Blogs

It started when my friend David texted me asking if I’d tried Cursor, a new AI-powered code editor. I hadn’t, but after he mentioned it twice in two days, I figured I should take a look. Within 10 minutes of trying it, I was convinced this was something different. What makes Cursor special isn’t just that it uses AI to

Anyone who’s taken a SANS SEC504 or now SEC587 class with me knows I love password cracking. But here’s the thing about password cracking – it’s a game of patience. Sure, sometimes you’ll crack a password in seconds. Other times, you’re playing the long game, watching your GPU churn through combinations for days. During my government days, this led to

For years, Archive.org has been one of the most valuable sites on the Internet, not only for OSINT research but also for various other tasks. Many others and I used it to archive copies of information that we found useful and trusted that it would be there for us when we needed it. Archive.org has experienced various issues over the

Anyone who has ever taken an OSINT course with me has heard me say, “Metadata is in play far more often than people think.” To help demonstrate that, I often reference a talk by Patrick Warren from the Reconnaissance Village at Defcon31. Warren and his team (some fantastic people I had the privilege of spending time with) identified sensitive information

I’ve already mentioned the Fabric framework, which attempts to minimize the friction between AI and users in several blog posts. I still plan on doing posts showing step-by-step how to install Fabric on different operating systems, but in the meantime, I wanted to show an example of shortcuts I use on Windows to make Fabric even more user-friendly. On my

Anyone who has taken an OSINT class with me knows how much I love Obsidian. In addition to taking notes, I use it to organize my tasks, priorities, and other details for my SANS courses, business, and personal life. Like many practitioners, I rely on pinned browser tabs as temporary bookmarks for interesting content I’d want to review later. We’ve

The internet is constantly being scanned by various services – from search engine crawlers to security research platforms. While examining a public web server’s logs is one way to observe these scanners, not everyone has access to one. Thankfully, Greynoise.io offers a powerful alternative that lets us peek behind the curtain of internet-wide scanning activity. Understanding Greynoise Greynoise operates an

Let’s look at exactly how to configure GoWitness to blend in with normal internet traffic. The settings we’ll use aren’t complicated, but each one serves a specific purpose in making our scanning look unremarkable. The most important setting is the user agent string. GoWitness (version 3.0.5) lets you set this with the –user-agent flag. Here’s what a typical Censys.io crawler’s

When you’re scanning websites, you want to be invisible. Not by being completely undetectable – that’s nearly impossible – but by looking like ordinary internet noise. It’s like walking down a busy street: you don’t want to wear a disguise that makes you stand out. You want to blend in with the crowd. I recently had a student ask an

One of the most powerful features of Large Language Models (LLMs) like ChatGPT or Claude is their ability to learn from conversation context. When you interact with these models through their web interfaces, they adapt to your preferences and feedback, ultimately leading to high-quality outputs that require minimal adjustments. But what happens when you want to automate these interactions using

Daniel Meisler recently created a framework called Fabric, which does something that sounds simple but turns out to be revolutionary: it removes the friction between humans and AI. While attending one of  Meisler’s Augmented virtual trainings featuring Fabric, he made a few predictions about our future relationship with AI. He believes it’s inevitable that we’ll all eventually have AI personal

After writing the SEC497 Practical OSINT Course, I expected 2024 to be a bit of a downshift in a lot of ways. What wasn’t on my threat model was being asked to take over authorship of the SEC587 Advanced OSINT Course. Most fields evolve slowly. Open-Source Intelligence (OSINT) isn’t one of them. Practitioners today face an environment shaped by rapid

As I wrote about a few days ago, I recently completed a massive overhaul of the SANS SEC587 Advanced OSINT course, including twenty new labs in 2024. One of the changes is a new wireless section, which includes a lab covering detecting modern drones using inexpensive USB dongles flashed with custom firmware. Here is a short video I posted on

Years ago, when SANS split the Forensics 508 course into two separate courses (500 and 508), I took both courses and wrote a blog post to help potential students determine which course would better fit them. I never thought I would write a similar post again, let alone for two courses I wrote. Background When I wrote the SEC497 Practical

For various reasons I won’t get into yet, I will blog A LOT more in 2025. I decided to convert my business website from a static site to WordPress so I could blog under this umbrella. I’ll leave all my older content at digitalforensicstips.com, but my new stuff will be posted here. Matt