unicorn All work

45 articles

Encyclopedia

A knowledge base I build up as I go — the theory behind the TryHackMe rooms I complete, told from the basics: networking, tools, Linux, Windows. It grows room by room.

Foundations

6

The CIA triad

The three goals all security rests on: confidentiality, integrity, availability.

Stages of a pentest

Scope, recon, scanning, exploitation, post-exploitation, reporting — the repeatable method.

Threat modeling & attack surface

Four questions asked before building or attacking, plus attack surface and trust boundaries.

Privilege escalation — the idea

Get in low, climb high: why the first foothold is never enough, and where the climb comes from.

OSINT basics

Building a picture of a target purely from public sources — the quiet first move.

Defensive security

The blue-team side — prevention vs detection & response, the five areas of defence, and the SOC loop.

Networking

7

OSI & TCP/IP models

Why network work is split into layers — the seven OSI layers, the four of TCP/IP, and encapsulation.

How DNS works

The internet's phone book: domain hierarchy, record types and the path of a single query.

How HTTP works

The language a browser speaks: requests, responses, methods, status codes, headers and cookies.

TCP, UDP and ports

Which program gets the packet, and reliable-vs-fast — the layer where port scanning lives.

IP addressing & subnetting

What an IP and a subnet mask mean, how to read CIDR, and what to tell nmap to scan.

Ports and services

The common ports worth memorizing and the first thought each one should trigger.

VPNs and tunneling

Encrypted tunnels: privacy, reaching private networks, WireGuard, and the security angle.

Web security

6

OWASP Top 10

The map of where web apps break most often — the shared vocabulary of web security.

SQL injection

Slipping SQL into input so the database runs your command — the classic injection.

Cross-site scripting (XSS)

Injecting your JavaScript so it runs in another user's browser — stored, reflected, DOM.

Authentication & sessions

Proving who you are and how the site remembers it — and the attacks on both.

File upload & inclusion

Uploading a web shell, and LFI/RFI tricking a page into loading the wrong file.

Command injection

When input reaches a system shell — appending your own command for code execution.

Tools & recon

10

Network recon utilities

Where every engagement starts: ping, traceroute, whois and dig — and passive vs active recon.

Directory brute-forcing

Finding unlinked pages by reading response codes — gobuster, ffuf and the pitfalls.

Nmap — port scanning

What's alive and what's listening: hosts, open ports, service versions.

Wireshark — traffic analysis

Capture the actual packets and read, layer by layer, exactly what's being said.

Burp Suite — the web workbench

A proxy between browser and site so you pause, read and change every HTTP request.

Netcat — the network multitool

A raw pipe over TCP/UDP: client, listener, file transfer, and shell-catcher.

Hydra — login brute-forcing

Automating password guessing against a live service — and how it's stopped.

Metasploit — the exploit framework

Thousands of exploits and payloads behind one interface — used deliberately.

Cracking hashes

Guessing passwords offline against stolen hashes — John, hashcat, salting.

Reverse & bind shells

Turning one command into an interactive shell — and why the target calls you back.

Linux

4

Linux command basics

The terminal vocabulary you keep coming back to: navigation, reading, search, operators.

Linux permissions

Reading rwx for owner/group/others, octal, and the SUID bit where privesc hides.

Linux privilege escalation

From low user to root: sudo, SUID, cron, writable files, forgotten credentials.

Bash scripting basics

Variables, arguments, if, for, while — turning repeated commands into a tool.

Windows

5

Windows internals

The most common target after Linux: NTFS, System32, accounts, UAC and the registry.

Windows privilege escalation

From normal user to Administrator/SYSTEM: services, tasks, stored creds, patches.

Active Directory basics

How companies run Windows at scale — and the biggest topic in real-world pentesting.

Windows authentication: NTLM & hashes

Why Windows stores hashes, and how pass-the-hash logs in without cracking them.

PowerShell for security

The object shell that admins and attackers both live in — enumerate like the admins do.

AI & LLMs

7

The four properties of AI

One mental model for almost any strange thing a generative model does — plus a symptom → property cheat sheet.

How generative AI works

What an LLM really is, and where its “character” comes from — pretraining, RLHF and Constitutional AI.

Next-token prediction

Where answers come from — tokens, one step at a time, temperature, and why fluent never means correct.

Knowledge & hallucinations

What a model actually knows, the training cut-off, and why it invents facts confidently — with the fixes.

Working memory & context

The context window, what falls off its edge, “lost in the middle”, and how to keep what matters in view.

Steerability

How far your instructions really steer the output — the strongest levers, and the limits that don’t bend.

When properties collide

In real tasks the four properties act together and errors stack — name the one that slipped, then fix it.

Back to the site