___ ___ __________ .__ .__
/ | \ ____ ___ ___\______ \| |__ _____ _______ ____ _____ | |__
/ ~ \_/ __ \ \ \/ / | ___/| | \ \__ \ \_ __ \ / _ \ \__ \ | | \
\ Y /\ ___/ > < | | | Y \ / __ \_ | | \/( <_> ) / __ \_| Y \
\___|_ / \___ >/__/\_ \ |____| |___| /(____ / |__| \____/ (____ /|___| /
\/ \/ \/ \/ \/ \/ \/
Cybersecurity enthusiast as well as a mere developer, a.k.a HexPharoah. An active cyber explorer, currently diving into reverse engineering. A casual CTF player with interests in reverse engineering, steganography, and digital forensics.
Collaborated with like-minded cybersecurity enthusiasts to participate in CTFs and security research.
Find me on
Default passwords, default configurations, default ports.
Attackers don’t need innovation when your setup provides a roadmap.
Harden your starting point: change what’s predictable, remove what’s unused, log what matters.
Good security often begins with being a little less “default.”
SIEMs, EDRs, and scanners are lenses, not answers.
It’s the analyst who interprets the story behind the data.
Why did this script run?
Why did this user elevate privileges?
Why did this endpoint call out at 3 AM?
Asking “why” is more powerful than any dashboard. Attackers think deeply. Defenders should too.
Every system has a rhythm: traffic flows, user habits, normal noise.
Attackers disrupt that rhythm, even if quietly.
A spike in DNS queries, a host talking to a new region, a script waking up at midnight, none of these are random.
The more you understand your environment, the faster you spot the activity that doesn’t belong.
The easiest way into a system isn’t always an exploit, it’s a credential.
A leaked password, an overlooked admin account, or a reused key can be more effective than any zero-day.
Modern defense isn’t just patching vulnerabilities, it’s watching identity.
Unusual logins, impossible travel patterns, privilege escalations: that’s where the real story begins.
If you want to secure a system, start by securing how people enter it.
Most breaches don’t announce themselves.
They show up as a single failed logon at an odd hour…
or a new service created silently…
or a process that shouldn’t talk to the internet, yet does.
Security isn’t reacting to noise; it’s noticing the small things everyone else scrolls past.