Broader security topics that touch the network without belonging to a single platform. Threat models, defensive design, and the trade-offs behind each control.
MAB with no ISE node and no licence: FreeRADIUS 3.2.7 against a Catalyst 9000v, with the freeradius -X trail that proves MAB is bare PAP, the MAC format everyone gets wrong, and a real Method: mab / Authc Success on a live switchport.
Every 802.1X guide assumes you have Cisco ISE. You do not need it. Here is the whole chain built on FreeRADIUS and a Catalyst 9000v, with real Access-Accept output, a port flipping to Authorized, and the CML switch image that silently wastes your evening.
The site already teaches you how to run every nmap scan. This one flips the camera around: what a SYN scan, a UDP scan and a ping sweep actually look like in an IOS XE ACL counter, in syslog and in a packet capture, plus why a slow scan beats most of it.
Craft spoofed ARP and IP packets with Scapy against a Cisco IOS-XE lab, then watch Dynamic ARP Inspection drop every forgery and name the attacker's real MAC.
dnswalk is the DNS enumeration tool that defenders should love as much as attackers do. It is a DNS debugger:
Most DNS enumeration tools ask a server for records. dnstracer asks a different question: where does this answer actually come
Subdomain brute forcing is only useful if you can go big, and going big means going fast. massdns is the
When a nameserver refuses zone transfers - which, these days, is most of them - subdomain brute forcing is how you enumerate
dnsenum is the classic DNS enumeration tool - a multithreaded Perl script that has been in every pentester's kit
If you learn one DNS enumeration tool, make it dnsrecon. It is the Swiss Army knife of the category: a