A full TCP connect scan is slow, and it leaves a much bigger footprint than you’d want on a real engagement. This builds a raw SYN scanner with gopacket instead — the same half-open technique nmap uses under the hood, and why it’s faster.
Blog
OPSEC for Red Teamers and CTF Players: A Practical Field Guide
Almost every operator who gets caught broke the same handful of OPSEC rules — and good OPSEC doesn’t matter if you’re not authorized to be there in the first place. This is the field guide to the mistakes that actually get people caught, not a generic checklist.
theHarvester OSINT Tutorial: Passive Recon from the Command Line
theHarvester pulls emails, subdomains, and hosts from public sources without you ever touching the target directly — that’s what makes it passive recon. This covers the command-line workflow and where the ethical line actually sits.
Reverse Shell Cheat Sheet for Linux CTF — One-Liners and TTY Upgrade
A reverse shell one-liner gets you a shell — it doesn’t get you a usable one. The TTY upgrade after it is what turns that into something you can actually work in, and it’s the part most cheat sheets skip.
masscan vs nmap: When to Use Each (and How to Combine Them)
masscan finds hosts fast, nmap tells you what’s actually running on them — this covers using both together instead of treating it as an either/or choice.
Linux SUID Privilege Escalation Tutorial for CTF
SUID binaries are one of the most common privilege escalation paths on CTF boxes, and running a tool that finds them isn’t the same as understanding why they work. This walks through finding and exploiting them by hand first.