Njeru Mtwaiti

SIEM Tuning From the Field: Cutting Noise Without Going Blind

Sat, 18 Oct 2025 00:00:00 +0000

SIEM tuning is the SOC work nobody talks about because it’s unglamorous. There’s no clean exploit chain to demonstrate, no CVE to drop. It’s the slow work of making your detection layer actually useful instead of a source of alert fatigue that trains analysts to ignore everything.

These are notes from production — from real log sources, real false positive storms, and real threats that needed catching.

The False Positive Problem Link to heading

A poorly tuned SIEM is worse than no SIEM. When analysts are triaging 500 alerts a day and 490 of them are junk, two things happen:

Fintech API Security: The Attack Surfaces Nobody Talks About

Tue, 12 Aug 2025 00:00:00 +0000

Working in fintech security — both building payment infrastructure at Durrafx and testing external platforms through bug bounty — has given me a particular view of how fintech APIs fail. The standard OWASP Top 10 checklist catches the obvious stuff. This post is about what comes after that.

Why Fintech APIs Are Different Link to heading

A generic web app leaking user data is bad. A payment API leaking transaction data, processing unauthorized disbursements, or allowing account takeover is directly money-out-the-door bad. The stakes mean that subtle logic flaws — the kind that don’t trigger a WAF, don’t show up in automated scans, and require understanding the business model — are often the most valuable findings.

Web Recon Methodology: How I Map an Attack Surface

Fri, 20 Jun 2025 00:00:00 +0000

Reconnaissance is where engagements are won or lost. The best exploit in the world is useless if you aimed it at the wrong target. This post breaks down my web recon process — what I run, in what order, and what I’m actually looking for.

Philosophy First Link to heading

Recon is not about running every tool you have. It’s about building an accurate mental model of the target:

sqli-hunter

Thu, 15 May 2025 00:00:00 +0000

A purpose-built SQL injection detection and exploitation tool designed for web application pentesting engagements. Lighter and more scriptable than sqlmap for targeted assessments.

Capabilities:

Error-based injection detection across common databases (MySQL, PostgreSQL, MSSQL, SQLite)
Boolean-based blind injection with binary search
Time-based blind injection with adaptive delay tuning
Cookie, header, and POST body injection points
Simple CLI interface for quick integration into recon pipelines

Tech: Python, requests, argparse

Intended for authorized security testing only.

Linux Privilege Escalation: The Checklist I Actually Use

Sat, 05 Apr 2025 00:00:00 +0000

You’ve got a shell. You’re running as www-data or some low-privilege user. Now what?

Privilege escalation on Linux is part methodology, part intuition. This is the checklist I actually run — the one I’ve refined across dozens of CTF boxes and real engagements. No tool dumps the whole path for you. You need to understand what you’re looking at.

0. Situational Awareness First Link to heading

Before running any scripts, understand where you are.

CTF Writeups Repository

Tue, 01 Apr 2025 00:00:00 +0000

A growing collection of detailed writeups from CTF competitions and platform boxes. Each writeup covers the full attack chain: enumeration → exploitation → privilege escalation → flags.

Organized by platform and difficulty. I write these both to solidify my own understanding and to give back to the community that taught me.

Platforms covered:

HackTheBox (Easy / Medium / Hard)
TryHackMe learning paths
CTFtime competition events
PicoCTF challenges

Categories: Web, Binary Exploitation, Cryptography, Forensics, Reversing, OSINT

recon-toolkit

Sat, 01 Mar 2025 00:00:00 +0000

A modular recon automation framework that chains together passive and active discovery techniques — subdomain brute-forcing, DNS resolution, HTTP probing, port scanning, and screenshot capture — into a single pipeline.

Features:

Passive subdomain discovery via crt.sh, Shodan, and VirusTotal APIs
Active DNS brute-force with custom wordlists
HTTP service detection and technology fingerprinting
Automated screenshot capture of live hosts
Output to structured JSON and HTML reports

Tech: Python, asyncio, aiohttp, dnspython, Shodan API

SQL Injection from Zero to Shell: A Practical Walkthrough

Mon, 10 Feb 2025 00:00:00 +0000

SQL injection is one of the oldest and most consistently exploited vulnerability classes on the web. It’s been in the OWASP Top 10 since 2003. It keeps showing up in real engagements, bug bounty reports, and CTF challenges year after year.

This post walks through SQL injection end-to-end — detection, manual exploitation, data extraction, and in some cases, a path to remote code execution.

How It Works Link to heading

When a web application constructs a SQL query by directly embedding user input, an attacker can manipulate that query’s logic.

About

Wed, 01 Jan 2025 00:00:00 +0000

whoami Link to heading

I’m Njeru Mtwaiti — a Cyber Security Engineer with a focus on Application Security, Red Teaming, and Malware Research, working in the Fintech industry from Kenya.

I believe the best defence starts with thinking like an attacker. By understanding how systems break, I build security measures that are practical, resilient, and built for real-world pressure — not just compliance checkboxes.

Currently leading security operations at Durrafx, securing Durrapay’s production infrastructure — a Payment Service Provider platform handling transactions for individual and business clients across borders. I also volunteer my offensive security skills with Protect.ngo, helping non-profits stay safe against adversaries with far more resources.

Contact

Wed, 01 Jan 2025 00:00:00 +0000

Get in Touch Link to heading

I’m always open to conversations about security research, CTF collaboration, responsible disclosure, or just geeking out about infosec.

Email: info@njerumtwaiti.com

GitHub: github.com/njeru-codes

LinkedIn: linkedin.com/in/njeru-mtwaiti

Twitter / X: @njeru_codes

Responsible Disclosure Link to heading

Found a vulnerability and want to report it responsibly? Reach me via email with [SECURITY] in the subject line. I’ll respond within 48 hours.

Hire Me

Wed, 01 Jan 2025 00:00:00 +0000

Freelance Security Consultant Link to heading

I help businesses find and fix security gaps before attackers do. Penetration testing, red team operations, and security consulting — tailored for startups, fintechs, and growing teams.

Currently available for new engagements.

What I Offer Link to heading

Web Application & API Penetration Testing Full-scope assessments covering OWASP Top 10, auth bypass, IDOR, injection flaws, business logic vulnerabilities, and payment flow security. Particularly experienced with fintech platforms and mobile money integrations.