Research & field notes.
The working notebook, technical writeups, lab builds, conference notes, and tooling as it takes shape. Full archive lives on the blog; here's a taste of what's in it.
Good offensive work is downstream of good research. This is where the research surfaces, rough edges and all.
✎ blog.SSHad0w.com The full run of writeups, notes, and research logs. Read the blog →#Featured build: SpectraGate
SpectraGate is a beginner-friendly banner-grabbing lab cloaked in a little mystery: one port, many protocols, no map. It's a lightweight TCP multiplexer that breaks the assumption every new analyst quietly relies on, that a port number tells you what's behind it.
Instead of finding SSH on 22 or HTTPS on 443, you get a single exposed port and have to work out what's living behind it using only the banners it returns and your own protocol intuition.
How it works
- Listens on one external port (default
2345) - Peeks at the first few bytes the client sends
- Matches them against known protocol signatures
- Transparently reroutes the connection to the right local service
Send SSH-2.0… and you're routed to 2222. Send
GET / HTTP/1.1 and you land on 80. Start a TLS
handshake and you're handed to 443. The number told you
nothing; the signal did.
In the real world attackers hide services on strange ports, defenders lean on protocol obfuscation and deception, and lazy scanners simply miss it. SpectraGate forces manual curiosity, no shortcut, no help, just instinct. Find the service in the signal, not the number.
Try to break it
Point a few tools at it from another box and see what routes where, then debug what doesn't. That struggle is the entire lesson:
curl http://your_ip:2345nc your_ip 2345openssl s_client -connect your_ip:2345ssh -p 2345 your_ip
Built with Python 3 (asyncio), a hunger for clarity, and a flair for the
dramatic. Every successful connection lands in Spectragate.log
with timestamps and fingerprints to pick apart later. It's MIT-licensed,
learn from it, modify it, share it.
More to come · Action Guard, Cyb3r Club, and whatever the next lab turns into. Not everything behind the port is what it seems.