unicorn All work

61 articles

Encyclopedia

A knowledge base I build up as I go — the theory behind the TryHackMe rooms I complete, told from the basics: networking, tools, Linux, Windows. It grows room by room.

Foundations

8

The CIA triad

The three goals all security rests on: confidentiality, integrity, availability.

Stages of a pentest

Scope, recon, scanning, exploitation, post-exploitation, reporting — the repeatable method.

Threat modeling & attack surface

Four questions asked before building or attacking, plus attack surface and trust boundaries.

Privilege escalation — the idea

Get in low, climb high: why the first foothold is never enough, and where the climb comes from.

OSINT basics

Building a picture of a target purely from public sources — the quiet first move.

Defensive security

The blue-team side — prevention vs detection & response, the five areas of defence, and the SOC loop.

Log analysis

Finding the few lines that matter in thousands — where an attack's trail lives, and how a SIEM scales it.

Infrastructure as Code

Managing servers and networks as code in files — declarative, idempotent, reviewable in git — and its security.

Networking

7

OSI & TCP/IP models

Why network work is split into layers — the seven OSI layers, the four of TCP/IP, and encapsulation.

How DNS works

The internet's phone book: domain hierarchy, record types and the path of a single query.

How HTTP works

The language a browser speaks: requests, responses, methods, status codes, headers and cookies.

TCP, UDP and ports

Which program gets the packet, and reliable-vs-fast — the layer where port scanning lives.

IP addressing & subnetting

What an IP and a subnet mask mean, how to read CIDR, and what to tell nmap to scan.

Ports and services

The common ports worth memorizing and the first thought each one should trigger.

VPNs and tunneling

Encrypted tunnels: privacy, reaching private networks, WireGuard, and the security angle.

Web security

6

OWASP Top 10

The map of where web apps break most often — the shared vocabulary of web security.

SQL injection

Slipping SQL into input so the database runs your command — the classic injection.

Cross-site scripting (XSS)

Injecting your JavaScript so it runs in another user's browser — stored, reflected, DOM.

Authentication & sessions

Proving who you are and how the site remembers it — and the attacks on both.

File upload & inclusion

Uploading a web shell, and LFI/RFI tricking a page into loading the wrong file.

Command injection

When input reaches a system shell — appending your own command for code execution.

Tools & recon

10

Network recon utilities

Where every engagement starts: ping, traceroute, whois and dig — and passive vs active recon.

Directory brute-forcing

Finding unlinked pages by reading response codes — gobuster, ffuf and the pitfalls.

Nmap — port scanning

What's alive and what's listening: hosts, open ports, service versions.

Wireshark — traffic analysis

Capture the actual packets and read, layer by layer, exactly what's being said.

Burp Suite — the web workbench

A proxy between browser and site so you pause, read and change every HTTP request.

Netcat — the network multitool

A raw pipe over TCP/UDP: client, listener, file transfer, and shell-catcher.

Hydra — login brute-forcing

Automating password guessing against a live service — and how it's stopped.

Metasploit — the exploit framework

Thousands of exploits and payloads behind one interface — used deliberately.

Cracking hashes

Guessing passwords offline against stolen hashes — John, hashcat, salting.

Reverse & bind shells

Turning one command into an interactive shell — and why the target calls you back.

Linux

4

Linux command basics

The terminal vocabulary you keep coming back to: navigation, reading, search, operators.

Linux permissions

Reading rwx for owner/group/others, octal, and the SUID bit where privesc hides.

Linux privilege escalation

From low user to root: sudo, SUID, cron, writable files, forgotten credentials.

Bash scripting basics

Variables, arguments, if, for, while — turning repeated commands into a tool.

Windows

5

Windows internals

The most common target after Linux: NTFS, System32, accounts, UAC and the registry.

Windows privilege escalation

From normal user to Administrator/SYSTEM: services, tasks, stored creds, patches.

Active Directory basics

How companies run Windows at scale — and the biggest topic in real-world pentesting.

Windows authentication: NTLM & hashes

Why Windows stores hashes, and how pass-the-hash logs in without cracking them.

PowerShell for security

The object shell that admins and attackers both live in — enumerate like the admins do.

AI & LLMs

21

The four properties of AI

One mental model for almost any strange thing a generative model does — plus a symptom → property cheat sheet.

How generative AI works

What an LLM really is, and where its “character” comes from — pretraining, RLHF and Constitutional AI.

Next-token prediction

Where answers come from — tokens, one step at a time, temperature, and why fluent never means correct.

Knowledge & hallucinations

What a model actually knows, the training cut-off, and why it invents facts confidently — with the fixes.

Working memory & context

The context window, what falls off its edge, “lost in the middle”, and how to keep what matters in view.

Steerability

How far your instructions really steer the output — the strongest levers, and the limits that don’t bend.

When properties collide

In real tasks the four properties act together and errors stack — name the one that slipped, then fix it.

Three ways to work with Claude

Chat, Cowork, Code — one model, three shapes of work, and how to pick the right one.

Prompting & AI Fluency

The prompt is the main lever, and the four Ds that turn luck into a predictable result.

Claude Code — the terminal agent

An agent that reads the codebase, runs commands and edits files — plus three supervision modes.

The agent loop & tools

Act → observe → decide → repeat; tools give the agent hands, thinking gives it time.

Projects & artifacts

A project gives standing context (input); an artifact is a finished object (output).

Claude skills

Package a recurring process once so Claude does it your way every time.

Claude Cowork

Hand over a multi-step task on your real files — a working session, not a chat.

Explore → Plan → Code → Commit

Claude Code's rhythm: catch mistakes at the plan, where they're cheapest to fix.

MCP — Model Context Protocol

One standard 'socket': connect a server once, any MCP client can use it — like USB.

Claude API basics

A structured request in, a structured response out — and picking a model by evals.

Managed agents

Let Anthropic run the loop in a sandbox and read an event stream — less code, less control.

Connectors, Search & Research

Three ways to reach the real world — your apps, company knowledge, deep multi-source research.

Claude Code setup

CLAUDE.md, subagents, skills, MCP and hooks — shape the terminal agent to your work.

Agent context management

A long agent bloats the window and the bill — summarise, prune, offload, /compact.

Back to the site