Kayssel
Offensive security, documented as I learn it
Series on Active Directory, web and API hacking, binary exploitation, Android and Web3. Written to be read in order, with labs you can reproduce, by Rubén Santos García
Latest posts
The most recent write-ups. Each one belongs to a series you can follow from the start.
Meta-Transactions: Gasless UX and New Attack Vectors
Deep dive into meta-transaction architecture, EIP-2771 trusted forwarders, relayer patterns, and the security implications of gasless transaction execution in Ethereum.
Transaction Signatures vs Message Signatures: Understanding the Difference
Deep dive into RLP encoding, EIP-191 versioning, and the security differences between on-chain transaction signatures and off-chain message signatures in Ethereum.
Understanding Ethereum Signatures - The Foundation of Web3 Security
Deep dive into Ethereum's cryptographic signature system, ECDSA, secp256k1, signature anatomy (r, s, v), and practical examples of signing, verifying, and securing Web3 authentication flows.
When Containers Lie: Escaping Root and Breaking Docker Isolation
We explore how root containers and host mounts enable privilege escalation, from SUID binaries in shared volumes to abusing /proc/<PID>/root. Then we show how Valeris detects these risky setups with YAML-based rules before they lead to full host compromise.
Docker Security: Dissecting Namespaces, cgroups, and the Art of Misconfiguration
Docker uses namespaces, cgroups & OverlayFS for isolation, but misconfigs (root, --privileged, sensitive mounts) weaken security. Valeris, a Rust CLI, audits running containers, flags risks, and provides a checklist to harden deployments.
Beyond the CLI: Hacking Smart Contracts with the Slither API
Discover the power of Slither's API for in-depth smart contract auditing. Learn how to build custom detectors, enhance output with Rich, and uncover hidden vulnerabilities beyond standard static analysis.
The Viking’s Question: What Are You Really Fighting For?
A purpose isn't something you wait for. it's something you build. Through discipline, reflection, and action, you can design a life worth living. In this article, we explore what it means to walk with purpose in a world full of noise and distraction.
Browse by series
Ten series, from Active Directory to Web3. Pick one and read it in order.
Building the Offensive Security Playground: A Step-by-Step Guide
Set up a personal hacking lab on Proxmox: virtual machines, networks and the targets you will use in the other series.
Exploring API Security: A Practical Guide to Uncovering Vulnerabilities
REST and GraphQL from the attacker's side: enumeration, broken auth, mass assignment and BOLA, with Burp Suite and Postman.
Forging Valeris: Building a Rust CLI to Secure Docker & Kubernetes
Build log of Valeris, a Rust CLI that scans Docker (and soon Kubernetes) for misconfigurations: design, code, plugin architecture and the checks themselves.
Initiating Linux Binary Exploitation: A Beginner's Expedition into Code Manipulation
Linux binary exploitation from the start: assembly, stack overflows, format strings, shellcode and the mitigations that get in the way.
Navigating the Active Directory Maze: Unveiling Hacking Strategies
Active Directory from enumeration to domain admin: Kerberos, NTLM, credential theft and lateral movement with PowerShell, Mimikatz and BloodHound.
No More Enemies: The Battle for Inner Freedom
Notes on focus, discipline and purpose. The only series here that is not about breaking computers.
Open Source Web Hacking Mastery: A Junior's Guide to Methodical Penetration Testing
Web application testing with open-source tools like Nuclei and mitmproxy, practised on OWASP Juice Shop.
Python Prowess: Ethical Hacking Explorations for Security Enthusiasts
Python for offensive work: web exploitation, cryptography and pentest tooling, one script at a time.
Securing Android: An In-Depth Exploration
Android app security through the Damn Vulnerable Bank app: finding, exploiting and fixing common and less common mobile flaws.
Web3 Exploitation Fundamentals: Navigating Security in Decentralized Systems
Smart contract exploitation with Foundry and Hardhat: reentrancy, front-running, signatures, proxies and the defenses that actually hold.