swafox

Notes on offensive security, exploit development, and Linux — hand-typed, slowly accumulated, occasionally useful.

These are old field notes from CTFs, bug-bounty work, and after-hours tinkering. Some of it is dated. All of it earned its place by being something I needed to look up more than once.

Linux

Tools I use daily and the occasional sysadmin detour.

• Vim — the editor I keep coming back to.
• Microsoft Office on Linux — running the things you can't avoid.
• An unlimited secure VPN for $5/month — a quick build, your VPS, your traffic.

Exploit development

Stack overflows, shellcoding, and the toolchain around them.

• Buffer overflows — the classic 7-step recipe, end to end.
• Pwntools — the Python toolkit you'll reach for every time.

Ethical hacking & bug bounty

Web vulnerabilities, real-world CVEs, and methodology that scales.

• Bug bounty methodology — how to actually get paid.
• XSS — reflected, stored, DOM, and the payloads that hit.
• XXE — XML external entity attacks, demystified.
• CVE-2020-5902 — F5 BIG-IP RCE walkthrough.
• Google XSS — a small bounty story.
• Server-side request forgery — SSRF basics and bypasses.
• OWASP ZAP — the free intercepting proxy, used well.
• Identifying IP via email — light-touch OSINT.

Write-ups

Box-by-box solutions from TryHackMe and HackTheBox.

• TryHackMe — OWASP Top 10 Event
• TryHackMe — Anthem
• TryHackMe — Blog
• TryHackMe — Poster
• TryHackMe — Tomghost
• HTB — Traceback: user flag walkthrough

Reference

• Resources — a long list of training material, tools, and reading I keep returning to.