Beacon Calls

Hunting blind and out-of-band bugs, with a collector that catches what calls home and a runnable lab you can spin up yourself.

1. Beacon Calls: Own the Collector That Catches Your Blind Bugs

   Part 1 · July 28, 2026

   Blind bugs prove themselves on a server the target calls home to, not in the response you can see. So the real question is what you run for that. This kicks off a series about out-of-band hunting, and it introduces beacontrap, a self-hostable collector you can stand up on your own box in an afternoon.

2. Beacon Calls: Blind Bugs, and the Collector That Catches Them

   Part 2 · July 30, 2026

   A blind bug never proves itself in the response you can see. The proof shows up somewhere else, and later, on infrastructure you control. So the first thing you actually need is not a payload list, it's a collector. Here is why, and here is one I built from scratch in Go for a lab you can run yourself.