Njeru Mtwaiti

SIEM Tuning From the Field: Cutting Noise Without Going Blind

Sat, 18 Oct 2025 00:00:00 +0000

SIEM tuning is the SOC work nobody talks about because it’s unglamorous. There’s no clean exploit chain to demonstrate, no CVE to drop. It’s the slow work of making your detection layer actually useful instead of a source of alert fatigue that trains analysts to ignore everything.

These are notes from production — from real log sources, real false positive storms, and real threats that needed catching.

The False Positive Problem Link to heading

A poorly tuned SIEM is worse than no SIEM. When analysts are triaging 500 alerts a day and 490 of them are junk, two things happen:

Fintech API Security: The Attack Surfaces Nobody Talks About

Tue, 12 Aug 2025 00:00:00 +0000

Working in fintech security — both building payment infrastructure at Durrafx and testing external platforms through bug bounty — has given me a particular view of how fintech APIs fail. The standard OWASP Top 10 checklist catches the obvious stuff. This post is about what comes after that.

Why Fintech APIs Are Different Link to heading

A generic web app leaking user data is bad. A payment API leaking transaction data, processing unauthorized disbursements, or allowing account takeover is directly money-out-the-door bad. The stakes mean that subtle logic flaws — the kind that don’t trigger a WAF, don’t show up in automated scans, and require understanding the business model — are often the most valuable findings.

Web Recon Methodology: How I Map an Attack Surface

Fri, 20 Jun 2025 00:00:00 +0000

Reconnaissance is where engagements are won or lost. The best exploit in the world is useless if you aimed it at the wrong target. This post breaks down my web recon process — what I run, in what order, and what I’m actually looking for.

Philosophy First Link to heading

Recon is not about running every tool you have. It’s about building an accurate mental model of the target:

Linux Privilege Escalation: The Checklist I Actually Use

Sat, 05 Apr 2025 00:00:00 +0000

You’ve got a shell. You’re running as www-data or some low-privilege user. Now what?

Privilege escalation on Linux is part methodology, part intuition. This is the checklist I actually run — the one I’ve refined across dozens of CTF boxes and real engagements. No tool dumps the whole path for you. You need to understand what you’re looking at.

0. Situational Awareness First Link to heading

Before running any scripts, understand where you are.

SQL Injection from Zero to Shell: A Practical Walkthrough

Mon, 10 Feb 2025 00:00:00 +0000

SQL injection is one of the oldest and most consistently exploited vulnerability classes on the web. It’s been in the OWASP Top 10 since 2003. It keeps showing up in real engagements, bug bounty reports, and CTF challenges year after year.

This post walks through SQL injection end-to-end — detection, manual exploitation, data extraction, and in some cases, a path to remote code execution.

How It Works Link to heading

When a web application constructs a SQL query by directly embedding user input, an attacker can manipulate that query’s logic.