T#
Index#
tcpdump is the operator’s go-to packet capture utility on Linux and macOS. This page covers basic filters, protocol selection, boolean composition, and a set of advanced BPF expressions that target specific TCP /…
Technical intelligence. Intelligence derived from the exploitation, analysis, and reverse-engineering of foreign equipment, weapons, components, and materials.
Tradecraft the operator runs during open-source target development. Each technique answers a specific information gap, account hunting, imagery, location, persona creation.
Reference of major telecommunications operators by country. The landscape changes frequently (mergers, brand rebrands, MVNO churn); follow GSMA, TeleGeography, and per-country regulator sites for live data.
Reference of vendor naming conventions for tracked threat actors. Most actors have 4-8 alias names across different vendors; this page maps the conventions and lists notable overlaps so the operator can correlate…
The operator’s pointer list when they need IOC feeds, sandboxes, TTP libraries, or vendor reporting for collection, triage, or attribution. Most working analysts orbit two or three of these plus MITRE ATT&CK; the…
Reference of time-zone identifiers, UTC offsets, and the operator-relevant gotchas: DST transitions, leap seconds, and the difference between fixed-offset (POSIX) and rule-based (IANA / tz database) zones.
Terminal multiplexer. Default prefix is Ctrl-b; many operators rebind to Ctrl-a (the GNU Screen convention). In the tables below prefix stands for whichever you’ve bound; prefix <key> means “send the…
Operator-grade Python snippets. The handbook leans on Python for quick scripting on Linux, macOS, and Windows targets, including parsing arguments, reading and writing files, and shelling out to the operating system.
tmux is the terminal multiplexer the operator runs to detach long sessions from the controlling terminal. Engagements survive disconnects, the operator’s panel layout follows them across hosts, and a single…
Online OSINT tools broken into categories by selector. Each section gives the operator the best-known sites for that pivot, addresses, domains, email, image, infrastructure, IPs, people, satellite imagery, telephone,…
Reference of major multilateral treaties and conventions an operator may meet in policy, intelligence, sanctions, and compliance work. Categorized by domain.
Reference of the math used to localise signals, objects, and emitters from multiple measurements. The discipline shows up in GNSS, RF direction-finding, sonar, multilateration of aircraft / ships, astronomical…
Operator one-liners for macOS configuration, monitoring, and quality-of-life. Generate passwords, query external IP, drive Spotlight, monitor performance with powermetrics, and tune the firewall, ARD, AirDrop,…
TShark is Wireshark’s terminal companion, a packet capture and analyzer the operator drives from the command line. Display filters peel the haystack down to the bytes that matter; output flags pull fields into…