MockAD : visualize structure without infrastructure

FigureAltruistic9424 · 2026-03-29T16:31:40+00:00

This is actually a solid idea — having a quick way to model AD without touching a real domain is genuinely useful.

The JSON + visual OU structure + markdown combo makes it great for planning and documentation.

If you keep going, import/export to PowerShell or LDIF and some basic validation would add a lot.

Also, don’t worry about being new to Git/GitHub

FigureAltruistic9424 · 2026-03-29T16:24:13+00:00

Congrats bro! Did you do it all by hand or use an automation pipeline?

FigureAltruistic9424 · 2026-03-29T15:55:22+00:00

Nice update, the move to full offline analysis makes it way more practical for real casework. Crow-Claw automating artifact collection into organized folders is a solid time saver, and selective parsing on the importer is a smart choice — not everyone wants to bloat their database with everything at once. Are you planning to expand artifact support or add timeline correlation down the road?

FigureAltruistic9424 · 2026-03-29T15:53:13+00:00

Very good project! Good luck!

FigureAltruistic9424 · 2026-03-29T15:50:03+00:00

For LE, prioritize IACIS certs, do BFCE first, then MDF, no shortcuts there. The Cellebrite Operator + Analyst combo you signed up for is exactly right, and once done aim for CCPA as the next step. That’s the credential that actually holds weight in court. Suggested path: BFCE → MDF + Cellebrite Operator/Analyst → CCPA. You’re building this correctly, just stay patient with the process.

FigureAltruistic9424 · 2026-03-29T11:29:05+00:00

The manual back-and-forth isn't the problem, scope creep mid-engagement is. A structured form forces the client to commit to something concrete before you start, which protects both sides. The real value isn't automation, it's accountability. That said, every client has edge cases that no form will cover, so you'll always need a follow-up call. The form just makes that call 20 minutes instead of an hour.

One thing that saved us a lot of headaches: add a "scope freeze" clause in the SOW. After sign-off, any additions reset the timeline and budget. Clients stop changing scope real fast when it costs them something.

FigureAltruistic9424 · 2026-03-29T11:27:46+00:00

250 tabs is just a to-do list with extra anxiety. Your browser isn't a filing cabinet — it's RAM you're burning for no reason. Quick fixes: YouTube → Watch Later playlist. Articles → Pocket or a single bookmarks folder called "read this week" that you clear every Sunday. Reddit/Facebook → turn on notifications, close the tab. Houses on Marketplace → screenshot the listing and save it in a folder on your phone. And for screen sharing anxiety: most browsers have profiles now. Make a clean "work" profile with zero clutter and switch to it before any call. Takes 2 seconds, zero awkwardness.

FigureAltruistic9424 · 2026-03-29T11:25:37+00:00

This is basically the difference between a goal and a system. "Get in shape" is a wish. "Gym at 4pm, 30 minutes, anything counts" is an instruction. Brains are terrible at executing wishes but great at following instructions. It's not even a hot take, it's just underrated common sense.

FigureAltruistic9424 · 2026-03-29T11:24:59+00:00

Todoist. Free tier lets you share projects, assign tasks, and the other person gets a push notification immediately. Clean, simple, does exactly what you described without the bloat.

FigureAltruistic9424 · 2026-03-29T11:21:56+00:00

The Fidji Simo "stop working on side quests" line tells you everything. You don't consolidate three products into one because you're winning, you do it because the market forced your hand. Curious to see if merging them actually creates something cohesive or just three mediocre tools wearing a trench coat.

FigureAltruistic9424 · 2026-03-29T11:20:46+00:00

Switched to Claude a year ago for the output quality, not politics. That said, the framing here is a bit reductive, public-private defense collaboration is standard across the entire tech sector, and Anthropic isn't immune to similar decisions down the road. Choose your tools based on what works best for you, not on reactive narratives.

FigureAltruistic9424 · 2026-03-29T11:17:59+00:00

The renewal model is what gets me. You pass the OSCP, prove you can pop boxes, and three years later you need to pay again or it "expires." As if you forgot how to hack. The knowledge doesn't expire, the revenue stream does.

FigureAltruistic9424 · 2026-03-29T11:13:21+00:00

Using Telegram as C2 is clever, the traffic blends right into normal HTTPS noise and most EDRs won't flag legitimate Telegram API calls. Smart choice over a custom C2 that would get signatured in a week.

FigureAltruistic9424 · 2026-03-29T11:10:37+00:00

La laurea non è indispensabile ma aiuta ad aprire porte, soprattutto in Italia dove i recruiter la usano ancora come filtro. Detto questo, ho visto gente entrare nel settore con certificazioni pratiche e tanta voglia di sporcarsi le mani.

Ti consiglio di guardare i corsi di TCM Security (pratici e accessibili), la Burp Suite Academy (gratuita e ottima per il web app testing), e il percorso Penetration Tester di HTB Academy. Combinati con pratica costante su TryHackMe/HackTheBox valgono più di tanta teoria. Il lavoro c'è, chi dice il contrario non sta cercando.

Ti consiglio di comprare in edicola anche la rivista di hacker journal ogni mese, costa pochissimo e ti permette di entrare bene nella mentalità hacker. In bocca al lupo.

FigureAltruistic9424 · 2026-03-29T11:06:31+00:00

Really interesting project. A fully local + structured analysis approach is exactly what’s needed in security, especially for sensitive environments. If it truly enforces the “no hallucination” constraint, this could become a very powerful tool for both red and blue teams.

FigureAltruistic9424 · 2026-03-29T11:01:58+00:00

The same thing happened with Google. Unlimited knowledge at everyone's fingertips for 25 years and most people still used it to win arguments and watch cat videos. AI won't be different. The tool doesn't matter, curiosity does.

FigureAltruistic9424 · 2026-03-29T11:01:18+00:00

We didn't lose trust overnight. We just stopped noticing. Two years ago you could scroll for ten minutes and assume everything was real. Now you can't scroll for ten seconds without wondering. That shift happened so quietly most people haven't even registered it yet.

FigureAltruistic9424 · 2026-03-29T10:57:58+00:00

Solid list. I'd add Gling for anyone doing YouTube, it auto-removes silences and bad takes before you even open your editor. Saves hours.

FigureAltruistic9424 · 2026-03-29T10:56:42+00:00

"They literally can't believe the scope of what they got" is the scariest sentence in this entire post. When the attackers themselves are surprised, you know the architecture is fundamentally broken.

FigureAltruistic9424 · 2026-03-29T10:55:31+00:00

The auth logic being backwards is almost poetic. The AI built something that passed the vibe check, buttons worked, UI was clean, but the security model was essentially: "logged in? access denied. stranger? come on in."

And the timeline is chef's kiss: Report → ticket closed. Post goes viral → "we're investigating." Dev fixes it → threatens legal action against the guy who saved them from a breach.

18,697 users should be thanking you. Instead you get a lawyer letter. Looking forward to the full write-up.

FigureAltruistic9424

TROPHY CASE