Systematic documentation of offensive and defensive security techniques across rooms spanning web exploitation, Active Directory, cloud environments, DFIR, and AI/LLM security.
Every room gets a writeup. The writeups follow a consistent format: attack chain, detection engineering, key concepts, lessons learned. The point isn't the flag — it's the judgment that comes from running the material against real labs and then writing down how it actually worked.
These are a curated public subset of a larger vault of 300+ documented rooms.
| Folder | Platform | Focus |
|---|---|---|
Hack The Box |
HackTheBox | Web exploitation, Active Directory, Sherlocks (DFIR), AI red team |
Let's Defend |
LetsDefend | Blue-team / SOC: malware analysis, cloud audit logs, social engineering |
TryHackMe |
TryHackMe | Offensive and defensive fundamentals through advanced rooms |
- Liberty (HTB Sherlock) — Windows DFIR. A
.urlfile in a network share captures Net-NTLMv2 credentials when the folder is opened. No click required. - Discord Forensics / Operation Dream Job (LetsDefend) — Social engineering reconstructed from Chrome cache. Lazarus Group TTPs.
- AI-Powered Ransomware (PromptLock) (LetsDefend) — A Go binary using a local LLM to generate dynamic encryption payloads at runtime. Signature-based detection is blind to it.
- AWS VPC Data Exfiltration (TryHackMe) — A private subnet is a routing concept, not a security boundary. Four IAM permissions turn it into a public attack surface.
- Google Cloud Compromise (LetsDefend) — Six log entries, 72 seconds, complete attack chain. The Data Access logging gap is the defensive finding.
Each writeup carries YAML frontmatter (platform, difficulty, tags, MITRE ATT&CK technique IDs) and is written in Markdown. They render best in Obsidian, but read fine anywhere.
Part of the portfolio at larrypeseckis.ai — security at the intersection of offense, defense, cloud, and AI.