a series for defenders learning to think like attackers.
eight posts. every one pairs an attacker technique with what it actually generates — or doesn’t — on the SOC side. written after sitting the CEH Practical exam: 6 hours, 20 challenges, one closed room in Bangalore.
the eight posts#
| # | post | what it covers |
|---|---|---|
| 0 | SOC eyes, attacker hands: why a defender signs up for CEH | why a defender signs up for an offensive certification, and the two-sided format every post after it follows. |
| 1 | recon looks different from both sides of the wire | nmap, OSINT, and Google dorking — and how little of any of it reaches a SIEM. |
| 2 | scanning: the noise before the storm | banner grabbing, SMB enumeration, and web scanning, plus the Windows Event IDs and IDS signatures they trip before the real attack starts. |
| 3 | hashcat, hydra, and the art of credential attacks | online brute-forcing fills your logs with failed logins. offline hash cracking leaves nothing at all. |
| 4 | what exploitation actually looks like | EternalBlue through Metasploit lights up Sysmon. a hand-uploaded web shell hides inside the web server process. |
| 5 | web attacks: SQLi, XSS, and why they still work | SQL injection, XSS, and a login form that hid its own answer in an HTML comment. |
| 6 | hiding in plain sight — stego and crypto | data hidden inside images, weak passphrases cracked, and why almost none of it gets caught in transit. |
| 7 | 6 hours, 20 challenges, one Security analyst | an honest debrief: what was hard, where a defender’s background helped, and the marks lost to overthinking. |
how to read it#
in order, if you’re preparing for CEH Practical — each post leans on the tooling from the one before it.
out of order, if you’re a defender who wants one technique’s footprint. find the row that matches the alert you’re staring at, and start there.