<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Incident Response on MeteSec</title><link>https://metesec.com/categories/incident-response/</link><description>Recent content in Incident Response on MeteSec</description><generator>Hugo -- gohugo.io</generator><language>en</language><managingEditor>metesec@outlook.com (Mete Demirci)</managingEditor><webMaster>metesec@outlook.com (Mete Demirci)</webMaster><copyright>© 2026 Mete Demirci</copyright><lastBuildDate>Wed, 26 Aug 2026 22:00:00 +0200</lastBuildDate><atom:link href="https://metesec.com/categories/incident-response/index.xml" rel="self" type="application/rss+xml"/><item><title>Following the Evidence Through OffSec's Dune Phantom</title><link>https://metesec.com/posts/following-the-evidence-through-dune-phantom/</link><pubDate>Wed, 26 Aug 2026 22:00:00 +0200</pubDate><author>metesec@outlook.com (Mete Demirci)</author><guid>https://metesec.com/posts/following-the-evidence-through-dune-phantom/</guid><description>&lt;p class="article-lead"&gt;Four investigations. Four completely different environments. One lesson that kept returning: follow the evidence, not the loudest alert.&lt;/p&gt;
&lt;p&gt;Over the last few weeks, I worked through OffSec&amp;rsquo;s &lt;strong&gt;Dune Phantom&lt;/strong&gt; challenge series.&lt;/p&gt;
&lt;p&gt;I considered writing four separate walkthroughs. Instead, I wanted to capture the investigation as a single story—because what made the series memorable was not any individual answer. It was how radically the environment changed from one week to the next while the investigative method stayed the same.&lt;/p&gt;</description><media:content xmlns:media="http://search.yahoo.com/mrss/" url="https://metesec.com/posts/following-the-evidence-through-dune-phantom/featured.png"/></item></channel></rss>