Henrik Falk May 28, 2026
Nmap Through SSH Pivot: Why Proxychains and sshuttle Fail
If you’ve tried pivoting nmap through an SSH jump host, you’ve probably hit one of two outcomes: every port comes back as filtered, or every port comes back as open. Both are wrong and in this post I will show you how I got to a satisifying result. (Spoiler: Using ligolo-ng).
Blog by Simon Frey
JWT is a scam and your app doesn't need it
Every JWT-based system I have audited has the same broken revocation story, the same useless refresh dance, and the same client codebase that decodes the payload and trusts it.
www.dusanmalusev.dev/blog/jwt-is-a-scam-and-your-app-doesnt-need-it
Living Off The Land: Creative C2 and Data Exfiltration Options
Today, we want to explore how creativity has transformed both C2 and Data Exfiltration and look at the techniques that hackers have come up with. A great resource for studying this is LOLC2, which is a collection of C2 frameworks that leverage legitimate services to evade detection. The project focuses on the idea of hiding malicious communication inside platforms defenders already trust.
hackers-arise.com/living-off-the-land-creative-c2-and-data-exfiltration-options
