Cybersecurity professional based in the UK. Enthusiast of nature, chequered shirts and lists of three. Creator of open-source tools like Slack Watchman, GitLab Watchman, Lil Pwny, and more.
TryHackMe Writeups
This series of write-ups is for the TryHackMe Room Squid Game, which you can access here: https://tryhackme.com/room/squidgameroom. This challenge room is one of the few intended for blue teams on TryHackMe, and is categorised as hard, so I thought I would give it a go. The
Slack Watchman
The new version 4.0.0 release of Slack Watchman contains some major upgrades and new features: Centralised signatures The biggest upgrade, in terms of maintenance, to Slack Watchman is the move to store and pull signatures from a centralised repository GitHub - PaperMtn/watchman-signatures: Signature base for Watchman applications
Tradecraft
This post has been updated in December 2025 to account for changes to Slack authentication since it was originally written. Slack, like many other services, uses cookies to store authentication and session information. What is interesting with Slack, however, is that one particular cookie can be used to generate a
Lil Pwny
A new year, and a new lease of life for Lil Pwny, which gets some love with the release of version 2.0.0 The new version can be found on GitHub Or can be installed from PyPI: python3 -m pip install --upgrade gitlab-watchman About Lil Pwny Lil Pwny is
GitHub Watchman
If your organisation does any development, infrastructure management, or anything with code, you will know that some of your most important data and intellectual property sit in Git repositories. Whether it is down to bad coding practice, mistakes, or oversights, all sorts of confidential data is often stored in repositories
Slack Watchman
In what should be the last major version bump for a while, today I release Slack Watchman 3.0.0. This update adds some transformational features that help move Slack Watchman into the realms of being a truly useful solution for enterprise. Slack Watchman is available on GitHub: https://github.
Slack Watchman
The past housebound weeks have given me time to continue working on Slack Watchman, and i've now reached the stage of releasing version 2.0.0 The release is available on GitHub: https://github.com/PaperMtn/slack-watchman/releases/tag/2.0.0 The latest version is always available
Slack Watchman
About Slack Watchman is an application I have created to search through Slack workspaces and look for sensitive information posted in public chats/channels. This information is then returned to you in the form of CSV files. You can find the project on GitHub here With the whole environment moving
Tradecraft
It seems strange to talk about normal right now considering that, at the time of writing, a lot of the world is under quarantine. Yet in security, normal is something that is important to know. When creating alerts or analysing logs, you want to be notified when something is not
Lil Pwny
💡This post is partially out of date, and should be read in combination with the version 2.0.0 release notes Now that we have our data from Active Directory, it is time to use Lil Pwny to audit the passwords. Getting Ready Installing Lil Pwny is simple from PyPI:
Lil Pwny
The first step in auditing passwords using Lil Pwny is to recover the passwords from Active Directory. Passwords in a Windows Domain Before we look at how to recover passwords, it is useful to know how Windows handles and stores passwords in general. Windows uses the NTLM (New Technology LAN
Lil Pwny
💡This post is partially out of date, and should be read in combination with the version 2.0.0 release notes About Lil Pwny is an application I created to check passwords from Active Directory against the list of compromised passwords from Have I Been Pwned, the collection of real