https://stevesec.net/Recent content on SteveSecHugoen-usFri, 06 Feb 2026 00:00:00 +0000https://stevesec.net/blog/osint-methodology-building-a-framework-that-works/Fri, 06 Feb 2026 00:00:00 +0000https://stevesec.net/blog/osint-methodology-building-a-framework-that-works/A practical breakdown of how to structure OSINT investigations, from defining objectives to organizing collected data into actionable intelligence.https://stevesec.net/blog/smtp-good-for-you-better-for-me/Wed, 05 Mar 2025 00:00:00 +0000https://stevesec.net/blog/smtp-good-for-you-better-for-me/SMTP is the backbone of email, and a goldmine for attackers. Open relays, spoofing, directory harvest attacks, and how to lock it all down.https://stevesec.net/blog/social-media-woes-what-an-attacker-can-find/Wed, 05 Mar 2025 00:00:00 +0000https://stevesec.net/blog/social-media-woes-what-an-attacker-can-find/What happens when employees overshare on social media? Badge photos, job announcements, and personal details become attack vectors. Here’s how attackers exploit it and how organizations can fight back.https://stevesec.net/blog/clickfix-defense/Wed, 01 Jan 2025 00:00:00 +0000https://stevesec.net/blog/clickfix-defense/Fake reCAPTCHA pages that trick users into pasting an mshta command into the Run dialog. How the ClickFix attack chain works, start to finish, and how to shut it down.https://stevesec.net/blog/getpdf/Wed, 01 Jan 2025 00:00:00 +0000https://stevesec.net/blog/getpdf/CyberDefender GetPDF Walkthrough.https://stevesec.net/blog/packetdetective/Wed, 01 Jan 2025 00:00:00 +0000https://stevesec.net/blog/packetdetective/CyberDefender PacketDetective Walkthrough.https://stevesec.net/blog/malicious-banking-apk/Wed, 01 Jan 2025 00:00:00 +0000https://stevesec.net/blog/malicious-banking-apk/Reverse-engineering a banking trojan disguised as an RBL credit-card app: unpacking two stages of AES-encrypted payloads, defeating string obfuscation, and tracing it back to an exposed Firebase full of stolen data.https://stevesec.net/blog/strutted/Wed, 01 Jan 2025 00:00:00 +0000https://stevesec.net/blog/strutted/Strutted Hack the Box Walkthrough.https://stevesec.net/blog/unrested/Wed, 01 Jan 2025 00:00:00 +0000https://stevesec.net/blog/unrested/Unrested Hack the Box Walkthrough.https://stevesec.net/blog/vscode-powershell-execution/Wed, 01 Jan 2025 00:00:00 +0000https://stevesec.net/blog/vscode-powershell-execution/Using VS Code’s Microsoft-signed, trusted PowerShell terminal to run scripts where powershell.exe is locked down by AppLocker, WDAC, or Constrained Language Mode, and how defenders can catch it.https://stevesec.net/blog/mdns-llmnr-netbios-pentesters-best-friend/Thu, 12 Dec 2024 00:00:00 +0000https://stevesec.net/blog/mdns-llmnr-netbios-pentesters-best-friend/How legacy name resolution protocols like mDNS, LLMNR, and NetBIOS-NS are exploited by penetration testers for credential harvesting, and how to remediate them.https://stevesec.net/blog/attack-surface-reduction-personal-guide/Thu, 12 Dec 2024 00:00:00 +0000https://stevesec.net/blog/attack-surface-reduction-personal-guide/A guide to reducing your personal digital attack surface through account management, strong passwords, and proactive security practices.https://stevesec.net/blog/google-zip-mov-tld/Thu, 12 Dec 2024 00:00:00 +0000https://stevesec.net/blog/google-zip-mov-tld/How Google’s introduction of .zip and .mov top-level domains creates new phishing and malware delivery attack vectors.https://stevesec.net/blog/how-learning-code-helps-penetration-testing/Thu, 12 Dec 2024 00:00:00 +0000https://stevesec.net/blog/how-learning-code-helps-penetration-testing/How learning to code enhances penetration testing through automation, tool comprehension, and safer execution in client environments.https://stevesec.net/blog/mobile-application-penetration-testing/Thu, 12 Dec 2024 00:00:00 +0000https://stevesec.net/blog/mobile-application-penetration-testing/Why mobile application penetration testing matters, how security professionals audit mobile apps, and best practices users can follow to protect their data.https://stevesec.net/blog/navigating-security-risks-in-ai-and-llms/Thu, 12 Dec 2024 00:00:00 +0000https://stevesec.net/blog/navigating-security-risks-in-ai-and-llms/An exploration of security risks in large language models, including prompt injection and insecure output handling, with guidance on staying secure.https://stevesec.net/blog/red-team/Thu, 12 Dec 2024 00:00:00 +0000https://stevesec.net/blog/red-team/Reference guide for red team tools, techniques, and procedures organized by MITRE ATT&CK phases.https://stevesec.net/blog/smart-contract-vulnerabilities/Thu, 12 Dec 2024 00:00:00 +0000https://stevesec.net/blog/smart-contract-vulnerabilities/A breakdown of the three most common smart contract vulnerabilities – reentrancy attacks, insecure arithmetic, and access control flaws – with real-world examples and prevention strategies.https://stevesec.net/blog/data-brokers-and-data-breaches/Thu, 12 Dec 2024 00:00:00 +0000https://stevesec.net/blog/data-brokers-and-data-breaches/An exploration of how data brokers contribute to data breaches by aggregating personal information that cybercriminals weaponize for social engineering and phishing attacks.https://stevesec.net/blog/unlocking-lsa-secrets/Thu, 12 Dec 2024 00:00:00 +0000https://stevesec.net/blog/unlocking-lsa-secrets/An overview of Windows LSA secrets, how attackers can extract stored credentials from the registry, and steps to protect against credential dumping.https://stevesec.net/blog/advanced-firebase-exploitation/Sat, 15 Jun 2024 00:00:00 +0000https://stevesec.net/blog/advanced-firebase-exploitation/Firebase’s flexibility introduces multiple attack surfaces. A deep dive into misconfigured rules, weak authentication flows, privilege escalation, and how to defend against them.https://stevesec.net/blog/why-grapheneos-is-the-best-android-rom/Fri, 03 May 2024 00:00:00 +0000https://stevesec.net/blog/why-grapheneos-is-the-best-android-rom/GrapheneOS takes Android’s open-source architecture and hardens it with advanced sandboxing, kernel security, and a de-Googled experience. Here’s why it’s the best ROM for privacy and security.https://stevesec.net/blog/cdn-phishing-walkthrough/Sat, 09 Dec 2023 00:00:00 +0000https://stevesec.net/blog/cdn-phishing-walkthrough/A walkthrough on setting up Azure CDN phishing infrastructure using EvilGoPhish for authorized red team engagements.https://stevesec.net/blog/security-safety-tips/Sat, 09 Dec 2023 00:00:00 +0000https://stevesec.net/blog/security-safety-tips/A practical guide covering data removal, password security, public area safety, and home security best practices.https://stevesec.net/blog/warhorse-configuration-file/Sat, 09 Dec 2023 00:00:00 +0000https://stevesec.net/blog/warhorse-configuration-file/An example Warhorse phishing configuration file for automating red team infrastructure deployment.https://stevesec.net/about/Mon, 01 Jan 0001 00:00:00 +0000https://stevesec.net/about/; stevesec.exe ; Entry point: 0x00401000 ; Compiled: Massachusetts ; Sections: .pentest .osint .re Steve Nelson is a security professional specializing in penetration testing, red team operations, and open-source intelligence. Former military: Vermont Army National Guard, Infantry. The discipline and mission-focused mindset from service translate directly into how he approaches security: methodical, thorough, relentless. What I Do Penetration testing. Red team operations. OSINT. Reverse engineering and malware analysis. I simulate real-world adversaries to identify weaknesses before actual threat actors do.