
+ Cheap Camera, Expensive Risk: Hacking an IoT PTZ Camera +
+What happens when you mix a €22.95 PTZ camera, physical access, and bad …
+diff --git a/assets/images/hero-image.png b/assets/images/hero-image.png
index 6129038..9b69d3e 100644
Binary files a/assets/images/hero-image.png and b/assets/images/hero-image.png differ
diff --git a/assets/images/hero-image.png_old b/assets/images/hero-image.png_old
new file mode 100644
index 0000000..6129038
Binary files /dev/null and b/assets/images/hero-image.png_old differ
diff --git a/content/_index.md b/content/_index.md
index a4602aa..02add76 100644
--- a/content/_index.md
+++ b/content/_index.md
@@ -19,6 +19,8 @@ banner:
content: "21 years"
- title: "Languages"
content: "Dutch, English, French"
+ - title: "Phone"
+ content: "+32 456 06 92 55"
- title: "Location"
content: "Mechelen"
@@ -136,6 +138,10 @@ contact:
icon: "fa-solid fa-envelope"
content: "[jorensc@riseup.net](mailto:jorensc@riseup.net)"
+ - name: "Phone"
+ icon: "fa-solid fa-phone"
+ content: "[+32 456 06 92 55](tel:+32456069255)"
+
- name: "Location"
icon: "fa-solid fa-location-dot"
content: "Mechelen"
diff --git a/hugo_stats.json b/hugo_stats.json
index 4eaf22e..320befc 100644
--- a/hugo_stats.json
+++ b/hugo_stats.json
@@ -127,6 +127,7 @@
"fa-network-wired",
"fa-paper-plane",
"fa-person-chalkboard",
+ "fa-phone",
"fa-screwdriver-wrench",
"fa-shield-halved",
"fa-solid",
diff --git a/public/.htaccess b/public/.htaccess
new file mode 100644
index 0000000..ad01b82
--- /dev/null
+++ b/public/.htaccess
@@ -0,0 +1,88 @@
+##### Optimize default expiration time - BEGIN
+
What happens when you mix a €22.95 PTZ camera, physical access, and bad …
+Kerberos is a cornerstone of enterprise authentication in Windows domains. But …
+An in-depth exploration of the Matrix protocol, how it decentralizes messaging, …
+A closer look at the Seiko SARV001, a Japanese Domestic Market gem that offers …
+How name resolution protocols and IPv6 misconfigurations enable credential …
+Your smart lightbulb doesn't need to talk to your NAS. Here's how and why to …
+In deze aflevering van Red Team Talk spreken studenten Joren Schipman en Mattia …
+An inside look into Howest’s participation in NATO’s world-leading cyber defence …
+I tackled buffer overflows, reversed Android apps, cracked crypto puzzles, and …
+Colonel Gunther Godefridis of Belgian Cyber Command shares insights on cyber …
+Howest’s ongoing commitment to world-class cybersecurity training took center stage again as six lecturers from the Cyber Security program joined forces with experts from Latvia, Luxembourg and Belgium in one of NATO’s most intensive simulations: the Locked Shields exercise, hosted by the Cooperative Cyber Defence Centre of Excellence (CCDCOE). Now in its fifth year of participation, the Howest team shared their firsthand experiences at a special evening talk at Howest Bruges.
+Locked Shields is no ordinary simulation. It is a full-scale, live-fire cyber defence exercise involving more than 6,000 machines and a narrative scenario so detailed it includes geopolitics, disinformation and even fictional countries. This year, the Blue Team 03 (our team) defended a simulated nation’s critical infrastructure including power plants, satellites, 5G networks and banking systems, all while under constant attack from a coordinated Red Team using automated scripts and over 28,000 attacks across two days.
+And yes, every team (Red, Blue, Yellow, White) uses Ansible. For everything.
+What do you do when a rogue process might be malware, or maybe just a poorly named service? What happens when your teammate refuses to act unless something is “officially malicious”? The team faced cultural clashes, communication breakdowns and stress-testing of both systems and people.
+The exercise required more than technical fixes. It demanded communication with simulated commanders, media and public stakeholders. Reporting became just as important as patching. It taught participants how to translate technical impact into real-world consequences. Not “port 8443 unreachable”, but “our air defence system is degraded, and we cannot fly planes”.
+A new but powerful presence in the simulation was the Black Team, a rapid-response unit deployed when problems became too complex for any single team. Acting like special forces, they jumped in when incidents crossed team boundaries or demanded unconventional solutions. Their mission was to find out what was happening, assess the impact and suggest fast, creative responses. Introduced just last year, this team quickly proved its value again in 2025. They even embraced the role with style “you can wear sunglasses inside” became their unofficial motto.
+Their presence underlined a critical lesson: not every problem fits neatly within a team’s silo. Real-world defence requires flexibility, speed and lateral thinking.
+There were plenty of mishaps. Misfired scripts, team mix-ups, and one case where a DNS setup from a previous year was reused by mistake. Someone tried renaming cut
to shutdown
, breaking essential operations until it was fixed. Systems rebooted into chaos, a manual was uploaded to public GitHub, and the team had to quickly learn the difference between symbolic links and real binaries.
From detecting malware with Velociraptor and Q9, to encountering teammates who took orders literally, the learning was intense. One participant noted that while Belgian and Luxembourg teams prioritized knowledge sharing, others preferred strict protocol. This highlighted cultural differences and the importance of interpersonal skills.
+The biggest lesson? You are never fully prepared. Every iteration of Locked Shields is different. But each one sharpens not only your skills, but also your ability to function as a team under extreme conditions.
+This experience directly impacts the classroom. Inspired by the exercise, Howest is introducing new hands-on courses. Students will be dropped into realistic broken networks, with misconfigurations, fake firewalls and simulated threats. It is chaos, but controlled. And that is the point.
+As one speaker said: “You don’t win Locked Shields. You just survive it better than the rest.”
+The exercise teaches more than just cybersecurity. It builds trust. It proves that knowing your teammates can be as important as knowing the tools. Whether that comes from a shared flight or a pre-exercise barbecue, it all matters when the pressure hits.
+Want to see how cyber defence works in real life? This is it.
+ +Smart homes are convenient. But with convenience comes risk. If your doorbell runs Linux, talks to Chinese cloud servers, and sits on the same network as your work laptop, you’ve got a problem. The fix? Segmentation. This post explores how to use VLANs and firewall rules to quarantine IoT devices and minimize lateral movement, even on a home budget.
+Most people treat their home network like a trust zone. All devices are equal. But they’re not. You wouldn’t let your robot vacuum log into your online banking, yet they live on the same flat LAN. That’s the fundamental issue.
+IoT vendors prioritize cost and features, not security. Devices often ship with:
+A compromise is inevitable. The only question is: does that compromise stay local, or pivot deeper into your network?
+A VLAN (Virtual Local Area Network) logically segments traffic on the same physical infrastructure. Think of it as creating isolated “subnet bubbles” where traffic can be controlled and filtered.
+VLANs let you:
+And you don’t need enterprise gear to do this. Many consumer-grade routers and access points already support VLANs, especially if you install OpenWRT, OPNSense, or just Linux. Even some ISP-provided devices have basic VLAN tagging features tucked away in their advanced menus. You might not need new hardware at all, just better firmware.
+Let’s say you have a smart home with:
+Step 1: Define VLANs
+VLAN ID | +Purpose | +Example Devices | +
---|---|---|
10 | +LAN (trusted) | +Laptop, NAS | +
20 | +IoT | +Smart TV, plugs, doorbell | +
30 | +Guest WiFi | +Friends’ phones | +
Step 2: Assign Interfaces
+Most routers allow you to map VLANs to interfaces or SSIDs. Use one SSID per VLAN for WiFi. Wire VLAN-tagged ports for wired devices.
+Step 3: Firewall Rules
+On VLAN 20 (IoT):
+Optional: Use static DHCP leases and force DNS through Pi-hole for logging and filtering.
+Case 1: Smart TV
+Blocked LAN access. Within 5 minutes of boot, it tried to contact:
+Video streaming still worked fine. Everything else was noise.
+Case 2: IP Camera
+On the LAN, it had access to the NAS and router UI. After VLAN isolation, its access was limited to outbound 443 and NTP. Still worked. Couldn’t snoop.
+Still, the benefits far outweigh the complexity.
+If you’ve ever installed a smart plug and noticed it phones home every few minutes, you’re not alone. And if you haven’t noticed, maybe you should.
+Security in small networks doesn’t need to be complex. VLANs are one of the most powerful tools you can deploy for minimal cost. Set it up once. Sleep better forever.
+Your lightbulb shouldn’t have access to your tax documents.
+ + + + + + + +Tip
+Looking for OpenWRT-compatible routers? Check the OpenWRT Table of Hardware for supported devices.
On March 14 and 15, I joined the Cyber Security Challenge Belgium qualifiers with three teammates. For two days, we threw ourselves at CTF challenges covering binary exploitation, Android reversing, cryptography, and more.
+What follows is a recap of the challenges I personally worked on, some I solved, some I didn’t, but all of them left me with new skills and new ideas.
+One of the first challenges I picked involved a binary with a basic stack overflow. I used standard techniques, finding the offset, hijacking the return address, and injecting shellcode. Tools like pwntools
helped automate the payload crafting. It was a great warm-up and a confidence boost once it worked.
Then there was a more elaborate cryptography challenge: 18 zip files, each password-protected. We cracked the first three passwords using John the Ripper and got numeric values from them. I searched the sequence in OEIS and found it matched A007408, which gave us the full pattern of passwords.
+Using this, I could extract all zip contents automatically, reconstruct the password-protected message, and finally reveal the flag.
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +One challenge involved “guessing” a thousand random numbers between 1 and 10. The banner claimed it required infinite luck, but of course, the randomness was seeded. After inspecting the generator, I realized it was deterministic. By precomputing seeds and output sequences, I could match the challenge’s banner to a specific seed and regenerate the entire solution.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Several APKs were part of the qualifier set. I used JADX to decompile them and FRIDA to patch logic at runtime. In one challenge, I bypassed license validation by forcing key methods to return true and unlocking hidden functionality.
+This one stood out.
+The app used a 4×8 button grid. Pressing buttons loaded a sequence of blockXX
files from assets. These were concatenated in-memory and passed into InMemoryDexClassLoader
to load a class called be.dauntless.flag.Flag
.
Class loadClass = new InMemoryDexClassLoader(ByteBuffer.wrap(byteArrayOutputStream.toByteArray()), getClassLoader())
+ .loadClass("be.dauntless.flag.Flag");
+
Each block
was a fragment of a DEX file, but the app didn’t tell you the right order. I tried manually inspecting the fragments, identifying methods, string constants, and offsets, to infer how to reassemble the full file. I got close, but didn’t crack it in time.
That challenge stuck with me because it combined static analysis, runtime introspection, and logic reconstruction. It wasn’t just technical, it was creative.
+Another challenge involved a Go-based TLS server that rejected all client connections unless they matched a specific fingerprint. I used Go’s tls.Config
to replicate the version, cipher suites, and ALPN:
tls.Config{
+ MinVersion: tls.VersionTLS13,
+ CipherSuites: []uint16{
+ tls.TLS_AES_128_GCM_SHA256,
+ // ...
+ },
+ NextProtos: []string{"h2"},
+}
+
Despite that, the server still refused the connection. I suspect it was using JA4 or similar TLS fingerprinting techniques we couldn’t fully emulate. We had to move on, but I’d love to revisit that one someday.
+I didn’t solve everything. But that wasn’t the point. Every challenge was a practical puzzle, something to decode, reverse, bypass, or just understand a little better.
+Working as a team with Evarist, Nathan, and Waut made it even more valuable. We bounced ideas off each other, divided tasks, and got a much broader set of challenges covered.
+The Cyber Security Challenge Belgium qualifiers weren’t easy. But they were the best kind of difficult, the kind that teaches you something whether you solve the problem or not.
+ +On November 12, we had the opportunity to attend a Tech&Meet session unlike any other. The speaker was Colonel Gunther Godefridis, Director for Development & Readiness at Belgian Cyber Command, and the topic: safeguarding our country in the digital domain.
+Held at Howest Campus Brugge Station, the event drew students, researchers, and professionals eager to understand how military-grade cybersecurity operations are run, and why they matter more than ever.
+Colonel Godefridis began by outlining the core mission of Belgian Cyber Command: protecting Defense’s networks and weapon systems, supporting intelligence operations (ADIV), and conducting defensive and offensive operations in cyberspace. In short, Cyber Command isn’t just watching traffic, it’s actively shaping Belgium’s digital resilience.
+With society’s increasing reliance on digital infrastructure, the risks of espionage, disinformation, and attacks on critical systems are no longer theoretical. Godefridis highlighted the urgency of being able to respond to, not just detect, those threats.
+One theme that stood out was collaboration. Cyber Command doesn’t operate in a vacuum. It works closely with national agencies, NATO partners, academic institutions, and the private sector. The colonel emphasized that defending cyberspace requires broad cooperation, and Belgium’s approach is to engage across domains, military, civil, and industrial.
+He also made it clear that this isn’t just about defense systems or classified data. As the line between civil and military digital infrastructure blurs, vulnerabilities in civilian systems can become national security issues. That’s where cooperation becomes essential.
+With over 20 years in military service, Colonel Godefridis brings a unique perspective. From artillery innovation to defense technology strategy, and now to cyber development, his background reflects the evolving nature of conflict and the military’s response.
+He discussed how innovation, including artificial intelligence, is becoming central to cyber defense. Cyber Command is investing in tools and skills to automate threat detection, analyze large datasets, and simulate attack scenarios. It’s not just about building walls, it’s about staying several moves ahead.
+The Q&A session at the end made the evening especially memorable. Questions ranged from technical details of cyber defense capabilities to the human side of cyber careers: how people are trained, what skills are valued, and how students might contribute.
+Colonel Godefridis was honest about the challenges. Cyber operations evolve quickly, and so do adversaries. But he was equally clear about the opportunity: Belgium is building a capability that matters, and it needs talent.
+If you walked into this talk expecting a dry presentation on military infrastructure, you were wrong. This session was a deep, realistic, and engaging look into how Belgium is preparing for cyber conflict, and how students like us could be a part of that mission.
+Whether you’re in cybersecurity, software development, or systems engineering, there’s a growing role to play. And as Colonel Godefridis made clear: it’s not just a job. It’s part of defending a society that’s more vulnerable, and more connected, than ever before.
+ + + + + + + +Tip
+Want to learn more about Cyber Command? Visit the official website at mil.be
In Red Team Talk nemen wij, Joren Schipman en Mattia Punjwani, studenten Cybersecurity aan Howest, jullie mee in een gesprek met Thomas Castronovo, ethical hacker en consultant bij Deloitte. Samen duiken we in de wereld van offensieve security, red teaming, en de realiteit van een carrière als pentester.
+Thomas deelt hoe zijn interesse in cybersecurity begon tijdens zijn opleiding, met hands-on projecten zoals het hacken van virtuele machines. Een stage bij Deloitte in 2019 zette hem op het pad naar een voltijdse functie binnen het Offensive Security Team. Vandaag werkt hij al drie jaar bij Deloitte België en specialiseert hij zich in offensieve testen.
+Hoewel zijn hart bij offensieve security ligt, kreeg hij recent ook ervaring aan de defensieve kant. Het leverde hem een breder perspectief op: “Het geeft een heel ander zicht op hoe aanvallen eruitzien vanuit de andere kant.” Toch blijft het red team werk zijn voorkeur behouden.
+Thomas legt uit hoe een typische pentest verloopt: van het ontvangen van de scope, over het scannen van het netwerk en het zoeken naar kwetsbaarheden, tot het rapporteren van bevindingen. Tools zoals Nessus, BloodHound en PingCastle worden ingezet, vaak gecombineerd met zelfgebouwde scripts die de output analyseren en structureren.
+Een groot deel van zijn werk focust op Active Directory (AD), waar hij telkens weer dezelfde pijnpunten tegenkomt: legacy-instellingen, onvoldoende gepatchte systemen, en misconfiguraties die vaak pas worden rechtgezet na een echte aanval. Twee voorbeelden die hij aanhaalt:
+Voor wie zelf wil beginnen raadt hij aan om zelf een AD op te zetten en tools als PingCastle en BloodHound uit te proberen. De meeste kennis verwerf je volgens Thomas door zelf te oefenen, dingen stuk te maken, en vooral: blijven proberen.
+Hoewel certificaten nuttig zijn (zoals WPT voor webapp testing), benadrukt Thomas dat de echte leerschool het werkveld is. “90% van wat ik weet, heb ik geleerd door het gewoon te doen,” zegt hij. Oefenen op Hack The Box, zelf een netwerk opzetten, en leren van collega’s zijn voor hem essentieel.
+De aflevering toont hoe breed het vakgebied offensive security is: van interne pentests tot phishingcampagnes, van legacy exploits tot zero-days. Maar vooral: het is een vak waar creativiteit en nieuwsgierigheid centraal staan.
+ + +In many internal networks, outdated or misconfigured protocols silently create attack surfaces. This post explores how attackers abuse name resolution fallbacks and IPv6 autoconfiguration to capture and relay NTLM credentials using Responder
and mitm6
.
When Windows can’t resolve a hostname via DNS, it falls back on legacy protocols: LLMNR (Link-Local Multicast Name Resolution), NBT-NS (NetBIOS Name Service), and increasingly mDNS in mixed environments. These protocols ask anyone nearby: “Do you know who somehost
is?”
An attacker on the local network can answer “yes” and claim to be that host. That’s exactly what Responder does. It listens for these requests and pretends to be the missing server, prompting clients to authenticate, typically using NTLM.
+Even in IPv4-only networks, most Windows clients have IPv6 enabled. If there’s no DHCPv6 server, they use router advertisements to configure themselves. mitm6
abuses this by spoofing a rogue IPv6 router, setting itself as the DNS server for all hosts.
Once clients start resolving names through the attacker’s DNS, the attacker can spoof responses and trick clients into connecting over SMB, LDAPS, or HTTP, exposing NTLM hashes.
+Responder
captures credentials (NTLMv1/v2), which can be cracked offline with tools like hashcat
. But it’s often more powerful to relay them live to a legitimate service.
Tools like ntlmrelayx
allow relaying to:
secretsdump.py
The success of the relay depends on the target’s configuration. If SMB signing or LDAP channel binding is enforced, the relay will fail. But in many networks, it isn’t.
+--smb2support --target smb://10.0.0.5
).fileshare
), the attacker responds.ntlmrelayx
relays these to the actual target server.In parallel, Responder
can be used for LLMNR/NBT-NS-based interception in IPv4 networks.
This isn’t new, but it’s often neglected. To prevent these attacks:
+If you’re in a flat network with legacy protocols enabled, an attacker doesn’t need exploits, just presence. These are silent, no-packet attacks that rely on trust and misconfiguration. The tools are public. The fixes are known. Yet the exposure is still widespread.
+Responder and mitm6 aren’t magic. They just reveal what’s already broken.
+ +If you’ve ever switched between Slack, WhatsApp, Discord, Teams, Signal and Telegram in a single day, you’ve felt the cost of digital fragmentation. We live in a world where communication is siloed into centralized apps, each with its own rules, limits and vulnerabilities. Matrix proposes an alternative: a universal, open, decentralized protocol for real-time communication, where users control their data and messaging isn’t trapped in walled gardens.
+In this post, we explore what Matrix is, how it works, where it’s being used, how you can adopt it yourself, and why it matters for the future of cybersecurity, collaboration, and digital sovereignty.
+Matrix is an open standard for interoperable, real-time communication over IP, designed to provide a decentralized alternative to proprietary messaging platforms. Just like email or the web, Matrix is federated, anyone can host a homeserver, and users on different homeservers can still talk to each other.
+Matrix isn’t an app. It’s a protocol. There are many clients (like Element) and server implementations (like Synapse) built on top of it. Communication is handled via JSON over HTTPS, using persistent rooms and event-based message history, with eventual consistency across the federation.
+Matrix supports:
+The power of Matrix lies in federation. Just like you don’t need a Gmail account to email someone using Outlook, you don’t need to be on the same Matrix server to chat. This model distributes control across the network, eliminating single points of failure and censorship risk.
+Bridges extend this idea further by connecting Matrix rooms to non-Matrix platforms. Want to keep your team on Matrix but still message a colleague on Slack? You can. Matrix becomes a universal glue layer for all communication.
+Supported bridge targets include:
+Matrix takes security seriously. Its end-to-end encryption (E2EE) is based on the Olm and Megolm ratchets, inspired by the Double Ratchet used by Signal. In private rooms, encryption is enabled by default.
+Encryption features include:
+In contrast to Signal, Matrix’s E2EE is multi-device aware by design. You can log in from your phone, laptop, and tablet, and still maintain encryption with all peers.
+Matrix is not just experimental, it’s deployed at scale:
+In red team/blue team simulations, robust and flexible comms are critical. Matrix excels in:
+In exercises like Locked Shields, where real-time coordination under pressure is key, Matrix could function as a fault-tolerant, cross-team coordination layer, especially when bridged to legacy systems.
+Matrix is self-hostable. This gives full control over identity, data, and federation policies. The most popular server implementation is Synapse, but others like Dendrite (Go, lightweight) and Conduit (Rust, performance-focused) are gaining traction.
+Minimum Setup:
+Pro Tips:
+Matrix is powerful, but not perfect:
+Work is ongoing on Matrix 2.0, which includes faster sync (Sliding Sync), a new media repo spec, and better thread handling.
+Matrix is what the future of communication could, and should, look like: open, secure, decentralized, and user-controlled. As central platforms tighten their grip on data and limit interoperability, Matrix flips the script. It’s not just a protocol. It’s a philosophy of sovereignty, transparency, and trustless interoperability.
+Whether you’re building a secure system, training the next generation of cyber professionals, or just tired of fragmented messaging, Matrix offers a future where you own your conversations.
+ + + + + + + +Tip
+Visit matrix.org to learn more, or get started today at element.io.
Kerberos, introduced to Windows with Active Directory in 2000, is widely seen as a secure, modern replacement for NTLM. And yet, in the hands of an attacker, it becomes a double-edged sword. This post explores how Kerberos works, and how it can be abused through techniques like Kerberoasting, delegation abuse, and ticket impersonation.
+Authentication starts when a user logs in and the Key Distribution Center (KDC), a service on the domain controller, issues a TGT (Ticket Granting Ticket) encrypted with the user’s secret. This lets the user request service tickets to access other services without sending credentials again.
+From a security model perspective, this is elegant. Credentials never cross the wire. Everything is based on secret keys and symmetric encryption. But this also assumes every piece in the chain, from domain users to service accounts, is configured securely.
+Spoiler: they rarely are.
+If a service account uses a weak password, it’s game over.
+Service tickets are encrypted with the service account’s password hash. Any domain user can request a ticket to any SPN (Service Principal Name), even without legitimate access. The attacker just needs to capture the ticket and brute-force it offline.
+Request SPN ticket → Extract ticket → Crack with hashcat
+
Kerberoasting doesn’t require elevated rights. Just domain access. And if that SPN maps to a privileged account (e.g. Domain Admin used for SQL service), cracking that password opens the domain.
+Default AD configs don’t restrict this. Detection? Hard. Ticket requests look normal. Mitigation? Use strong, random passwords for service accounts. Monitor ticket requests for unusual patterns.
+Kerberos supports delegation, allowing services to act on behalf of users. Useful for SSO scenarios like web apps accessing databases, but dangerous if abused.
+Unconstrained Delegation lets a service impersonate any user who authenticates to it. If an attacker compromises such a host, they can extract users’ TGTs and use them elsewhere, effectively becoming them. Golden ticket territory.
+Constrained Delegation tries to limit this to specific services. But it’s often misconfigured. And worse, Resource-Based Constrained Delegation (RBCD) lets target systems define who can delegate to them, opening up attack chains where a low-priv user adds a rogue computer object and escalates.
+These trust edges form a privilege escalation graph. BloodHound maps this beautifully.
+Once an attacker gets the KRBTGT account’s hash (e.g. via DCSync), they can create Golden Tickets, valid TGTs for any user, any group, any time. Total domain compromise.
+More subtle is Silver Ticketing. Here, the attacker forges only the service ticket, not the TGT. Requires the service account’s hash, not KRBTGT. Harder to detect. Ideal for lateral movement.
+Tools like Rubeus
automate this: asktgt
, s4u
, tgtdeleg
, kerberoast
, golden
, and silver
.
Rubeus.exe kerberoast /format:hashcat /user:svc_sql /domain:corp.local
+
→ Dumps service tickets in hashcat format.
+hashcat -m 13100 hashes.txt rockyou.txt
+
→ Cracks the SPN ticket. If the password is weak, you’re in.
+This is achievable from any domain user account. No alerts triggered, unless you’ve configured ticket monitoring.
+Kerberos isn’t broken. But it’s trust-heavy. And Windows environments are often too trusting.
+Strong service account hygiene, strict delegation configs, and monitoring ticket activity are the bare minimum. Defensive tools like klist
, event ID 4769
, and Kerberoast detection rules
help, but only if actively used.
In red team ops, Kerberos attacks are quiet, credential-free, and highly effective. They don’t break the protocol. They exploit how admins use it.
+Want to defend the kingdom? Start by defending the keys.
+ +When you pay €22.95 for a pan-tilt-zoom security camera, you’re not buying enterprise-grade security. But what if you’re also buying root access through an SD card?
+This post documents a hands-on assessment of the LSC SMART PTZ Camera (Model IPC167), a low-cost, Tuya-based IoT device sold at Action. While it ticks many boxes on paper, TLS, OTA updates, encrypted storage, physical access opens a completely different chapter.
+Under normal operation, the camera exposes a single LAN control port and requires authentication. But the real surprise lies in how it reacts to external media.
+Insert a specially crafted SD card containing certain files, and the device silently enables Telnet and FTP services at boot, with root access using credentials from the card. No prompt. No warning. The system trusts the card implicitly.
+This is intended for factory debugging, but it still exists in the retail device, and there are no warnings in the user manual. Once active, Telnet gives full shell access with UID 0. All processes run as root. It’s not just insecure, it’s reckless.
+A quick teardown revealed a UART interface on the PCB. While login is currently disabled, its presence adds another attack vector. UART could enable firmware dumping, memory access, or even re-enabling local shells in earlier firmware revisions.
+Combined with the SD card behavior, it paints a clear picture: if you can touch the device, you own it.
+Plenty. With root access via SD card:
+All of this without triggering any alarms, logs, or user notifications.
+Yes. TLS over MQTT for telemetry. Encrypted UDP for video. Encrypted SQLite storage. From a remote attacker’s perspective, it looks secure.
+But physical access breaks the whole model. And physical attacks are not just theoretical, especially for devices placed outdoors or in public environments.
+Fixing this requires more than software updates. It’s about rethinking assumptions.
+Until then, buyers are getting more than they bargained for.
+This was a cheap camera. It delivered on video quality and mobile app UX. But under the surface, it’s a wide-open platform for attackers with a screwdriver and a microSD card.
+If you’re building IoT gear: assume physical access and plan for it. +If you’re buying IoT gear: assume nothing until you’ve torn it apart.
+Security is more than encryption and TLS. It’s what happens when someone walks up, pops the back cover, and flips the whole threat model on its head.
+In the world of horology, the Japanese Domestic Market (JDM) often hides treasures that fly under the radar. One such gem is the Seiko SARV001, a watch that combines classic design, reliable mechanics, and exceptional value.
+The SARV001 boasts a 42mm stainless steel case with a thickness of 11.6mm, offering a balanced presence on the wrist. Its white sunburst dial exudes a subtle elegance, complemented by applied indices and luminous dauphine hands for enhanced legibility. The watch features a day-date complication at 3 o’clock, with the unique option to display the day in either English or Japanese Kanji, adding a distinctive JDM touch.
+The case is protected by Seiko’s proprietary Hardlex crystal, known for its durability and resistance to shattering. A see-through case back reveals the inner workings of the movement, providing a glimpse into the watch’s mechanical heart.
+At its core, the SARV001 is powered by Seiko’s in-house 4R36 automatic movement, featuring 24 jewels and a 41-hour power reserve. This movement supports both hacking and hand-winding, offering versatility for daily wear. With a water resistance of 100 meters, the watch is well-suited for everyday activities, though it’s not designed for diving.
+The watch’s 22mm lug width and drilled lugs make strap changes straightforward, allowing for customization to suit various occasions. Whether paired with its original stainless steel bracelet or a leather strap, the SARV001 transitions seamlessly from casual to formal settings.
+Priced under 150 EUR, the SARV001 offers features typically found in higher-end models. Its combination of classic aesthetics, reliable mechanics, and thoughtful details like the Kanji day display make it a standout choice for both novice and seasoned collectors seeking a quality timepiece without breaking the bank.
+The Seiko SARV001 exemplifies the brand’s commitment to craftsmanship and value. Its understated design, robust movement, and unique JDM characteristics make it a compelling option for those looking to add a versatile and reliable watch to their collection.
+Category
+ +A lightweight Alpine Linux system running DNS filtering, WireGuard VPN, and IRC …
+Category
+ +An in-depth exploration of the Matrix protocol, how it decentralizes messaging, …
+Category
+ +I tackled buffer overflows, reversed Android apps, cracked crypto puzzles, and …
+Category
+ +Kerberos is a cornerstone of enterprise authentication in Windows domains. But …
+An in-depth exploration of the Matrix protocol, how it decentralizes messaging, …
+How name resolution protocols and IPv6 misconfigurations enable credential …
+Your smart lightbulb doesn't need to talk to your NAS. Here's how and why to …
+In deze aflevering van Red Team Talk spreken studenten Joren Schipman en Mattia …
+An inside look into Howest’s participation in NATO’s world-leading cyber defence …
+I tackled buffer overflows, reversed Android apps, cracked crypto puzzles, and …
+Colonel Gunther Godefridis of Belgian Cyber Command shares insights on cyber …
+Category
+ +An in-depth exploration of the Matrix protocol, how it decentralizes messaging, …
+Category
+ +Colonel Gunther Godefridis of Belgian Cyber Command shares insights on cyber …
+Category
+ +A lightweight Alpine Linux system running DNS filtering, WireGuard VPN, and IRC …
+Category
+ +I tackled buffer overflows, reversed Android apps, cracked crypto puzzles, and …
+Category
+ +An inside look into Howest’s participation in NATO’s world-leading cyber defence …
+Colonel Gunther Godefridis of Belgian Cyber Command shares insights on cyber …
+Category
+ +What happens when you mix a €22.95 PTZ camera, physical access, and bad …
+Category
+ +In deze aflevering van Red Team Talk spreken studenten Joren Schipman en Mattia …
+Category
+ +What happens when you mix a €22.95 PTZ camera, physical access, and bad …
+Your smart lightbulb doesn't need to talk to your NAS. Here's how and why to …
+Category
+ +A closer look at the Seiko SARV001, a Japanese Domestic Market gem that offers …
+Category
+ +How name resolution protocols and IPv6 misconfigurations enable credential …
+Category
+ +A lightweight Alpine Linux system running DNS filtering, WireGuard VPN, and IRC …
+Your smart lightbulb doesn't need to talk to your NAS. Here's how and why to …
+Category
+ +Kerberos is a cornerstone of enterprise authentication in Windows domains. But …
+How name resolution protocols and IPv6 misconfigurations enable credential …
+Category
+ +In deze aflevering van Red Team Talk spreken studenten Joren Schipman en Mattia …
+Category
+ +What happens when you mix a €22.95 PTZ camera, physical access, and bad …
+Category
+ +A closer look at the Seiko SARV001, a Japanese Domestic Market gem that offers …
+Category
+ +A lightweight Alpine Linux system running DNS filtering, WireGuard VPN, and IRC …
+Category
+ +A lightweight Alpine Linux system running DNS filtering, WireGuard VPN, and IRC …
+Category
+ +A closer look at the Seiko SARV001, a Japanese Domestic Market gem that offers …
+Category
+ +Kerberos is a cornerstone of enterprise authentication in Windows domains. But …
++ Initeam, Izegem +
+ + + + Feb 2025 – May 2025 + + + + ++ CAPAC/HVW, Brussels +
+ + + + Jun 2022 – Aug 2022 + + + + ++ CAPAC/HVW, Brussels +
+ + + + 2021 – 2022 + + + + +A lightweight Alpine Linux system running DNS filtering, WireGuard VPN, and IRC on minimal hardware using a …
+How I built and deployed my personal blog using Hugo and hosted it on a minimal Alpine Linux VPS.
+DRMDTool is a complete solution for handling `.drmd` files with automated decryption and downloading via N …
+Your smart lightbulb doesn't need to talk to your NAS. Here's how and why to …
+How name resolution protocols and IPv6 misconfigurations enable credential …
+A closer look at the Seiko SARV001, a Japanese Domestic Market gem that offers …
+An in-depth exploration of the Matrix protocol, how it decentralizes messaging, …
+Kerberos is a cornerstone of enterprise authentication in Windows domains. But …
+What happens when you mix a €22.95 PTZ camera, physical access, and bad …
+In deze aflevering van Red Team Talk spreken studenten Joren Schipman en Mattia …
+An inside look into Howest’s participation in NATO’s world-leading cyber defence …
+I tackled buffer overflows, reversed Android apps, cracked crypto puzzles, and …
+Colonel Gunther Godefridis of Belgian Cyber Command shares insights on cyber …
+Feel free to reach out, I’m always open to new opportunities and collaborations.
++ Mail +
+ ++ Phone +
++ Location +
++ LinkedIn +
+ +A lightweight Alpine Linux system running DNS filtering, WireGuard VPN, and IRC on minimal hardware using a …
+ + Discover +How I built and deployed my personal blog using Hugo and hosted it on a minimal Alpine Linux VPS.
+ + Discover +DRMDTool is a complete solution for handling `.drmd` files with automated decryption and downloading via N …
+ + Discover +DRMDTool is an automation-centric utility designed to streamline the processing of .drmd
files by tightly integrating with the N_m3u8DL-RE downloader. The tool offers robust automation via a watch folder and an intuitive web-based interface, significantly reducing the friction for managing and processing DRM-protected streaming content.
DRMDTool has evolved into a comprehensive platform for batch downloading with enhanced support for user interaction and background processing. It features granular job tracking, dynamic download control (pause, resume, abort), and a refined WebSocket-based console for real-time command output. Subtitle handling now includes automatic downloading and conversion from VTT to SRT, and the downloader adapts based on metadata, organizing content into categorized directories.
+The primary aim is to automate .drmd
file processing with minimal manual input. Users can configure download formats, specify directories, and enable real-time command broadcasting. DRMDTool is suitable for both interactive use through a web UI and headless automation in pipelines, supporting inotify or polling-based folder watching.
.drmd
Files WorkA .drmd
file is a structured JSON document that defines one or more encrypted media items to be processed by DRMDTool. It contains an Items
array, with each item representing a specific media job. DRMDTool parses these entries to generate download commands for N_m3u8DL-RE.
Each item includes:
+abcd1234ef567890:00112233445566778899aabbccddeeff
). These are required for decrypting encrypted media streams and are passed directly to N_m3u8DL-RE using --key
flags..vtt
format. DRMDTool downloads and converts these to .srt
, then muxes them into the final file.Title;Type;Season
(e.g., Example Show;serie;1
) used to determine directory structure (Movies/Title
or Series/Title/Season
)..drmd
Structure{
+ "Items": [
+ {
+ "MPD": "aHR0cHM6Ly9leGFtcGxlLmNvbS9zdHJlYW0ubXBk",
+ "Keys": "abcd1234ef567890:00112233445566778899aabbccddeeff",
+ "Filename": "ExampleShow.S01E01",
+ "Subtitles": "https://example.com/sub1.vtt,https://example.com/sub2.vtt",
+ "Metadata": "Example Show;serie;1",
+ "Description": "Pilot episode",
+ "Poster": ""
+ }
+ ]
+}
+
.drmd
uploads through the web UI.KID:key
pairs, output paths, and subtitles, DRMDTool builds a command line for N_m3u8DL-RE.These files serve as portable job definitions. When DRMDTool detects or receives a .drmd
file, it parses the items, decodes or downloads the MPD, applies the keys, and builds a download command using N_m3u8DL-RE. Files are saved in organized directories like Movies/Title
or Series/Title/Season
, and subtitles are embedded if available. Pausing, resuming, and aborting downloads is supported per file.
The configuration is handled via config.toml
, with environment variable overrides for containerized or dynamic deployments. Once started, the tool can either monitor a specified folder or allow file uploads through the UI. Each .drmd
file is parsed, grouped by series and season (if applicable), and processed sequentially with support for job pausing and resuming.
To use:
+./drmdtool
+
Visit http://localhost:8080
for the web interface, which supports drag-and-drop uploads, selection of episodes or movies, and real-time progress tracking. For headless operation:
./drmdtool -f /path/to/file.drmd
+
Jobs can be paused, resumed, or aborted through the web interface, which reflects the backend state via live updates.
+DRMDTool dynamically builds download commands using metadata from .drmd
files and user preferences. It ensures that only the highest quality streams are kept, removing ad periods and duplicate segments from the MPD files. Subtitles are fetched and embedded automatically. Jobs are tracked with robust state management and logs for debugging and visibility.
Code and setup instructions are hosted here: +https://git.directme.in/Joren/DRMDTool
+For advanced usage details, customization, and API structure, refer to the README.md
in the repository.
I built my personal blog using Hugo and deployed it on a lightweight Alpine Linux VPS. I chose this setup to have full control, keep things simple, and avoid bloated platforms or services. Here’s how the process went from site generation to live deployment.
+On my development machine, I created a new Hugo site:
+hugo new site howest-blog
+
I used the professors-hugo
theme and copied its exampleSite
content into my project. I customized the layout, structure, and styling by editing content files, SCSS in assets/scss/custom.scss
, and partial templates in the theme directory.
All content lives under content/
, with separate folders for blog/
and project/
, each containing .md
files with front matter and Markdown content.
I edited the config/_default/hugo.toml
to configure site parameters like the base URL, theme, language, and menus. SCSS and image assets go in assets/
, and are processed by Hugo’s pipeline. Static files like favicons are placed in static/
.
To preview the site locally:
+hugo server
+
To build the static site:
+hugo
+
This generates everything in the public/
folder.
I rented a minimal Alpine Linux VPS and installed only what I needed. After setting up SSH and a basic nginx web server, I copied the public/
folder over using scp
:
scp -r public/* user@my-vps:/var/www/html
+
On the VPS, I installed nginx:
+apk add nginx
+
And configured /etc/nginx/conf.d/default.conf
to serve files from /var/www/html
. Then I enabled and started nginx:
rc-service nginx start
+rc-update add nginx
+
Now my Hugo site is live and served directly as static files, no backend, no database, just HTML, CSS, and JS.
+Alpine Linux is minimal and fast, perfect for serving static sites with low resource usage. Combined with Hugo’s speed and flexibility, I get a complete, performant setup that I fully control. It’s secure, lightweight, and easy to update, just rebuild and re-upload the public/
folder.
This setup is perfect if you want full control and minimal overhead for a personal blog or portfolio.
+ +Running a full-featured network stack on old hardware isn’t just possible, it’s efficient. This post covers how I configured Alpine Linux as a diskless system hosting DNS resolution, ad blocking, VPN access, and a local IRC server.
+The system boots entirely from RAM using Alpine’s diskless
mode. This eliminates wear on flash storage, improves startup speed, and ensures a clean slate on each reboot. Changes are persisted manually using lbu
, making the setup both robust and disposable, perfect for low-power hardware with limited write endurance.
The machine is an old D-Class thin client with 4 GB RAM and an AMD G-T48E CPU. Alpine Linux 3.21 is installed with only essential packages (229 total). Services are configured via OpenRC
and restored from compressed overlays on boot.
Blocky handles all local DNS queries, with DoT upstreams, custom mappings, and deny lists per client.
+Highlights:
+directme.in
Example config:
+blocking:
+ denylists:
+ ads:
+ - https://big.oisd.nl/domainswild
+ vtm:
+ - /home/joren/dns/vtmgo.txt
+ clientGroupsBlock:
+ default:
+ - ads
+ 192.168.178.123:
+ - vtm
+
WireGuard provides encrypted access to the local network, and PiVPN makes managing it trivial. While WireGuard itself is minimal, PiVPN adds essential automation without requiring a full control panel or web UI.
+Key benefits in this setup:
+Client management is simple and scriptable. Adding, disabling, or revoking peers takes seconds:
+pivpn -a # add client
+pivpn -r # remove client
+pivpn -off <name> # temporarily disable
+
Mobile-friendly. Each config can be exported as a QR code with pivpn -qr
, which is perfect for importing into the WireGuard mobile app.
Monitoring support. View live connections with pivpn -c
, or audit all issued keys with pivpn -l
.
Backups included. One command backs up all configs: pivpn -bk
.
Example output:
+::: Connected Clients List :::
+Name Remote IP Virtual IP Bytes Received Bytes Sent Last Seen
+Phone 84.199.x.x:60042 10.60.150.2 439MiB 3.3GiB May 29 2025 - 22:39:56
+
In this context, PiVPN reduces the friction of managing WireGuard while remaining fully compatible with Alpine’s diskless, CLI-centric philosophy. No services are wasted, and all changes remain under user control.
+For real-time messaging, I run a public-facing ngIRCd instance accessible over both plaintext (port 6667) and encrypted TLS (ports 6697, 6698). Despite its modest footprint, ngIRCd is stable, portable, and well-suited for both LAN and internet-facing deployments.
+The server is configured to:
+#General
channelHere’s a snapshot of the active configuration:
+[Global]
+Name = irc.alpine4071
+Info = RAM-only IRC Server
+Listen = 0.0.0.0
+Ports = 6667
+MotdPhrase = "Welcome to our RAM-only IRC server!"
+AdminInfo1 = IRC Server
+AdminInfo2 = Anywhere On Earth
+AdminEMail = admin@irc.alpine4071
+
+[SSL]
+CertFile = /home/joren/certs/fullchain1.pem
+KeyFile = /home/joren/certs/privkey1.pem
+Ports = 6697, 6698
+
Authentication and moderation are handled via the [Operator]
block, and all users are dropped into a predefined channel:
[Channel]
+Name = #General
+Topic = General Channel
+Autojoin = yes
+
Why ngIRCd?
+This makes ngIRCd a perfect fit for remote support, small private networks, or just having your own IRC node to tinker with, without touching a gigabyte of storage.
+You can connect today via:
+irc://alpine-4071.duckdns.org:6667 (plaintext)
+ircs://alpine-4071.duckdns.org:6697 (TLS)
+
To persist changes in a stateless system, I use Alpine’s lbu
:
lbu include /etc/blocky/config.yml
+lbu include /etc/ngircd/ngircd.conf
+lbu commit -d
+
This updates the overlay that Alpine loads at each boot. All runtime data stays in RAM.
+All services are enabled through OpenRC:
+rc-update add blocky default
+rc-update add wg-quick default
+rc-update add ngircd default
+rc-update add iptables default
+
Boot time is under 10 seconds, with full network stack active by the time DHCP finishes.
+Alpine’s diskless approach is perfect for resilient, low-maintenance edge systems. Combined with fast tools like Blocky and WireGuard, even minimal hardware becomes a capable, efficient network node, quietly resolving DNS, filtering traffic, handling VPN access, and hosting IRC.
+ +