Engineering notes

Four decisions with their problem, evidence and limits, distinguishing personal software projects from HTB lab retrospectives.

Reviewed 10 October 2026

How I connect a problem with an implementation or a technical conclusion.

These notes were reviewed on 10 October 2026. This is the review date, not a claim about when the original decisions were made. The first two entries concern my own projects; the last two are editorial readings of documented HTB labs. They do not describe client engagements.

Personal projects

report-gen 0.27.0 · personal project

An imported observation is not a verified finding

Problem: A scanner output can enter a report before its technical meaning has been checked.
Decision: Nuclei imports create unverified findings. Nmap imports create service inventory and pending coverage, without creating vulnerabilities from open ports.
Evidence: The import code records provenance, including source hashes. The Nmap application path explicitly leaves coverage pending; finding imports explicitly set verification to unverified.
Limit: Importing preserves observations; it does not repeat a scan, validate a vulnerability or establish that an asset is within an authorized scope.

Read the scanner importer Read finding verification defaults Explore report-gen

Portfolio website · personal project

Keep the reading routes available without JavaScript

Problem: A script failure should not remove access to a case study, its sources or a CV.
Decision: Render the content and links in HTML. Use native disclosures for optional detail and add search, notebook and animation behavior progressively.
Evidence: The case links and CV are ordinary links; technical details use the browser’s own disclosure control. The search page provides a native catalog when JavaScript is unavailable.
Limit: Interactive search and the personal notebook still require JavaScript. The fallback preserves reading and navigation, not every interactive feature.

Inspect a case and its sources Open the search catalog (Spanish)Download the CV (Spanish PDF)

HTB lab retrospectives

HTB Cap · lab retrospective

Treat exposed credentials as a hypothesis for another service

Problem: FTP credentials in a packet capture do not, by themselves, prove SSH access.
Decision: Separate the traffic observation from the later authentication. Explain each transition with its own documentary source.
Evidence: The guide describes readable FTP authentication, then SSH access as nathan. The dossier links those two steps separately.
Limit: The original PCAP and an independent terminal transcript are not included. This note does not claim a new test or current access.

Source: traffic analysis (Spanish)Source: SSH access (Spanish)Read the decision in context

HTB Forest · lab retrospective

Describe replication rights separately from group membership

Problem: Saying that DCSync makes an account a Domain Admin confuses two different capabilities.
Decision: Follow the documented permission chain and name the resulting access precisely: replication material, followed by access with the Administrator identity.
Evidence: The guide documents nested memberships, WriteDacl, DCSync and material associated with RID 500 before the final Pass-the-Hash step.
Limit: Exported ACLs and an independent transcript are not included. The result does not establish automatic Domain Admins membership or a verified remediation.

Source: memberships and permissions (Spanish)Source: replication and final access (Spanish)Read the decision in context

Another own case: session revocation and server state (Spanish) →