functionality.\nThe Challenge That Stuck with Me: Rebuilding a Split DEX This one stood out.\nThe app used a 4×8 button grid. Pressing buttons loaded a sequence of blockXX files from assets. These were concatenated in-memory and passed into InMemoryDexClassLoader to load a class called be.dauntless.flag.Flag.\nClass loadClass = new InMemoryDexClassLoader(ByteBuffer.wrap(byteArrayOutputStream.toByteArray()), getClassLoader()) .loadClass(\u0026#34;be.dauntless.flag.Flag\u0026#34;); Each block was a fragment of a DEX file, but the app didn’t tell you the right order. I tried manually inspecting the fragments, identifying methods, string constants, and offsets—to infer how to reassemble the full file. I got close, but didn’t crack it in time.\nThat challenge stuck with me because it combined static analysis, runtime introspection, and logic reconstruction. It wasn’t just technical, it was creative.\nThe One That Got Away: TLS Fingerprinting Another challenge involved a Go-based TLS server that rejected all client connections unless they matched a specific fingerprint. I used Go’s tls.Config to replicate the version, cipher suites, and ALPN:\ntls.Config{ MinVersion: tls.VersionTLS13, CipherSuites: []uint16{ tls.TLS_AES_128_GCM_SHA256, // ... }, NextProtos: []string{\u0026#34;h2\u0026#34;}, } Despite that, the server still refused the connection. I suspect it was using JA4 or similar TLS fingerprinting techniques we couldn’t fully emulate. We had to move on, but I’d love to revisit that one someday.\nFinal Thoughts I didn’t solve everything. But that wasn’t the point. Every challenge was a practical puzzle, something to decode, reverse, bypass, or just understand a little better.\nWorking as a team with Evarist, Nathan, and Waut made it even more valuable. We bounced ideas off each other, divided tasks, and got a much broader set of challenges covered.\nThe Cyber Security Challenge Belgium qualifiers weren’t easy. But they were the best kind of difficult, the kind that teaches you something whether you solve the problem or not.\n","date":"March 15, 2025","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/professors/site/images/blog/post-2/binexpl_hu_3d36b409c72f3586.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"160\"\n onerror=\"this.onerror='null';\n this.src='\\/professors\\/site\\/images\\/blog\\/post-2\\/binexpl_hu_afca672637b6b98d.png';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/professors/site/blog/post-2/","title":"Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience"},{"categories":["cybersecurity","event","defense"],"contents":"Securing Cyberspace: Belgian Cyber Command at Howest On November 12, we had the opportunity to attend a Tech\u0026amp;Meet session unlike any other. The speaker was Colonel Gunther Godefridis, Director for Development \u0026amp; Readiness at Belgian Cyber Command, and the topic: safeguarding our country in the digital domain.\nHeld at Howest Campus Brugge Station, the event drew students, researchers, and professionals eager to understand how military-grade cybersecurity operations are run, and why they matter more than ever.\nDefending in the Digital Age Colonel Godefridis began by outlining the core mission of Belgian Cyber Command: protecting Defense’s networks and weapon systems, supporting intelligence operations (ADIV), and conducting defensive and offensive operations in cyberspace. In short, Cyber Command isn’t just watching traffic, it’s actively shaping Belgium’s digital resilience.\nWith society’s increasing reliance on digital infrastructure, the risks of espionage, disinformation, and attacks on critical systems are no longer theoretical. Godefridis highlighted the urgency of being able to respond to, not just detect, those threats.\nWorking Together: Academia, Industry, Government One theme that stood out was collaboration. Cyber Command doesn’t operate in a vacuum. It works closely with national agencies, NATO partners, academic institutions, and the private sector. The colonel emphasized that defending cyberspace requires broad cooperation, and Belgium’s approach is to engage across domains, military, civil, and industrial.\nHe also made it clear that this isn’t just about defense systems or classified data. As the line between civil and military digital infrastructure blurs, vulnerabilities in civilian systems can become national security issues. That’s where cooperation becomes essential.\nLeading with Innovation With over 20 years in military service, Colonel Godefridis brings a unique perspective. From artillery innovation to defense technology strategy, and now to cyber development, his background reflects the evolving nature of conflict and the military\u0026rsquo;s response.\nHe discussed how innovation, including artificial intelligence, is becoming central to cyber defense. Cyber Command is investing in tools and skills to automate threat detection, analyze large datasets, and simulate attack scenarios. It’s not just about building walls, it’s about staying several moves ahead.\nA Transparent, Human Conversation The Q\u0026amp;A session at the end made the evening especially memorable. Questions ranged from technical details of cyber defense capabilities to the human side of cyber careers: how people are trained, what skills are valued, and how students might contribute.\nColonel Godefridis was honest about the challenges. Cyber operations evolve quickly, and so do adversaries. But he was equally clear about the opportunity: Belgium is building a capability that matters, and it needs talent.\nFinal Thoughts If you walked into this talk expecting a dry presentation on military infrastructure, you were wrong. This session was a deep, realistic, and engaging look into how Belgium is preparing for cyber conflict, and how students like us could be a part of that mission.\nWhether you’re in cybersecurity, software development, or systems engineering, there’s a growing role to play. And as Colonel Godefridis made clear: it’s not just a job. It’s part of defending a society that’s more vulnerable, and more connected, than ever before.\nTip\nWant to learn more about Cyber Command? Visit the official website at mil.be\n","date":"November 12, 2024","image":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n\n\n\n\n\n \n\n \n \n \n \n \n\n\n \n \n\n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n\n\n \n \n\n\n \u003cimg\n \n src=\"/professors/site/images/blog/blog-3_hu_fdd9e13d0370b160.webp\" loading=\"lazy\"\n decoding=\"async\"\n \n\n alt=\"\"\n class=\" img\"\n width=\"650\"\n height=\"433\"\n onerror=\"this.onerror='null';\n this.src='\\/professors\\/site\\/images\\/blog\\/blog-3_hu_c932299ff2fa7067.jpg';\" /\u003e\n\n \n \n \n \n \n \n\n\n \n\n","permalink":"/professors/site/blog/post-3/","title":"Securing Cyberspace: Belgian Cyber Command at Howest"}]
\ No newline at end of file
diff --git a/public/index.xml b/public/index.xml
index 8ce49e0..c56169a 100644
--- a/public/index.xml
+++ b/public/index.xml
@@ -2,39 +2,53 @@
Home | Joren on Professors - Personal Portfolio Theme
- http://192.168.90.54:1313/
+ http://localhost:1313/professors/site/
Recent content in Home | Joren on Professors - Personal Portfolio ThemeHugoenThu, 29 May 2025 00:00:00 +0000
-
+ Building My Hugo Website on a VPS
- http://192.168.90.54:1313/project/project-2/
+ http://localhost:1313/professors/site/project/project-2/
Thu, 29 May 2025 00:00:00 +0000
- http://192.168.90.54:1313/project/project-2/
+ http://localhost:1313/professors/site/project/project-2/<p>I built my personal blog using <a href="https://gohugo.io/"
target="_blank"
>Hugo</a> and deployed it on a lightweight Alpine Linux VPS. I chose this setup to have full control, keep things simple, and avoid bloated platforms or services. Here’s how the process went from site generation to live deployment.</p>DRMDTool Project
- http://192.168.90.54:1313/project/project-1/
+ http://localhost:1313/professors/site/project/project-1/
Wed, 21 May 2025 00:00:00 +0000
- http://192.168.90.54:1313/project/project-1/
+ http://localhost:1313/professors/site/project/project-1/<p>DRMDTool is an automation-centric utility designed to streamline the processing of <code>.drmd</code> files by tightly integrating with the N_m3u8DL-RE downloader. The tool offers robust automation via a watch folder and an intuitive web-based interface, significantly reducing the friction for managing and processing DRM-protected streaming content.</p>
+
+ Red Team Talk: Een Blik Achter de Schermen bij Offensive Security
+ http://localhost:1313/professors/site/blog/post-4/
+ Tue, 20 May 2025 00:00:00 +0000
+ http://localhost:1313/professors/site/blog/post-4/
+ <h1 id="red-team-talk-een-blik-achter-de-schermen-bij-offensive-security">Red Team Talk: Een Blik Achter de Schermen bij Offensive Security</h1>
<p>In deze eerste aflevering van <strong>Red Team Talk</strong> nemen wij, Joren Schipman en Mattia Punjwani, studenten Cybersecurity aan Howest, jullie mee in een gesprek met <strong>Thomas Castronovo</strong>, ethical hacker en consultant bij Deloitte. Samen duiken we in de wereld van offensieve security, red teaming, en de realiteit van een carrière als pentester.</p>
+ Cyber Defence on the Digital Frontline: A Mission with NATO
- http://192.168.90.54:1313/blog/post-1/
+ http://localhost:1313/professors/site/blog/post-1/
Tue, 13 May 2025 00:00:00 +0000
- http://192.168.90.54:1313/blog/post-1/
+ http://localhost:1313/professors/site/blog/post-1/<h1 id="cyber-defence-on-the-digital-frontline-a-mission-with-nato">Cyber Defence on the Digital Frontline: A Mission with NATO</h1>
<h4 id="on-a-mission-with-nato-cyber-defence-on-the-frontline">On a Mission with NATO: Cyber Defence on the Frontline</h4>
<p>Howest’s ongoing commitment to world-class cybersecurity training took center stage again as six lecturers from the Cyber Security program joined forces with experts from Latvia, Luxembourg and Belgium in one of NATO’s most intensive simulations: the Locked Shields exercise, hosted by the Cooperative Cyber Defence Centre of Excellence (CCDCOE). Now in its fifth year of participation, the Howest team shared their firsthand experiences at a special evening talk at Howest Bruges.</p>Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience
- http://192.168.90.54:1313/blog/post-2/
+ http://localhost:1313/professors/site/blog/post-2/
Sat, 15 Mar 2025 00:00:00 +0000
- http://192.168.90.54:1313/blog/post-2/
+ http://localhost:1313/professors/site/blog/post-2/<h1 id="reversing-rebuilding-and-failing-better-my-cyber-security-challenge-belgium-qualifier-experience">Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience</h1>
<p>On March 14 and 15, I joined the Cyber Security Challenge Belgium qualifiers with three teammates. For two days, we threw ourselves at CTF challenges covering binary exploitation, Android reversing, cryptography, and more.</p>
+
+ Securing Cyberspace: Belgian Cyber Command at Howest
+ http://localhost:1313/professors/site/blog/post-3/
+ Tue, 12 Nov 2024 00:00:00 +0000
+ http://localhost:1313/professors/site/blog/post-3/
+ <h1 id="securing-cyberspace-belgian-cyber-command-at-howest">Securing Cyberspace: Belgian Cyber Command at Howest</h1>
<p>On November 12, we had the opportunity to attend a Tech&Meet session unlike any other. The speaker was <strong>Colonel Gunther Godefridis</strong>, Director for Development & Readiness at Belgian Cyber Command, and the topic: safeguarding our country in the digital domain.</p>
+
diff --git a/public/manifest.webmanifest b/public/manifest.webmanifest
index 755f8eb..900b9d3 100644
--- a/public/manifest.webmanifest
+++ b/public/manifest.webmanifest
@@ -4,7 +4,7 @@
"lang": "en",
"display": "fullscreen",
"orientation" : "portrait",
- "start_url": "http://192.168.90.54:1313/?utm_source=web_app_manifest",
+ "start_url": "http://localhost:1313/professors/site/?utm_source=web_app_manifest",
"background_color": "#0e1015",
"theme_color": "#18b0a2",
@@ -20,33 +20,33 @@
"icons": [
{
- "src": "/images/favicon_hu_6da0167f32a32123.png",
+ "src": "/professors/site/images/favicon_hu_6da0167f32a32123.png",
"sizes": "48x48",
"type": "image/png"
},
{
- "src": "/images/favicon_hu_d4d33babbe6805bc.png",
+ "src": "/professors/site/images/favicon_hu_d4d33babbe6805bc.png",
"sizes": "72x72",
"type": "image/png"
},
{
- "src": "/images/favicon_hu_78447c6bde7c0620.png",
+ "src": "/professors/site/images/favicon_hu_78447c6bde7c0620.png",
"sizes": "96x96",
"type": "image/png"
},
{
- "src": "/images/favicon_hu_50a8dfcefba7e8a8.png",
+ "src": "/professors/site/images/favicon_hu_50a8dfcefba7e8a8.png",
"sizes": "144x144",
"type": "image/png"
},
{
- "src": "/images/favicon_hu_302f3e1abb47ae13.png",
+ "src": "/professors/site/images/favicon_hu_302f3e1abb47ae13.png",
"sizes": "192x192",
"type": "image/png",
"purpose": "any maskable"
},
{
- "src": "/images/favicon_hu_997547777bc65c3.png",
+ "src": "/professors/site/images/favicon_hu_997547777bc65c3.png",
"sizes": "512x512",
"type": "image/png"
}
diff --git a/public/project/index.html b/public/project/index.html
index 5e72480..13b1eb9 100644
--- a/public/project/index.html
+++ b/public/project/index.html
@@ -1,7 +1,7 @@
-
+
Recent Projects
@@ -28,11 +28,11 @@
-
-
-
-
-
+
+
+
+
+
@@ -41,7 +41,7 @@
-
+
@@ -70,7 +70,7 @@
-
+
@@ -156,8 +156,8 @@
-
-
+
+
@@ -184,7 +184,7 @@
-
+
@@ -268,7 +268,7 @@
-
+
@@ -297,27 +297,27 @@
@@ -9462,7 +9462,7 @@
diff --git a/public/project/index.xml b/public/project/index.xml
index 6038fc0..88922ba 100644
--- a/public/project/index.xml
+++ b/public/project/index.xml
@@ -2,24 +2,24 @@
Recent Projects on Professors - Personal Portfolio Theme
- http://192.168.90.54:1313/project/
+ http://localhost:1313/professors/site/project/
Recent content in Recent Projects on Professors - Personal Portfolio ThemeHugoenThu, 29 May 2025 00:00:00 +0000
-
+ Building My Hugo Website on a VPS
- http://192.168.90.54:1313/project/project-2/
+ http://localhost:1313/professors/site/project/project-2/
Thu, 29 May 2025 00:00:00 +0000
- http://192.168.90.54:1313/project/project-2/
+ http://localhost:1313/professors/site/project/project-2/<p>I built my personal blog using <a href="https://gohugo.io/"
target="_blank"
>Hugo</a> and deployed it on a lightweight Alpine Linux VPS. I chose this setup to have full control, keep things simple, and avoid bloated platforms or services. Here’s how the process went from site generation to live deployment.</p>DRMDTool Project
- http://192.168.90.54:1313/project/project-1/
+ http://localhost:1313/professors/site/project/project-1/
Wed, 21 May 2025 00:00:00 +0000
- http://192.168.90.54:1313/project/project-1/
+ http://localhost:1313/professors/site/project/project-1/<p>DRMDTool is an automation-centric utility designed to streamline the processing of <code>.drmd</code> files by tightly integrating with the N_m3u8DL-RE downloader. The tool offers robust automation via a watch folder and an intuitive web-based interface, significantly reducing the friction for managing and processing DRM-protected streaming content.</p>
diff --git a/public/project/project-1/index.html b/public/project/project-1/index.html
index 1ab5eac..3e71199 100644
--- a/public/project/project-1/index.html
+++ b/public/project/project-1/index.html
@@ -1,7 +1,7 @@
-
+
DRMDTool Project
@@ -28,11 +28,11 @@
-
-
-
-
-
+
+
+
+
+
@@ -41,7 +41,7 @@
-
+
@@ -70,7 +70,7 @@
-
+
@@ -159,15 +159,15 @@
-
-
+
+
-
-
+
+
@@ -187,7 +187,7 @@
-
+
@@ -271,7 +271,7 @@
-
+
@@ -300,27 +300,27 @@
+ 
Cybersecurity
Cybersecurity
+ 
+ 
-
- 
+ 
+ 
+ alt="Reversing, Rebuilding, and Failing Better: My Cyber Security Challenge Belgium Qualifier Experience"
+ width="634"
+ height="156" />
+ 
+ 
+ onerror="this.onerror='null';this.src='\/professors\/site\/images\/hero-image.png';" />
@@ -537,7 +537,7 @@
+ width="848"
+ height="516" />
