$ whoami → @holyghost
HolyGhost is an independent cybersecurity blog. Clear breakdowns of known vulnerabilities and attacks, plus practical lessons for people learning security the right way.
A 2026 wave of BitLocker bypasses all abuse the same weak spot, the Windows Recovery Environment. Here is how the trust boundary breaks, why the fixes keep failing, and what actually protects your data.
Attackers did not break into thousands of networks one by one. They compromised a single software vendor's build process and let the trusted updates carry the backdoor in. A breakdown of the SolarWinds supply chain attack.
Server side request forgery turns a harmless looking URL input into a way to read a cloud instance's own credentials. Here is how the metadata endpoint becomes the prize, and why IMDSv2 changed the game.
Threat modelling is the habit of asking what could go wrong before it does. A beginner friendly guide to the four questions and a simple framework for spotting weaknesses early.
A single string written into a log file could run attacker code on millions of servers. Here is how Log4Shell (CVE-2021-44228) worked, why it spread so far, and what it taught the industry about dependencies.
Any authenticated user in an Active Directory domain can ask for tickets that are effectively offline password hashes for service accounts. Here is how Kerberoasting works, why it is so reliable, and how to shut it down.
A plain English primer on threat models: what BitLocker, FileVault, and LUKS defend against, what they quietly do not, and why 'encrypted' is not a yes or no answer.
Modern processors guess ahead to go faster. Spectre and Meltdown showed that guessing leaves traces an attacker can read. A plain explainer of speculative execution side channels.
In Windows networks an attacker often does not need your password, just its hash. Here is how pass the hash works, why it powers lateral movement, and how to break the chain.
The difference between an event, an alert, an incident, and a breach, plus the incident response lifecycle every team follows. A calm, beginner friendly explainer.
How a flaw in an ageing file sharing protocol, weaponised by a leaked intelligence exploit, spread ransomware across the world in hours. A breakdown of EternalBlue and MS17-010.
A missing length check in OpenSSL let anyone read chunks of a server's memory, including private keys and passwords. Here is how Heartbleed (CVE-2014-0160) worked and why it was so serious.
VPNs are sold as magic privacy shields. A clear headed beginner guide to what a VPN actually does, the legitimate uses, and the things it cannot do that the ads imply.
For years, Bash would run code smuggled into the end of an environment variable. Shellshock (CVE-2014-6271) turned that into remote code execution across a huge slice of the internet.
By adding ../ to a file path, an attacker can climb out of the intended directory and read files the application never meant to expose. Here is how path traversal works and how to block it.
CSRF tricks a logged in user's browser into sending a real, authenticated request they never intended. Here is how it abuses the way browsers handle cookies, and how to shut it down.
Most breaches exploit vulnerabilities that were already fixed. A beginner friendly guide to what patching is, why it matters so much, and how teams keep on top of it.
If an application builds a system command out of user input, an attacker can smuggle in their own commands. Here is how OS command injection works and how to design it out.
XSS lets an attacker run JavaScript in another user's browser session, in the context of a site they trust. Here are the three types, what they enable, and how to stop them.
A firewall decides which network traffic is allowed and which is blocked. A beginner friendly guide to how firewalls work, the main types, and what they can and cannot protect.
SQL injection turns a login box or search field into a way to read, change, or destroy a database. Here is how it works, the flavours it takes, and the one fix that actually stops it.
Virus, worm, trojan, ransomware, spyware, rootkit. A beginner friendly guide to what malware is, the main families and how they differ, and the habits that keep it out.
Most breaches start with a message, not a hack. A beginner friendly guide to phishing and social engineering: the common types, the warning signs, and how to not take the bait.
Passwords get stolen constantly. Multifactor authentication is the cheap, powerful layer that keeps an attacker out even when they have your password. Here is how it works and which types to trust.
The one tool that fixes the biggest everyday security problem: reused and weak passwords. A beginner friendly guide to what a password manager is, how it works, and why to trust one.
A plain English walk through of what happens when you load an https site: the TLS handshake, how certificates prove identity, and why the padlock does not mean a site is safe.
Why storing passwords is harder than it looks, what a salt actually does, and why a fast hash like SHA-256 is the wrong tool for the job. A plain English primer for people learning security.
Every website visit starts with a lookup you never see. A beginner friendly guide to how DNS turns a name like holyghost.sh into an address, and why it matters for security.
From typing an address to seeing a page, a lot happens in a second. A beginner friendly walk through of clients, servers, requests, and responses, the mental model the rest of web security builds on.
The three ideas that make computer networking click: what an IP address is, what a port is, and what a protocol is. A beginner friendly foundation for everything else in security.
Confidentiality, integrity, availability. A beginner friendly guide to the model that quietly sits behind almost every security control, attack, and trade off.
Encryption in everyday language: what it means to scramble data, the difference between symmetric and asymmetric keys, how real systems combine both, and where you already rely on it every single day.
Cryptography is more than encryption. A beginner friendly guide to what it actually covers, and the difference between encrypting, hashing, signing, and encoding that trips almost everyone up.
Four words used constantly in security, and constantly confused. A simple analogy that makes the difference between threat, vulnerability, risk, and exploit stick for good.
One of the oldest and most influential classes of vulnerability. How writing more data than a buffer can hold lets an attacker corrupt memory and seize control, and the defences that now stand in the way.
The old model trusted anything inside the network. Zero trust throws that away and verifies every request, wherever it comes from. A beginner friendly guide to the idea and why it took over.
Turning saved data back into live objects sounds harmless. When the data comes from an attacker, it can lead to remote code execution. Here is how insecure deserialization works and how to avoid it.
Those cryptic strings like rwxr-xr-x are simpler than they look. A beginner friendly guide to Linux file permissions, what the letters and numbers mean, and how to set them safely.
XML has a feature that lets a document pull in outside content. Point it at a local file or an internal server and a helpful parser becomes a data leak. Here is how XML External Entity attacks work.
A Security Operations Centre is the people and tools that monitor, detect, and respond to threats around the clock. A beginner friendly guide to what a SOC does and who works in one.
Clickjacking layers an invisible page over a decoy so your click lands somewhere you never intended. Here is how this user interface trick works and how sites shut it down.
A beginner friendly tour of the OWASP Top Ten, the widely used list of the most critical web application security risks, and how its categories map to real attacks.
Template engines mix data into pages. Feed user input into the template itself and an attacker can run code on the server. Here is how SSTI works and how to prevent it.
Open Source Intelligence is the art of learning about a target using only publicly available information. A beginner friendly guide to what OSINT is, how it is used, and how to shrink your own footprint.
When the outcome of a system depends on split second timing, an attacker who controls the timing can bend the rules. A plain guide to race conditions and TOCTOU flaws.
Every famous vulnerability has a CVE id and usually a CVSS score. A beginner friendly guide to what those numbers mean, who assigns them, and why the score is not the same as your risk.
