SQL Injection Detection: A Defensive Guide
How to detect SQL injection across web, app, and database telemetry — with Sigma, Suricata, and SPL rules, a CVE-2025-1094 case study, and tuning tips. Lab-only.
Read the analysis$ defensive security research · lab-only
Understand the attack. Build the defense.
darkpwn is a defensive security research publication: how real attacks work, what they leave behind, and the detections and hardening that stop them. Hardware hacking, detection engineering, and CTF analysis from a working lab — written for defenders, authorization-only.
Latest writing
All articles
Defensive Research
Zero Trust Microservices: East-West Detection
Zero trust microservices detection. Find east-west movement via new service-pair edges, workload identity drift, and Kafka abuse, with SPL and KQL analytics.
Security Tools
Secrets Detection for Engineering Teams
Secrets detection that finds leaked credentials first. Git history, CI logs, and container layers, with pattern and entropy analytics plus a rotation-first runbook.
Detection Engineering
Credential Stuffing Detection
Credential stuffing detection that finds what hides under per-IP thresholds. Success-rate inversion, low-and-slow campaigns, and ATO signals in SPL and KQL.
Defensive Research
Supply Chain Attack Detection
Supply chain attack detection in CI/CD. Build-time egress, dependency drift, and artifact provenance, with Sigma and SPL analytics plus hermetic-build hardening.
Detection Engineering
Session Hijacking Detection
Session hijacking detection after MFA. Refresh-token reuse, device drift, and impossible travel, with SPL, KQL, and Sigma analytics plus a triage runbook.
Detection Engineering
YARA Rules for Incident Response
How to write YARA rules for incident response — durable signatures that survive a packer change, scanning files and memory, and tuning false positives.
Explore by discipline
Defensive Research
How attacks work — so defenders can stop them
BrowseHardware Security
RF, RFID, and implants on the bench
BrowseDetection Engineering
Sigma, YARA, Suricata that actually fire
BrowseCTF Analysis
Write-ups that teach the underlying primitive
BrowseSecurity Tools
The defender and researcher toolchain
Browse