Developer tools7 min read
Inspect an EXE without running it: reading PE headers
What the PE headers, section table, import list and per-section entropy tell you about a Windows executable, and where static triage stops being enough.
Developer tools posts
EXE/PE inspection, pcap analysis, JSON, JWT and encoding work.
Developer tools6 min read
JWT debugging safely: decoding is not verifying
JWT structure and base64url, the alg and kid headers, the none and algorithm-confusion attacks, expiry and clock skew, and how to debug a token without leaking it.
Developer tools6 min read
Read a pcap without Wireshark: headers, flows and TLS
How pcap and pcapng are laid out, where snaplen truncation bites, how to turn packets into flows and endpoints, and what TLS still leaks in a capture.