# Basilisk OffSec > Offensive and personal security - Site: https://blog.basilisk.com.br/ - Feed: https://blog.basilisk.com.br/feed.xml - Sitemap: https://blog.basilisk.com.br/sitemap.xml ## Artigos - [macOS Hardening: Lockdown Mode, MDM and Attack Surface Reduction](https://blog.basilisk.com.br/macos-hardening-lockdown-mdm): Defensive configurations on Apple Silicon for journalists, activists and researchers facing well-funded state or commercial adversaries. - [Supply Chain Security: Sigstore Signing and Real SBOMs in CI/CD](https://blog.basilisk.com.br/supply-chain-security-sigstore-sbom-cicd): How Basilisk ships cosign, SLSA, and CycloneDX across real pipelines to blunt SolarWinds-style attacks, XZ Utils backdoors, and dependency confusion. - [Malware Analysis in an Isolated Lab: Safe Setup with FlareVM and REMnux](https://blog.basilisk.com.br/malware-analysis-flarevm-remnux-isolated-lab): How to build an air-gapped lab with FlareVM and REMnux for reverse engineering real samples without contaminating your network or burning IOCs. - [Comms OPSEC: Signal, SimpleX and Session Technically Compared](https://blog.basilisk.com.br/opsec-comms-signal-simplex-session-compared): Technical breakdown of protocols, metadata and threat models for Signal, SimpleX and Session, with practical selection criteria per scenario. - [AMSI and ETW Bypass for Defensive Research: What Blue Teams Should Know](https://blog.basilisk.com.br/amsi-etw-bypass-for-defensive-research): Honest technical breakdown of how public AMSI and ETW bypasses work, and how defenders can harden Windows telemetry without looking foolish. - [SQL Injection in Practice: Exploiting, Detecting and Mitigating in a Controlled Lab](https://blog.basilisk.com.br/sql-injection-in-practice-controlled-lab): Hands-on SQLi demo with sqlmap in your own lab, focused on defensive detection and parameterized fixes that actually hold up against production traffic. - [Lateral Movement in the Lab: SMB, WMI and WinRM with a Detection Focus](https://blog.basilisk.com.br/lateral-movement-lab-smb-wmi-winrm-detection): We reproduce three classic lateral movement techniques in GOAD and show how to turn each one into a Sigma rule the blue team can actually use. - [Ethical OSINT: Investigating Your Own Digital Footprint with Maltego and Spiderfoot](https://blog.basilisk.com.br/ethical-osint-personal-digital-footprint): Before a stalker, hostile recruiter, or data broker finds you, do the work yourself. Maltego and Spiderfoot turn public fragments into a personal attack map. - [SSH Hardening 2026: Algorithms, Certificates and Bastion Hosts](https://blog.basilisk.com.br/ssh-hardening-2026-certificates-bastion): Modern SSH configuration with an internal CA, resistant algorithms and auditable bastion hosts to shrink the attack surface in corporate environments. - [Anti-Doxxing Personal Security: Removing Data from Brazilian Data Brokers](https://blog.basilisk.com.br/anti-doxxing-data-broker-removal-brazil): Hands-on technical procedure to cut your exposure on Brazilian data brokers, social media and public records before a doxxer does it for you. - [Simulated Initial Access: Macros, LNK and ISO in an Isolated Windows 11 Lab](https://blog.basilisk.com.br/simulated-initial-access-macros-lnk-iso-windows-11-lab): We replayed three classic initial access vectors inside a sealed Windows 11 lab to see what the EDR actually logs and where detection quietly falls apart. - [Disk Crypto and Backups: VeraCrypt, LUKS and a Resilient 3-2-1 Strategy](https://blog.basilisk.com.br/disk-crypto-veracrypt-luks-321-backups): How to encrypt disks with LUKS2 and VeraCrypt and build verified 3-2-1 backups, with a recovery plan tested in the lab. - [STRIDE Threat Modeling in Sprints: A Full Microservice Walkthrough](https://blog.basilisk.com.br/stride-threat-modeling-microservice-sprint): How to apply STRIDE to a real payments microservice inside a two-week sprint, with a clean DFD, prioritized threats, and actionable mitigations. - [Web Pentesting From Scratch: Building a Safe Lab with DVWA, Juice Shop and Burp Suite](https://blog.basilisk.com.br/web-pentest-from-scratch-dvwa-juice-shop-burp-lab): Hands-on guide to building an isolated web pentest lab with DVWA, Juice Shop and Burp Suite configured under clear legal and safety rules. - [Passwords and MFA: Moving to Passkeys Without Breaking Your Recovery](https://blog.basilisk.com.br/passwords-mfa-passkeys-recovery): Passkeys kill phishing and MFA fatigue, but a sloppy migration locks legitimate users out. Plan fallback, devices and roaming with no holes. - [Windows 11 Hardening for High-Risk Offensive Security Workstations](https://blog.basilisk.com.br/windows-11-hardening-high-risk-workstations): Battle-tested Windows 11 hardening recipe with ASR, Credential Guard, AppLocker and WDAC deployed across Basilisk offensive analyst laptops. - [Linux Server Hardening: Applying CIS Benchmark Without Breaking Production](https://blog.basilisk.com.br/linux-server-hardening-cis-benchmark-no-prod-breakage): How to apply the CIS Benchmark on production Debian and Ubuntu hosts by validating each control, measuring impact, and keeping SLA intact without an all-night rollback. - [Exploring File Upload Vulnerabilities Without Breaking the Law](https://blog.basilisk.com.br/file-upload-vulnerabilities-ethical-lab): How to bypass upload validations in your own lab, map the bug classes, and harden webservers against RCE via malicious file. - [macOS Incident Forensics: UnifiedLogs, FSEvents and AULR in Practice](https://blog.basilisk.com.br/macos-incident-forensics-unifiedlogs-fsevents-aulr): How Basilisk collects evidence on macOS Sonoma and Sequoia using UnifiedLogs, FSEvents and AULR without trampling the incident scene. - [SSRF Demystified: Exploiting Cloud Metadata in a Local AWS Lab](https://blog.basilisk.com.br/ssrf-demystified-cloud-metadata-aws-lab): Ethical SSRF reproduction against IMDS using LocalStack, with real payloads, simulated credential theft and definitive mitigation via IMDSv2. - [Memory Forensics with Volatility 3: Analyzing Dumps in a Reproducible Lab](https://blog.basilisk.com.br/memory-forensics-volatility-3-lab): Technical memory analysis workflow with Volatility 3, sandbox-reproduced dumps and cross-validation against Rekall and MemProcFS. - [Personal Crypto: Hardware Wallets, Passphrase and Coercion-Resistant Backup](https://blog.basilisk.com.br/personal-crypto-hardware-wallet-coercion-backup): How to build self-sovereign crypto custody using a hardware wallet, BIP39 passphrase and metal backup designed against phishing and physical attacks. - [Linux Application Sandboxing with Bubblewrap, Firejail and Flatpak](https://blog.basilisk.com.br/linux-app-sandboxing-bubblewrap-firejail-flatpak): How the Basilisk team isolates browsers, PDF readers and risky tools on Linux desktops using audited, reproducible sandbox profiles. - [Building C2 Infra with Sliver in an Isolated Lab for Defensive Research](https://blog.basilisk.com.br/building-c2-infra-sliver-isolated-lab): Spinning up a Sliver C2 air-gapped is not hacker theater: it is how Blue Teams learn to detect what they will face tomorrow. Hands-on technical walkthrough. - [Active Directory Pentest: Step-by-Step Kerberoasting in a GOAD Lab](https://blog.basilisk.com.br/active-directory-kerberoasting-goad-lab): Ethical Kerberoasting walkthrough on Game of Active Directory: TGS capture, offline crack with hashcat, and detection via Event ID 4769. - [Personal Security for High-Visibility Targets: Journalists, Activists, and Executives](https://blog.basilisk.com.br/personal-security-high-visibility-targets): Defensive playbook for people with public profiles: from threat modeling to digital hygiene, with tools battle-tested in the field. - [Threat Hunting with Sigma and Elastic: From Indicator to Detection Rule](https://blog.basilisk.com.br/threat-hunting-sigma-elastic): How to turn attack hypotheses into Sigma rules tested in Elastic, with a reproducible lab validation pipeline. - [Red Team 101: How Pentests Differ from Real Adversarial Operations](https://blog.basilisk.com.br/red-team-101-pentest-vs-adversarial-ops): A pentest is not a red team. Learn scope, ROE, objectives, and why ethical discipline defines whether an adversarial engagement actually delivers value. - [REST and GraphQL API Pentest: Technical Checklist for Legal Bug Bounty](https://blog.basilisk.com.br/rest-graphql-api-pentest-checklist-bug-bounty): Hands-on methodology for testing REST and GraphQL APIs in authorized programs, focused on IDOR, authentication bypass and malicious introspection. - [Modern XSS: DOM, Stored and Reflected With Real Examples in a Test Lab](https://blog.basilisk.com.br/modern-xss-dom-stored-reflected): Three XSS flavors dissected in a sandbox with payloads, exploitation flow, and mitigations via strict CSP, Trusted Types and DOMPurify sanitization. - [Timeline Forensics on Windows: Plaso, Log2Timeline and KAPE in Practice](https://blog.basilisk.com.br/timeline-forensics-windows-plaso-kape): Building super-timelines of a compromised Windows 11 test VM with KAPE for triage collection and Plaso parsing 200+ artifacts. - [Real Anonymity with Tor: What Works and What is Myth in 2026](https://blog.basilisk.com.br/real-tor-anonymity-myths-reality-2026): Tor is not an invisibility cloak. Where the network truly protects, where traffic correlation breaks anonymity, and how to use it sensibly in 2026. - [Adversary Emulation with Caldera and MITRE ATT&CK in a Corporate Lab](https://blog.basilisk.com.br/adversary-emulation-caldera-attack-lab): How Basilisk uses Caldera, Atomic Red Team and MITRE ATT&CK to simulate real TTPs in a closed lab and measure SOC maturity without breaking production. - [Metadata Hygiene: Stripping EXIF, PDF and Office Before You Publish](https://blog.basilisk.com.br/metadata-hygiene-exif-pdf-office): How to remove metadata that leaks identity, GPS and authorship from images, PDFs and Office documents before publishing online. - [Advanced Nmap: NSE Scripts for Internal Recon in a Simulated Corporate Lab](https://blog.basilisk.com.br/advanced-nmap-nse-internal-recon-lab): How to get real value out of NSE for authorized enumeration on simulated internal networks, with script examples, output parsing, and pentest pipeline integration. - [SELinux Without Fear: Custom Policies for Critical Services](https://blog.basilisk.com.br/selinux-without-fear-custom-policies): From audit2allow forensics to versioned policy modules running in production, without falling into permanent permissive mode. - [Pivoting with Chisel and Ligolo-ng: Segmented Networks in a Pentest Lab](https://blog.basilisk.com.br/pivoting-chisel-ligolo-pentest-lab): How to pivot across VLANs using Chisel and Ligolo-ng in a controlled lab, and which artifacts the blue team can capture to detect the reverse tunnel. - [Digital Compartmentalization: Separate Identities Without Leaking Metadata](https://blog.basilisk.com.br/digital-compartmentalization-identities-metadata): How to keep personas, browsers and devices actually isolated by closing the metadata leaks that destroy any separation within minutes. - [AppSec Shift-Left: SAST, SCA and Secrets Scanning Without Slowing the Team](https://blog.basilisk.com.br/appsec-shift-left-sast-sca-secrets-without-slowing): How Basilisk OffSec rolls out AppSec gradually, measuring developer friction and avoiding the permanently red pipeline nobody bothers to read. - [Hunting Living-off-the-Land Binaries on Windows with KQL](https://blog.basilisk.com.br/hunting-living-off-the-land-binaries-windows-kql): Production-ready KQL queries for Microsoft Defender and Sentinel to hunt LOLBin abuse from rundll32, mshta, and certutil in real environments. - [DFIR on Linux: Live Triage with UAC and Velociraptor](https://blog.basilisk.com.br/dfir-linux-live-triage-uac-velociraptor): How the Basilisk team runs live triage on compromised Linux hosts using UAC and Velociraptor without destroying volatile evidence. - [Dependency Confusion and Typosquatting: Practical Defense for Dev Teams](https://blog.basilisk.com.br/dependency-confusion-typosquatting-defense): How registry policies, lockfiles and scoping block malicious packages before they hit the build. Hands-on technical guide from the Basilisk team. - [Purple Team in Practice: Building a Red vs Blue Feedback Loop](https://blog.basilisk.com.br/purple-team-in-practice-red-blue-feedback-loop): How to integrate adversarial emulation with the SOC, close detection gaps in short sprints, and turn exercises into versioned Sigma rules. - [Tails, Whonix or Qubes OS: Which to Pick for Each OPSEC Scenario](https://blog.basilisk.com.br/tails-whonix-qubes-opsec-comparison): Technical comparison of Tails, Whonix and Qubes OS with objective criteria around threat model, compartmentalization and operational cost to pick the right OS. - [Container Forensics: Investigating Kubernetes Compromises Like a Pro](https://blog.basilisk.com.br/container-forensics-kubernetes-compromises): How the Basilisk team collects evidence from pods, runtime, and control plane after a suspected incident in production Kubernetes clusters. - [Windows Persistence: 10 Documented Techniques and Their Countermeasures](https://blog.basilisk.com.br/windows-persistence-techniques-countermeasures): Defensive catalog of 10 Windows persistence mechanisms with ready-to-run KQL hunting queries and hardening measures any SOC can deploy this week. - [OPSEC for Security Researchers: Building a Personal Threat Model](https://blog.basilisk.com.br/opsec-security-researchers-personal-threat-model): Before you install Tails, Qubes or Signal, draw your individual threat model. Skip it and you are just stacking tools and burning effort in the wrong place. - [EDR Evasion for Research: Direct Syscalls Explained Without the Hype](https://blog.basilisk.com.br/edr-evasion-direct-syscalls-research): How direct syscalls actually work in controlled defensive study, why they remain detectable, and what blue teams should look for before buying the next black box. - [Authorized Red Team Phishing: Templates, GoPhish and Ethical Guardrails](https://blog.basilisk.com.br/authorized-red-team-phishing-gophish-ethics): How written-scope red team engagements use GoPhish, build believable templates, and why firing a campaign without authorization ends careers. - [Android Mobile App Pentest: Frida, MobSF, and a Genymotion Lab](https://blog.basilisk.com.br/android-mobile-pentest-frida-mobsf): End-to-end setup for dynamic analysis of your own APKs using Frida, MobSF, and Genymotion, with hands-on hooks and a technical checklist.