https://wescastle.com/blog/ Field notes from offensive security engagements, developer tooling, and infrastructure ownership. By Wes Hardcastle. en Thu, 09 Jul 2026 08:00:00 +0000 https://wescastle.com/blog/badge-cloning.html https://wescastle.com/blog/badge-cloning.html Thu, 09 Jul 2026 08:00:00 +0000 A field-notes account of cloning access-control badges on physical pentests — 125 kHz prox cards, a $50 Proxmark, why RFID access control is mostly theater, and the handful of controls that actually raise the cost of the attack. https://wescastle.com/blog/clipboard-datacenter.html https://wescastle.com/blog/clipboard-datacenter.html Tue, 05 May 2026 08:00:00 +0000 A field-notes account of physical penetration testing — clipboards, business-casual pretexts, $40 of hardware, wireless drop boxes in open Ethernet ports, and the part nobody talks about: leaving every site on good terms. https://wescastle.com/blog/fourdollarvpn-blog.html https://wescastle.com/blog/fourdollarvpn-blog.html Fri, 17 Apr 2026 08:00:00 +0000 FourDollarVPN spins up a personal WireGuard VPN on DigitalOcean in about 90 seconds, for about $4 a month. One command, no config files, no commercial provider you have to take at their word. https://wescastle.com/blog/you-dont-own-anything-blog-post.html https://wescastle.com/blog/you-dont-own-anything-blog-post.html Tue, 31 Mar 2026 08:00:00 +0000 Your code is on GitHub. Your DNS is on Cloudflare. Your email is on Google. Your deployments are on Vercel. What do you actually own? Less than you think. https://wescastle.com/blog/forkoff-blog-post.html https://wescastle.com/blog/forkoff-blog-post.html Tue, 31 Mar 2026 08:00:00 +0000 GitHub can suspend your account without warning. ForkOff is a free, open-source tool that mirrors all your repos locally every day — so it doesn't matter if they do.