Code lives at github.com/lazerdude-labs. The rules for what gets published are on the Ethics page.

License

Write-ups and other content on this site are licensed CC BY 4.0: reuse and adapt them with credit. Code in the site repository and in the tool repositories is MIT unless a repository says otherwise. The logo and the Lazerdude Labs name are not covered by either.

Known and patched CVEs only

I only write up vulnerabilities that are already public and already have a fix from the vendor. There are no zero-days here and no undisclosed bugs. If a fix is not available yet, the write-up waits.

Reproduced in a lab I own

Every reproduction happens on hardware and software that I own and control. I do not test against systems that belong to someone else, and nothing here is a record of activity on a network I was not explicitly allowed to touch.

No bug bounty or private-program material until it is disclosed

Anything I learn through a bug bounty or a private disclosure program stays off this site until the program and the vendor have disclosed it publicly. Program rules and disclosure timelines come first.

Nothing about my employer

This site has no content related to my employer: not its systems, its incidents, its tooling, or anything I learned on the job. Lazerdude Labs is a personal project and stays that way.

The goal

Reproduce, detect, harden. The reproduction steps are here so that the detection content can be tested, not so that the bug can be used against anyone. If you think something published here crosses a line, open an issue on the GitHub organization and I will look at it.

Virtualization

Proxmox VE hosts everything. Each PoC gets its own isolated network with a vulnerable target VM and an attacker VM, and snapshots put the target back to a clean state between runs. Nothing in the lab has a route to a production network, and vulnerable targets never get internet access.

Network monitoring

Security Onion watches a mirror of the lab network and runs Zeek and Suricata. The Zeek logs and Suricata alerts generated while a PoC runs are what the Detect sections of the write-ups are built from.

SIEM and detection engineering

The Elastic Stack receives logs from Security Onion and from agents on the target VMs. Sigma rules are converted to Elastic queries and tested against the data produced during the Reproduce step, so every published detection has been fired at least once against real traffic.

Hardware

Specifics for each host will be listed here as the hardware write-ups are published.

Rules

What gets reproduced here, and why, is governed by the Ethics page.