Modern WAF internals: architecture, evasion, and NyxR production data
An analysis of modern WAFs, from HTTP parsing to behavioral correlation, with NyxR architecture choices and one month of production metrics.
39 min read
Xsec
(he/him)Pentester and cybersecurity teacher
Passionate about IT for more than 12 years, I enjoy digging into advanced concepts and technologies, then sharing what I learn. I also help students learn systems, networks, defense and penetration testing.
Latest posts
Read now
EDR Internals: Telemetry Architecture and Evasion Boundaries
A source-based analysis of Windows EDR telemetry paths, their documented semantics, enforcement limits, and red-team validation methodology.
53 min read
Baby (VulnLab) - Complete Writeup
Complete writeup of the Baby machine on VulnLab. Anonymous LDAP bind exploitation, password spraying, SeBackupPrivilege and NTDS.dit extraction.
16 min read
Unfiltered OSCP+ Review
An honest, no-nonsense review of the OSCP+ certification. Course, exam, report, and practical tips.
7 min read
Living knowledge map
Knowledge Graph
Every article lives inside a connected world shaped by shared tags. Explore a domain, hover a star to reveal its neighbors, drag it or open the post.
- articles
- 41
- worlds
- 12
- connections
- 0
Cybersecurity4
- Automated secure static website deployment for the lazyAutomated secure static website deployment for the lazy
- Google Ads, a Real ThreatGoogle Ads, a Real Threat
- Cybersecurity and the Dunning-Kruger EffectCybersecurity and the Dunning-Kruger Effect
- Multifactor AuthenticationMultifactor Authentication
Evasion4
- EDR Internals: Telemetry Architecture and Evasion BoundariesEDR Internals: Telemetry Architecture and Evasion Boundaries
- EDR InternalsEDR Internals
- EDR NeutralizationEDR Neutralization
- Windows InternalsWindows Internals
Windows3
- Active Directory multi-sites, network shares and user rights managementActive Directory multi-sites, network shares and user rights management
- Apply quota on network shared directoriesApply quota on network shared directories
- Installing a Windows Server with AD DS Role (Domain Controller)Installing a Windows Server with AD DS Role (Domain Controller)
GNU/Linux8
- Introduction to Git & GithubIntroduction to Git & Github
- Managing Permissions in GNU/LinuxManaging Permissions in GNU/Linux
- Install an OpenSSL self-signed certificate with nginxInstall an OpenSSL self-signed certificate with nginx
- Installing Docker on DebianInstalling Docker on Debian
- Install Nginx + Webdav on debian 11Install Nginx + Webdav on debian 11
- Create an OpenVPN server on debianCreate an OpenVPN server on debian
- SSH connection with public keySSH connection with public key
- Create a DNS server on DebianCreate a DNS server on Debian
Networking6
- Alcatel Switch ConfigurationAlcatel Switch Configuration
- Remote AccessRemote Access
- The hierarchy of CLI ciscoThe hierarchy of CLI cisco
- Help, autocompletion, monitoring, shortcutsHelp, autocompletion, monitoring, shortcuts
- LAYER 2 Vlan, Spanning-tree, Trunk, EtherChannel, and Dot1Q EncapsulationLAYER 2 Vlan, Spanning-tree, Trunk, EtherChannel, and Dot1Q Encapsulation
- LAYER 3 Static Routing, RIPv2, OSPF, NATLAYER 3 Static Routing, RIPv2, OSPF, NAT
Certifications5
- Unfiltered OSCP+ ReviewUnfiltered OSCP+ Review
- Certified Evasion Techniques Professional reviewCertified Evasion Techniques Professional review
- Certified Azure Red Team Professional ReviewCertified Azure Red Team Professional Review
- Certified Red Team Expert ReviewCertified Red Team Expert Review
- Certified Red Team Professional reviewCertified Red Team Professional review
Defensive2
- Modern WAF internals: architecture, evasion, and NyxR production dataModern WAF internals: architecture, evasion, and NyxR production data
- Maximizing Windows Defender ProtectionMaximizing Windows Defender Protection
OPSEC3
- Email aliases, take back control of your mailsEmail aliases, take back control of your mails
- Reducing Your Attack Surface on DiscordReducing Your Attack Surface on Discord
- Useful Links for Privacy and SecurityUseful Links for Privacy and Security
CTF2
- Baby (VulnLab) - Complete WriteupBaby (VulnLab) - Complete Writeup
- GCTF 2025 - Case WriteupGCTF 2025 - Case Writeup
Finance2
- My vision of wealth management and investmentMy vision of wealth management and investment
- Your Banker Is a Salesperson, Not an AdvisorYour Banker Is a Salesperson, Not an Advisor