A Linux box where the attack surface is the air between three VLANs. A password leaked over SNMP opens a consultant laptop stocked with Wi-Fi radios, and the route to root runs through the networks it can hear: crack the tablets’ WPA2-PSK, decrypt the capture to hijack a cookie-trusting router panel, pivot through a .phtml upload, then clone the corporate WPA2-Enterprise AP with its own stolen certificate to crack an EAP identity and reach root.
A Linux box modelling an industrial plant, where the privilege escalation is not a CVE but the plant’s own safety logic being fed a forged sensor reading. Unauthenticated Apache NiFi → operator SSH key in support-bundles → password-cracked PLC manual → anonymous OPC UA writes → CalibrationOffset ramped into the maintenance window → helix-maint-console → root.
A rootkit hides by lying to whoever asks, so asking /proc twice gets you the same lie twice. kdetect asks through channels a rootkit has to subvert separately and treats their disagreement as the finding. This is how it works, how I validated it against a real rootkit, and the false positives that nearly shipped.
Quick-reference commands for recon, enumeration, exploitation, and post-exploit work on Linux and Windows targets.
A web app that leaks another user’s traffic capture, and a Linux privilege feature left too permissive. IDOR → PCAP recovery of credentials → SSH user shell → Linux file capabilities (getcap) → root via python3.8 capability.