The word hacker never means what the press wants it to mean. The definition in the Jargon File and in RFC 1392, why cracker is a pathology semantically before it is legally, what a lamer is, and the three philosophies competing for the scene. With the rule that actually tells them apart.
Read the article →An operational vademecum for anyone working in security: the order in which you look at a system, the things you always check, the ethical rules that are not negotiable, and the story of the greatest hackers with an explanation of why they were.
Read the article →Why most security tools are written in Python, what makes it suited to offensive work, and the story of the language from 1991 to today. With the ethical boundary put where it belongs, and Python’s limits stated plainly.
Read the article →A compromised Linux server is not fixed by reinstalling: first you work out how they got in, then you look for the rest. A method for finding infected files with nothing but the shell, the signals you must not ignore, and why the order of operations matters more than the tools.
Read the article →What a SQL injection really is, why prepared statements eliminate it, and how to use OWASP ZAP and Burp Suite to look for it in a systematic way. With ethics and hacker identity: the difference between those who break things and those who help, written without jargon.
Read the article →The difference between free software and proprietary software is not the price, it is control. Why reading the code, being able to modify it and not depending on a vendor are worth more than any licence, and how all this came about from 1983 onwards.
Read the article →Eight hexadecimal digits that point nowhere: what 0xDEADBEEF really is, where it is used as a sentinel value, where it came from and why people still write it. With the difference between remembering it as an address and remembering it as a trap for the debugger.
Read the article →WordPress is the most widespread CMS in the world and the most fertile ground for anyone hunting for flaws. How vulnerabilities are actually hunted — from plugin recon to analysing patch diffs — and why the hard part is not finding them but understanding whether they are exploitable.
Read the article →