This is a companion post to Building an Nmap Short Course from Scratch. Where that post was about the meta - course design, lab infrastructure - this one drills into the actual first-lecture material: how Nmap decides whether a host is up.

Full lecture notes: Nmap/Short Course/Lecture 1.

Why Host Discovery Matters

Before you can scan ports, identify services, or check for vulnerabilities, you have to figure out which IP addresses on the target network actually have a machine behind them. Scanning IPs that aren't responding is a waste of time, generates a lot of unnecessary network noise, and can …

We spent a good chunk of late May 2025 building a short course on Nmap from scratch - 12 lectures, 12 companion labs, plus the entire virtual lab infrastructure the students would use to run the labs. The whole thing lives on our wiki under Nmap/Short Course.

This post is not about the Nmap material itself (that comes in the next post). It is about the design decisions behind the course - why 12 lectures, why a fully isolated cloud lab, why Vagrant + Docker + Ansible instead of picking one, and what we would do differently if we started over.

Course Shape …

Short post, high signal-to-noise. If you're using Burp Suite for web security testing, there are two extensions we install on every fresh Burp installation before doing anything else. Both are free, both are in the official BApp Store, both take about thirty seconds to install, and both will save you hours the first time you need them.

Wiki reference: Burp Suite/Extensions.

How To Install BApp Store Extensions

For anyone who hasn't installed a Burp extension before:

1. In Burp, go to Extensions → BApp Store
2. Search for the extension name
3. Click "Install"
4. Wait for it to appear in the Installed tab …

Part 5 of our PortSwigger Web Security Academy series. This is the meaty one. We already covered blind SQLi with conditional responses, where the page renders differently depending on the truth of an injected boolean. This post covers what to do when the page doesn't render differently - but you can still smuggle information out by deliberately causing SQL errors.

The example is PortSwigger's Lab 12, which is Oracle-flavored. Full notes: SQL Injection/Blind.

The Six Steps

The full attack has six steps:

1. Prove the parameter is injectable
2. Fingerprint the database
3. Confirm a users table exists
4. Confirm the administrator user exists …

Part 4 of our PortSwigger Web Security Academy series. This one covers blind SQL injection with conditional responses, which is the easier of the two blind SQLi flavors we work through in this series.

Wiki notes: SQL Injection/Blind.

The Setup

Some SQL injection vulnerabilities never give you a direct channel back for the query results. The application runs a SQL query with your input, but the response doesn't render the result or leak database errors. The canonical example is a cookie tracking ID: the ID gets used in a SQL query on every request, but the query output is …

Part 3 of our PortSwigger Web Security Academy series. Part 2 sketched the four SQL injection shapes at a bird's-eye view. This post drills into one of them: the UNION attack. It is one of the most useful shapes to understand because it converts a small SQLi foothold into an "I can read anything in the database" primitive.

Wiki reference: SQL Injection/UNION Attack.

The Idea

Say a page runs

SELECT name, description FROM products WHERE category = 'Gifts'

The columns you can see in the response are name and description, because that is what the query is selecting. UNION lets …

This is part 2 of our series on working through the PortSwigger Web Security Academy. This one covers SQL injection at a bird's-eye view - the four main attack shapes that show up over and over, with the smallest possible example of each. Later posts will drill into specific attack types.

Full notes on our wiki: SQL Injection.

What SQL Injection Is

SQL injection is a web security bug that lets attackers execute their own SQL against your database, by taking advantage of user inputs that are not sanitized before being pasted into a SQL query.

The reason it is worth …

This post is part 1 of a series. We spent a chunk of May and June 2023 working through the PortSwigger Web Security Academy labs, mostly the SQL injection track, and taking notes on our wiki as we went. This post is the setup - what the Academy is, why we picked it, and how it fits together. The posts that follow will cover the specific techniques.

What the Academy Is

PortSwigger makes Burp Suite, which is the standard tool for web application security testing. They also run a free online academy at portswigger.net/web-security, which consists of written lessons …

This post is a preview of a series of posts to come, which will document the process of containerizing the entire charlesreid1.com website.

We will run through a lot of different moving parts and how to get them all working:

• Multiple domains and subdomains pointing to different services
• Docker pod for all services
• Nginx + SSL
• Reverse proxies via nginx
• Apache + MySQL + MediaWiki
• phpMyAdmin
• Gitea
• Configuration files under version control
• Data managed with backup/restore scripts and cron jobs
• Static content under version control
• Files server
• REST API
• Management LAN

All of the code for doing this is in docker …

• Undergraduate Research (UGR) Project: The Technologies
  • Overview of the UGR Project
  • Student-Led Components
    • Raspberry Pi
    • Question Skills
    • Aircrack/Airodump
    • Pi CSV Files
    • NoSQL Database
  • Backend Components
    • Stunnel
    • Virtual Private Server
    • Docker
  • Technologies Flowchart

Undergraduate Research Project (UGR): The Technologies

In this post we'll cover some of the technologies that were used in our South Seatte College undergraduate research project. The project involved an ensemble of different technologies to complete each component of the data analysis pipeline. Some components were planned for, but other components were implemented due to "surprise" challenges that cropped up during the course of the project, while …

Table of Contents:

• Overview of the Undergraduate Research (UGR) Project
  • South Seattle UGR Project
  • Engineering Design Project
  • Project Components: Extract, Store, and Analyze
  • The Internet of Things: Not Just a Buzzword
  • UW Research Symposium

Overview of the Undergraduate Research (UGR) Project

South Seattle UGR Project

For the past year, in addition to my duties as a computer science and math instructor at South Seattle College, I have served as a research mentor for an NSF-funded undergraduate research project involving (off-and-on) five different South Seattle students - all of whom have expressed interest in transferring to the University of Washington's computer science …