Blogs on kanyo's blog

Walking Past Defender

Sat, 04 Jul 2026 00:00:00 +0000

Introduction

When it came to practice, I hardly found what I was looking for. Most writeups and blogs on stager development and Defender evasion put everything into complex scenarios, so much detail, so much context, so much “here’s how I did it in this specific environment with these specific tools.” But no one actually simplified it. No one broke it down to what it actually is at its core.

How Defender Actually Works

Fri, 03 Jul 2026 00:00:00 +0000

Introduction

At Ingehack, I spent way too long blindly throwing obfuscated tools at a target. Change a string here, re-encode there, try a different obfuscator, run it again. Sometimes something worked. Most of the time it didn’t. And the frustrating part was that I had no real idea why, I was just guessing and hoping that enough random changes would eventually get me through.

That’s completely the wrong way to approach this.

eBPF Dive

Fri, 27 Mar 2026 00:00:00 +0000

Ever wanted to run your own code inside the Linux kernel without writing a kernel module, without rebooting, and without breaking everything? That’s eBPF.

This post is a practical intro. I’ll cover how eBPF programs actually work, walk through a real example, explain the two ways to get data out of the kernel, and show how the userspace side ties it all together. At the end I’ll touch on the network security toolkit I’ve been building on top of this.

Self-hosted VPN

Fri, 20 Mar 2026 00:00:00 +0000

Instead of relying on a commercial VPN provider, I wanted to see how far I could get by building my own on a VPS. The goal was simple: connect my laptop and phone over WireGuard, optionally route all traffic through it.

The real value came from debugging actual issues. This post goes through all of it.

Why WireGuard

Simpler than OpenVPN, kernel-based, and the mental model is clean. Each machine has its own private key, each knows the other’s public key, peers get assigned internal VPN IPs. No certificate infrastructure to deal with.

eJPT: Exam Guide

Tue, 17 Mar 2026 00:00:00 +0000

I passed the eJPT with 90%. I didn’t purchase the INE training bundle, so I won’t be walking through the exam itself, that’s against the rules and I didn’t have access to their course anyway. What I can do is tell you exactly what you need to know to be ready for it.

The exam is 48 hours, practical, and covers a multi-machine scenario across multiple networks. It’s entry level but it’s not a joke. You need to actually know what you’re doing.