Latest Articles - Page 11

Learn what Keycloak is, how its login and SSO flow works, and how realms, clients, users, roles, LDAP federation, identity brokering, OIDC and SAML fit together.

Diagnose watchdog BUG soft lockup CPU stuck on Linux from the kernel journal and stack trace. Separate VM starvation, workload pressure, storage stalls, and real driver bugs before changing watchdog_thresh.

Reset a lost Keycloak admin password with bootstrap-admin user, repair the permanent administrator, and remove OTP lockout with bootstrap-admin service when the Admin Console is unreachable.

Create Keycloak’s first administrator in the master realm with KC_BOOTSTRAP_ADMIN_USERNAME, the Welcome Page, or bootstrap-admin before the first server start.

Enable Keycloak service accounts and request client_credentials tokens for machine-to-machine auth—assign roles, fix role intersection with client scopes, call orders-api with curl, and troubleshoot invalid_client on …

Learn what a Keycloak realm contains, how realm isolation differs from groups and Organizations, when to add another realm, and why the master realm is for administration—not application users.

Test archived L3MON on Kali with Genymotion: start the panel, patch and install a lab APK, verify client behavior, then analyze the APK with aapt, apktool, and JADX.

Create Thinkst Canarytokens on canarytokens.org, test a Web bug from Kali with curl, read the alert history, then choose document, AWS, Kubernetes, cloned-site, and MCP honeytokens for authorized detection.

Install Ghost Framework 8.0.0 on Kali, connect it to a Genymotion Android 10 guest over ADB, enumerate the device, and compare Ghost commands with direct adb shell in an authorized lab.

Test the old ADB Android lock screen bypass claims on rooted Genymotion, see why gesture.key fails on modern Android, and learn which recovery options still apply.

Install Zphisher on Kali Linux, run a Facebook-style login template on localhost, submit dummy form data with curl, and inspect auth capture files to see how the phishing workflow works.

Review FiercePhish as a legacy Laravel phishing framework: inspect the official installer, note Ubuntu-only limits on modern Linux, and map campaign concepts without live delivery.

Create harmless PDF payload examples with JavaScript, embedded attachments, and URLs, then analyze them on Kali with PDFiD, pdf-parser, ExifTool, and qpdf.

Create a forensic disk image with Exterro FTK Imager, choose E01 settings, record evidence metadata, verify MD5 and SHA1 hashes, mount the image read-only, and keep acquisition logs.

Test DVWA web login brute-force protection on Kali with a small password list, Hydra http-get-form, Burp Intruder, CSRF and rate-limit caveats, and false-positive checks.

Learn how Browser-in-the-Browser (BITB) phishing fakes an SSO login window inside a real page, how to spot painted address bars, and how passkeys and awareness limit the attack.

Build an authorized ThePhish lab on Kali with TheHive 4 and Cortex, submit a sanitized .eml sample, review observables and analyzer verdicts, and see where MISP fits.

Install Andriller CE 3.6.3 on Kali, create known Genymotion artifacts, run an ADB acquisition, and verify SMS, call logs, and SQLite data in the HTML report.

Install Apktool 3.0.3 on Kali, decode InsecureShop into resources and Smali, make a harmless label change, rebuild with apktool b, sign with apksigner, and install on Genymotion while explaining signature mismatch on …

Find InsecureShop cleartext SharedPreferences credentials on rooted Genymotion, then practice SQLite and file inspection with clearly labeled training data and scoped-storage caveats.

Enumerate InsecureShop deep-link intent filters, trigger custom schemes with adb, attack weak URL validation, and check App Links verification state.

Install Drozer 3.1.0 and the matching Agent on Kali and Genymotion, enumerate InsecureShop components, start an exported activity, and inspect a permission-gated content provider with careful result wording.

Find android:exported activities, services, and receivers in InsecureShop, prove reachability with adb and Drozer, and show why export alone is not a vulnerability.

Install Objection 1.12.5 on Kali, attach to InsecureShop through frida-server on rooted Genymotion, enumerate components and storage paths, and try built-in Android jobs for SSL pinning and root detection before writing …

Pin Frida 17.17.0 on Kali, install a matching frida-server on rooted Genymotion, enumerate InsecureShop, and hook Java methods to observe and modify runtime values over ADB.

Prove Burp CA trust first, identify Android certificate pinning, then bypass Network Security Config and OkHttp pins with Objection and targeted Frida scripts on an authorized training APK so HTTPS appears in Burp.

Route an Android emulator or device through Burp Suite on Kali, install the Burp CA for your Android version, verify HTTPS in a browser first, then diagnose proxy and trust issues before testing apps.

Install Genymotion Desktop Pro on the physical host, create a rooted Android 10 device, fix VirtualBox host-only networking, and connect from Kali with adb for MobSF dynamic analysis.

Plan a CompTIA PenTest+ lab as four groups instead of one giant build: start with a local VirtualBox lab, add GOAD-Light for Active Directory lessons, then cloud-native and hosted targets only when those topics appear. …

Run MobSF 4.5.2 in Docker on Kali, scan the InsecureShop APK, triage static findings against MASVS, and validate an exported activity on Genymotion with the Dynamic Analyzer.