<?xml version="1.0" encoding="UTF-8"?><rss xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:atom="http://www.w3.org/2005/Atom" version="2.0"><channel><title><![CDATA[MeshForgeBlog]]></title><description><![CDATA[MeshForgeBlog]]></description><link>https://www.meshforge.net/blog</link><generator>RSS for Node</generator><lastBuildDate>Thu, 11 Jun 2026 02:54:24 GMT</lastBuildDate><atom:link href="https://www.meshforge.net/blog-feed.xml" rel="self" type="application/rss+xml"/><item><title><![CDATA[Bloodhound: The Map That Shows You How to Own Active Directory]]></title><description><![CDATA[Series: The Community's Red Team Post: 17 of 17 Tags: bloodhound, active directory, SharpHound, attack paths, AD, tools Read time: ~13 min Prerequisites: Post 01 — Methodology Overview, Post 14 — Impacket Active Directory is a maze. Thousands of users, hundreds of groups, dozens of computers, nested group memberships, ACL permissions, delegation rights, session data — the relationships between AD objects are too complex to map manually and too important to leave unmapped. A user who seems...]]></description><link>https://www.meshforge.net/post/bloodhound-the-map-that-shows-you-how-to-own-active-directory</link><guid isPermaLink="false">6a14b7d7503396b6af8ef8c9</guid><pubDate>Mon, 25 May 2026 18:21:58 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/7910d6_c314da81c5264beaa572537d9291e3d6~mv2.png/v1/fit/w_225,h_225,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Tony Kelly</dc:creator></item><item><title><![CDATA[Ligolo-ng: Pivoting That Feels Like You're Already Inside]]></title><description><![CDATA[Series: The Community's Red Team Post: 16 of 17 Tags: ligolo-ng, pivoting, tunneling, network interface, proxychains, tools Read time: ~10 min Prerequisites: Post 15 — Chisel Post 15 covered Chisel — excellent for simple tunneling when you need a SOCKS proxy. Ligolo-ng solves the same problem differently, and the difference matters: instead of routing your traffic through proxychains, Ligolo-ng creates an actual virtual network interface on your attack machine. The result is that internal...]]></description><link>https://www.meshforge.net/post/ligolo-ng-pivoting-that-feels-like-you-re-already-inside</link><guid isPermaLink="false">6a14b7d7503396b6af8ef8c8</guid><pubDate>Mon, 25 May 2026 18:17:01 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/7910d6_1deeb5ef111f46cd824c63cb60aa4f38~mv2.png/v1/fit/w_1000,h_800,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Tony Kelly</dc:creator></item><item><title><![CDATA[Chisel: TCP Tunneling Over HTTP When Nothing Else Gets Through]]></title><description><![CDATA[Series: The Community's Red Team Post: 15 of 17 Tags: chisel, pivoting, tunneling, SOCKS, proxychains, port forwarding, tools Read time: ~10 min Prerequisites: Post 01 — Methodology Overview You compromised a machine. That machine sits in a DMZ — it can reach the internal network, but your attack box cannot. The firewall allows outbound HTTP from the DMZ but blocks everything else. You need to get your tools into that internal network. Chisel builds an encrypted tunnel over HTTP. From the...]]></description><link>https://www.meshforge.net/post/chisel-tcp-tunneling-over-http-when-nothing-else-gets-through</link><guid isPermaLink="false">6a14b7d7503396b6af8ef8c7</guid><pubDate>Mon, 25 May 2026 18:13:06 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/7910d6_8598144216094885a50bcddd309ccf8b~mv2.png/v1/fit/w_973,h_379,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Tony Kelly</dc:creator></item><item><title><![CDATA[Impacket: Speaking Windows Protocols from a Linux Terminal]]></title><description><![CDATA[Series: The Community's Red Team Post: 14 of 17 Tags: impacket, psexec, wmiexec, secretsdump, kerberoast, DCSync, Windows, tools Read time: ~12 min Prerequisites: Post 06 — CrackMapExec, Post 12 — Metasploit Impacket is a Python library that implements Windows network protocols — SMB, MSRPC, LDAP, Kerberos, MSSQL, and more — at a level that lets you interact with Windows infrastructure from a Linux machine without needing to be domain-joined or running Windows at all. For red teamers the...]]></description><link>https://www.meshforge.net/post/impacket-speaking-windows-protocols-from-a-linux-terminal</link><guid isPermaLink="false">6a14b7d7503396b6af8ef8c6</guid><pubDate>Mon, 25 May 2026 18:08:05 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/7910d6_63392a9d2f734fdfbc324bf6c801d33f~mv2.png/v1/fit/w_1000,h_571,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Tony Kelly</dc:creator></item><item><title><![CDATA[LinPEAS / WinPEAS: Let the Automation Find the Mistakes First]]></title><description><![CDATA[Series: The Community's Red Team Post: 13 of 17 Tags: linpeas, winpeas, privilege escalation, post-exploitation, Linux, Windows, tools Read time: ~11 min Prerequisites: Post 12 — Metasploit, Post 11 — Netcat You've got a shell. You're running as a low-privilege user. The goal is root or SYSTEM. The question is: where's the opening? Privilege escalation is the art of finding misconfiguration — SUID binaries that shouldn't be SUID, cron jobs running writable scripts, sudo rules that let you run...]]></description><link>https://www.meshforge.net/post/linpeas-winpeas-let-the-automation-find-the-mistakes-first</link><guid isPermaLink="false">6a14b7d7503396b6af8ef8c5</guid><pubDate>Mon, 25 May 2026 18:01:43 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/7910d6_bc5ed9842a3846dd8d7fc17598260c04~mv2.png/v1/fit/w_1000,h_600,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Tony Kelly</dc:creator></item><item><title><![CDATA[Metasploit: The Exploitation Framework That Handles the Complexity]]></title><description><![CDATA[Series: The Community's Red Team Post: 12 of 17 Tags: metasploit, msfconsole, meterpreter, exploitation, post-exploitation, tools Read time: ~13 min Prerequisites: Post 01 — Methodology Overview, Post 11 — Netcat Metasploit has a reputation problem. In movies and TV it's the "press button, get hacked" tool that makes hacking look trivial. In beginner CTF writeups it's treated as a crutch. In real security work, it's an industrial-grade framework that senior red teamers use every day because...]]></description><link>https://www.meshforge.net/post/metasploit-the-exploitation-framework-that-handles-the-complexity</link><guid isPermaLink="false">6a14b7d7503396b6af8ef8c4</guid><pubDate>Mon, 25 May 2026 17:48:18 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/7910d6_a47aad4707404d13b7ee73de87aede21~mv2.jpg/v1/fit/w_1000,h_717,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Tony Kelly</dc:creator></item><item><title><![CDATA[Netcat: The Utility That Does Everything No One Tool Should Do]]></title><description><![CDATA[Series: The Community's Red Team Post: 11 of 17 Tags: netcat, reverse shells, bind shells, file transfer, port scanning, tools Read time: ~11 min Prerequisites: Post 01 — Methodology Overview Netcat has been called the TCP/IP Swiss Army knife, and that description has stuck for thirty years because nothing better has come along to replace it. It reads and writes raw data across TCP and UDP connections. That's it. That single capability, applied creatively, makes it the tool you reach for when...]]></description><link>https://www.meshforge.net/post/netcat-the-utility-that-does-everything-no-one-tool-should-do</link><guid isPermaLink="false">6a14b7d7503396b6af8ef8c3</guid><pubDate>Mon, 25 May 2026 17:44:28 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/7910d6_4e6cee16991b43c282b66a75d0e0264a~mv2.png/v1/fit/w_1000,h_630,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Tony Kelly</dc:creator></item><item><title><![CDATA[John the Ripper: Cracking Files, Keys, and Hashes Hashcat Can't Touch]]></title><description><![CDATA[Series: The Community's Red Team Post: 10 of 17 Tags: john the ripper, hash cracking, ssh keys, zip, pdf, office, password attacks, tools Read time: ~10 min Prerequisites: Post 09 — Hashcat Post 09 covered Hashcat — GPU-accelerated cracking for raw hashes. Hashcat is faster at cracking hashes once you have them. John the Ripper's edge is in everything that comes before that: converting password-protected files into a format that can be cracked. Find a password-protected zip file while...]]></description><link>https://www.meshforge.net/post/john-the-ripper-cracking-files-keys-and-hashes-hashcat-can-t-touch</link><guid isPermaLink="false">6a14b7d7503396b6af8ef8c2</guid><pubDate>Mon, 25 May 2026 17:39:27 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/7910d6_f96d6de1bb74484596cd51b2f0d0b78b~mv2.png/v1/fit/w_400,h_400,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Tony Kelly</dc:creator></item><item><title><![CDATA[Hashcat: Breaking Hashes Without Making a Single Network Request]]></title><description><![CDATA[Series: The Community's Red Team Post: 09 of 17 Tags: hashcat, hash cracking, offline cracking, NTLM, kerberoast, password attacks, tools Read time: ~12 min Prerequisites: Post 01 — Methodology Overview You're inside a system. You ran a credential dump and came back with a file full of hashes. Or you captured NetNTLMv2 traffic with Responder. Or you grabbed Kerberos tickets with Impacket. The plaintext passwords are locked inside these strings of hex characters. Hashcat's job is to unlock...]]></description><link>https://www.meshforge.net/post/hashcat-breaking-hashes-without-making-a-single-network-request</link><guid isPermaLink="false">6a14b7d7503396b6af8ef8c1</guid><pubDate>Mon, 25 May 2026 17:34:56 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/7910d6_a54430174e9244829a1b9610e5cb6ca7~mv2.png/v1/fit/w_225,h_225,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Tony Kelly</dc:creator></item><item><title><![CDATA[Medusa: Parallel Network Login Attacks Done Right]]></title><description><![CDATA[Series: The Community's Red Team Post: 08 of 17 Tags: medusa, brute force, ftp, ssh, parallel attacks, password attacks, tools Read time: ~9 min Prerequisites: Post 07 — Hydra (understand the brute force concepts first) Hydra and Medusa solve the same problem: trying a list of credentials against a network service. If you already read Post 07, you might be wondering why you need another brute force tool. The answer is that they're complementary, not redundant — each has cases where it works...]]></description><link>https://www.meshforge.net/post/medusa-parallel-network-login-attacks-done-right</link><guid isPermaLink="false">6a14b7d7503396b6af8ef8c0</guid><pubDate>Mon, 25 May 2026 16:34:46 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/7910d6_71f97cd402fc40deaa5dd8359896633f~mv2.jpg/v1/fit/w_225,h_225,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Tony Kelly</dc:creator></item><item><title><![CDATA[Hydra: Online Brute Force for Any Service That Has a Login]]></title><description><![CDATA[Series: The Community's Red Team Post: 07 of 17 Tags: hydra, brute force, ssh, ftp, http, password attacks, tools Read time: ~11 min Prerequisites: Post 01 — Methodology, Post 05 — Enum4linux (for password policy) Every service with a login prompt is potentially vulnerable to one of the oldest attacks in the book: try every password you know until one works. Hydra is the tool that automates this across almost every network protocol that exists. The important distinction before we go further:...]]></description><link>https://www.meshforge.net/post/hydra-online-brute-force-for-any-service-that-has-a-login</link><guid isPermaLink="false">6a14b7d7503396b6af8ef8bf</guid><pubDate>Mon, 25 May 2026 16:26:10 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/7910d6_87b50847a07c4801ba3f50c45aa3edf4~mv2.jpg/v1/fit/w_209,h_241,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Tony Kelly</dc:creator></item><item><title><![CDATA[NetExec/CrackMapExec: Test One Credential Against Everything at Once]]></title><description><![CDATA[Series: The Community's Red Team Post: 06 of 17 Tags: crackmapexec, netexec, nxc, smb, lateral movement, credential spraying, tools Read time: ~12 min Prerequisites: Post 01 — Methodology, Post 05 — Enum4linux You found a credential. Maybe it came from an SMB share. Maybe you cracked a hash. Maybe it was in a config file or a sticky note in a screenshot. Now what? The mistake beginners make is testing it against one service and moving on. The reality of real-world networks is that password...]]></description><link>https://www.meshforge.net/post/netexec-crackmapexec-test-one-credential-against-everything-at-once</link><guid isPermaLink="false">6a14b7d7503396b6af8ef8be</guid><pubDate>Mon, 25 May 2026 16:09:36 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/7910d6_68e9447ec9e64e95bbe7c6df7a77f617~mv2.png/v1/fit/w_1000,h_807,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Tony Kelly</dc:creator></item><item><title><![CDATA[Enum4linux: Everything SMB Will Tell You Without a Password]]></title><description><![CDATA[Series: The Community's Red Team Post: 05 of 17 Tags: enum4linux, smb, samba, enumeration, null session, tools Read time: ~10 min Prerequisites: Post 01 — Methodology Overview, Post 02 — Nmap If Nmap shows ports 139 or 445 open, you have an SMB service. And SMB — Server Message Block, Microsoft's file-sharing protocol — has a long history of being more talkative than it should be without any credentials at all. Enum4linux automates the conversation. Point it at an SMB service, run one...]]></description><link>https://www.meshforge.net/post/enum4linux-everything-smb-will-tell-you-without-a-password</link><guid isPermaLink="false">6a14b7d7503396b6af8ef8bd</guid><pubDate>Mon, 25 May 2026 09:05:01 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/7910d6_ef532752a46d4c1991d210b6f94efec0~mv2.jpg/v1/fit/w_970,h_546,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Tony Kelly</dc:creator></item><item><title><![CDATA[Nikto: The Automated Web Vulnerability Scanner That Finds the Embarrassing Stuff]]></title><description><![CDATA[Series: The Community's Red Team Post: 04 of 17 Tags: nikto, web scanning, vulnerability scanning, web server, tools Read time: ~8 min Prerequisites: Post 01 — Methodology Overview, Post 03 — Gobuster Nikto is not subtle. It doesn't pretend to be subtle. It fires thousands of checks at a web server as fast as it can and reports back everything it finds — outdated software versions, dangerous HTTP methods that shouldn't be enabled, default files that should have been deleted, security headers...]]></description><link>https://www.meshforge.net/post/nikto-the-automated-web-vulnerability-scanner-that-finds-the-embarrassing-stuff</link><guid isPermaLink="false">6a14b7d7503396b6af8ef8bc</guid><pubDate>Mon, 25 May 2026 08:50:29 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/7910d6_e24f6292c7c34b45ad6b46ae15e58443~mv2.jpg/v1/fit/w_299,h_168,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Tony Kelly</dc:creator></item><item><title><![CDATA[Gobuster: Finding What the Web Server Isn't Supposed to Show You]]></title><description><![CDATA[Series: The Community's Red Team Post: 03 of 17 Tags: gobuster, web enumeration, directory brute force, dns, vhost, tools Read time: ~10 minPrerequisites: Post 01 — Methodology Overview, Post 02 — Nmap Every web server has two versions of itself. The version it shows you the homepage, the login page, the public-facing content. And the version it's hiding the admin panel, the backup files, the staging environment that never got taken down, the config file that ended up in the wrong directory....]]></description><link>https://www.meshforge.net/post/gobuster-finding-what-the-web-server-isn-t-supposed-to-show-you</link><guid isPermaLink="false">6a14b7d7503396b6af8ef8bb</guid><pubDate>Mon, 25 May 2026 08:43:17 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/7910d6_c68014b71d9444c5b134ed34b91e8aef~mv2.png/v1/fit/w_646,h_209,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Tony Kelly</dc:creator></item><item><title><![CDATA[Nmap: The First Thing You Run on Everything]]></title><description><![CDATA[Series: The Community's Red Team Post: 02 of 16 Tags: nmap, recon, enumeration, port scanning, tools Read time: ~12 min Prerequisites: Post 01 — Red Team Methodology Overview Before you can attack anything, you need to know it exists. Before you know it exists, something has to scan for it. That something is Nmap — Network Mapper — and it's the first tool you'll run on every single target, without exception. Nmap has been around since 1997. It's open source, it's on every major security...]]></description><link>https://www.meshforge.net/post/nmap-the-first-thing-you-run-on-everything</link><guid isPermaLink="false">6a14b7d7503396b6af8ef8ba</guid><pubDate>Mon, 25 May 2026 08:20:45 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/7910d6_b3243f1488f947bba124c0f2dc4fad17~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Tony Kelly</dc:creator></item><item><title><![CDATA[They Count on You Not Knowing: A Beginner's Map of How Hacking Actually Works]]></title><description><![CDATA[Series: The Community's Red Team Post: 01 of 16 Tags: methodology, red team, beginner, recon, exploitation Read time: ~10 min Most people picture hacking as some genius sitting in a dark room typing impossibly fast while green text scrolls down the screen hacking into some black box of unknown technology. The reality is closer to a plumber reading blueprints before opening a wall. You follow a process. You work through a checklist. And the reason it works (almost every time) is that the...]]></description><link>https://www.meshforge.net/post/they-count-on-you-not-knowing-a-beginner-s-map-of-how-hacking-actually-works</link><guid isPermaLink="false">6a14b7d7503396b6af8ef8b9</guid><pubDate>Mon, 25 May 2026 08:16:24 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/7910d6_5ca51755cea84dc3b67b4763fca0c912~mv2.png/v1/fit/w_1000,h_928,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Tony Kelly</dc:creator></item></channel></rss>