Initializing
July 31, 2026
You're Domain Admin, but there's a whole network your Kali can't see. We turn Cetro into a bridge with ligolo-ng and take down the ghost that trips half the class: asymmetric routing.
By Gerardo Eliasib
July 29, 2026
No CVE, no 0-day, no brute force. Just secrets left where they shouldn't be. We take apart Imprenta's full chain (CPPJ): anonymous FTP, WordPress, an SSH key and sudo.
By Gerardo Eliasib
July 28, 2026
No exploit, no shellcode, no password. Just clicks on a certificate warning. We dissect CVE-2017-7344 on Fortaleza (CPPJ) and the class of bug that makes it possible.
By Gerardo Eliasib
July 18, 2026
A Domain Controller with two independent roads to SYSTEM: a crypto flaw and a memory bug. We dissect Cetro (CPPJ) to understand why it falls, not just how.
By Gerardo Eliasib
April 13, 2026
Your operator base in the cloud: an attack machine with the full offensive arsenal already installed and tuned. Launch it from your browser — nothing to install, no VPN.
By Gerardo Eliasib
April 12, 2026
The personal story behind Spartan-Labs: an idea born from drawing mazes in class that three years later becomes our lab platform.
By Gerardo Eliasib
April 12, 2026
Introducing the new identity of Spartan-Cybersecurity: the philosophy behind the black hole, the evolution of our brand, and the beginning of a new chapter.
By Gerardo Eliasib
March 3, 2026
Meet Tasks, the hands-on challenges in every Spartan Labs course: compromise the target from your SpartanOps, capture the flag, and submit it to the platform to level up.
By Gerardo Eliasib