https://srdusr.com/Portfolio of Trevor Gray (srdusr) – a multidisciplinary developer & security researcher working on cybersecurity and development.Hugoen-usThu, 03 Sep 2026 00:00:00 +0000https://srdusr.com/blog/a-git-server-is-two-packages/Thu, 03 Sep 2026 00:00:00 +0000https://srdusr.com/blog/a-git-server-is-two-packages/Self-hosting git needs no forge. git ships the server, nginx already speaks CGI, and the whole thing is about twenty lines of config. The one hard part is file ownership, and it will not tell you clearly that it is the problem.Securityhttps://srdusr.com/blog/hardening-a-small-server/Thu, 03 Sep 2026 00:00:00 +0000https://srdusr.com/blog/hardening-a-small-server/A single box running a couple of sites does not need a security programme. It needs about a dozen specific things done, and two of them are traps that look done when they are not.Securityhttps://srdusr.com/blog/recon-is-a-loop/Fri, 21 Aug 2026 00:00:00 +0000https://srdusr.com/blog/recon-is-a-loop/Enumeration is not something you finish and move on from. Every credential and hostname you find sends you back to enumerate something new, so the surface grows as you work.Securityhttps://srdusr.com/blog/writeups/htb-active/Wed, 05 Aug 2026 00:00:00 +0000https://srdusr.com/blog/writeups/htb-active/A GPP password in a readable SYSVOL copy, then a domain administrator with a service principal name. Nothing here is a CVE - everything here is a misconfiguration somebody made on purpose.https://srdusr.com/blog/personal-digital-security/Fri, 24 Jul 2026 00:00:00 +0000https://srdusr.com/blog/personal-digital-security/The attacks I read about for work arrive at ordinary people every day. What I actually do about that, in the order the effort pays back.Securityhttps://srdusr.com/blog/upgrading-a-dumb-shell/Tue, 09 Jun 2026 00:00:00 +0000https://srdusr.com/blog/upgrading-a-dumb-shell/A raw reverse shell has no tab completion, no arrow keys, no job control, and dies the moment you press Ctrl-C. The upgrade takes three steps, and it is worth doing before anything else.Securityhttps://srdusr.com/blog/writeups/htb-valentine/Sun, 17 May 2026 00:00:00 +0000https://srdusr.com/blog/writeups/htb-valentine/Heartbleed used properly - not "the scanner says vulnerable" but dumping memory repeatedly until a passphrase falls out. Root is not an exploit at all: a root process left its tmux socket group-readable.https://srdusr.com/blog/gallery/notes-on-film/Sat, 02 May 2026 00:00:00 +0000https://srdusr.com/blog/gallery/notes-on-film/Slower, more deliberate, and okay with getting it wrong sometimes - what shooting film teaches that digital doesn't.https://srdusr.com/blog/gallery/through-the-viewfinder/Fri, 10 Apr 2026 00:00:00 +0000https://srdusr.com/blog/gallery/through-the-viewfinder/A few frames from wherever the light happened to be good - streets, skylines, and the in-between moments.https://srdusr.com/blog/tests-cannot-see-what-the-machine-already-has/Wed, 08 Apr 2026 00:00:00 +0000https://srdusr.com/blog/tests-cannot-see-what-the-machine-already-has/Code that creates a precondition stops being exercised the moment it succeeds. On the machine where setup already ran, the setup path can break completely and stay green.Developmenthttps://srdusr.com/blog/writeups/htb-shocker/Sun, 22 Mar 2026 00:00:00 +0000https://srdusr.com/blog/writeups/htb-shocker/The exploit is trivial once you find the script. Finding the script is the box, and the reason it is hard is a real Apache configuration detail that breaks default directory brute forcing.https://srdusr.com/blog/gallery/en-garde/Wed, 18 Mar 2026 00:00:00 +0000https://srdusr.com/blog/gallery/en-garde/Fencing is the other discipline that rewards patience over aggression - notes and the odd bout photo, once there's a decent camera at the strip.https://srdusr.com/blog/encryption-is-not-integrity/Fri, 27 Feb 2026 00:00:00 +0000https://srdusr.com/blog/encryption-is-not-integrity/Hiding data is not the same as proving nobody changed it. Treating the first as the second is the root of a whole class of real vulnerabilities.Securityhttps://srdusr.com/blog/gallery/home-lab-build-log/Sun, 22 Feb 2026 00:00:00 +0000https://srdusr.com/blog/gallery/home-lab-build-log/Rack photos and the occasional cable-management disaster from the SIEM/IDS lab mentioned on the about page.https://srdusr.com/blog/writeups/htb-granny/Wed, 11 Feb 2026 00:00:00 +0000https://srdusr.com/blog/writeups/htb-granny/The upload filter blocks PUT of an .aspx and allows MOVE of anything. That is the whole foothold, and it generalises: a blocklist that does not cover rename is not a control.https://srdusr.com/blog/gallery/margin-notes/Fri, 30 Jan 2026 00:00:00 +0000https://srdusr.com/blog/gallery/margin-notes/Whatever gets sketched in the margins while waiting on a scan to finish - not art, just doodles that survived.https://srdusr.com/blog/zsh-arithmetic-subscript-executes/Mon, 19 Jan 2026 00:00:00 +0000https://srdusr.com/blog/zsh-arithmetic-subscript-executes/In zsh, an array subscript inside arithmetic context is evaluated as an arithmetic expression, so it performs command substitution. Tallying strings into an associative array runs them.Securityhttps://srdusr.com/blog/writeups/htb-jerry/Sun, 28 Dec 2025 00:00:00 +0000https://srdusr.com/blog/writeups/htb-jerry/Possibly the easiest box on HTB, and it teaches one thing worth keeping: a Tomcat Manager with default credentials is remote code execution as whatever runs Tomcat, which on Windows is usually SYSTEM.https://srdusr.com/blog/gallery/reading-list/Sun, 14 Dec 2025 00:00:00 +0000https://srdusr.com/blog/gallery/reading-list/Whatever's currently open on the nightstand - security, fiction, whatever isn't a man page for once.https://srdusr.com/blog/enumeration-beats-exploitation/Tue, 02 Dec 2025 00:00:00 +0000https://srdusr.com/blog/enumeration-beats-exploitation/When a box is stuck, the answer is almost never a more advanced technique. The winning path was usually visible at hour one and dismissed.Securityhttps://srdusr.com/blog/writeups/htb-blue/Sat, 29 Nov 2025 00:00:00 +0000https://srdusr.com/blog/writeups/htb-blue/One CVE, no privilege escalation, done in five minutes. The value is not the solve - it is that MS17-010 is the most consequential SMB bug of the last decade and this is the safest place to watch it work.https://srdusr.com/blog/trust-boundaries/Fri, 14 Nov 2025 00:00:00 +0000https://srdusr.com/blog/trust-boundaries/Name the point where data crosses into more trust and you have usually named the missing defence. Where that lens covers almost everything, and where it stops working.Securityhttps://srdusr.com/blog/gallery/late-shift/Sat, 08 Nov 2025 00:00:00 +0000https://srdusr.com/blog/gallery/late-shift/Whatever the city looks like at the hour most people have already gone to bed - the same hours a lot of the actual work happens in.https://srdusr.com/blog/writeups/htb-lame/Tue, 07 Oct 2025 00:00:00 +0000https://srdusr.com/blog/writeups/htb-lame/The first HTB machine, and a lesson in ruling things out. It shows four vulnerable-looking services: two are dead ends, one is a clean root, and one is a foothold with three separate escalations.