Introducing Andrax Pentester

Andrax Pentester is an independent cybersecurity research and education platform. We publish practical articles, tutorials, research notes, writeups, and cheat sheets for learners and working practitioners — with a growing focus on Model Context Protocol (MCP) security, alongside classic web, Linux, and Active Directory topics.

This page is the orientation guide: what exists on the site, how the sections fit together, and where to start depending on your goals. It is not a product pitch with invented metrics, customer logos, or fabricated rankings.

Why this platform exists

Security learning material on the open web is often either too shallow (tool flag dumps without methodology) or too commercial (lead-gen posts that never show a reproducible process). Andrax aims for a middle path:

• Methodology first — recon → hypothesis → evidence → impact → fix, even in short posts.
• Honest scope — lab and authorized testing only; no “hack anything” framing.
• MCP as a first-class topic — AI agent tooling introduced a new attack surface; we document it with the same discipline as SQLi or AD CS.
• Navigation that respects time — cheat sheets for recall, tutorials for practice, research for deeper mechanisms, writeups for narrative proof.

Platform map: where to start

Bookmark /learn if you prefer paths over browsing by date. Bookmark /cheatsheets if you already know the theory and need commands under pressure.

What you will find in each content type

Articles

Articles are the broadest surface: career and fundamentals pieces, deep technical guides (web, eBPF, cloud, AD), and the MCP security cluster (complete guide, tool poisoning, prompt injection / lethal trifecta, inspector workflows, Guard vs grade-only scanners). Use articles when you need context and tradeoffs, not only commands.

Tutorials

Tutorials assume you will type commands. They range from Linux and Kali setup material to hands-on GraphQL, BOLA, WebSocket, AD delegation, and MCP sandbox firewall labs. Prefer tutorials when you have a lab VM ready and a two-hour block.

Research

Research posts examine a mechanism — for example, how SPA client routing interacts with authorization boundaries. They should state methodology and limitations. Thin stubs are being expanded into real notes; treat older short research pages as drafts until they grow.

Writeups

Writeups tell a story: recon of a feature, identification of a sink, a proof-of-concept pattern, impact, and remediation. Public writeups here are anonymized / lab-styled where needed. They are teaching artifacts, not trophy lists — we do not invent bug-bounty payouts or CVE IDs.

Cheat sheets

Cheat sheets are scannable tables and command blocks (Nmap, Linux privilege escalation, MCP security). Print-friendly styling is available on cheat sheet pages for desk use during labs.

MCPGrade and the learning paths

MCPGrade is Andrax’s public-facing MCP security grading and tooling hub (start at /mcp). The educational MCP cluster explains why grades matter: poisoned tool descriptions, over-broad permissions, secret exposure, and agents that combine private data access with untrusted content and outbound communication (“lethal trifecta”).

Complementary product context lives on the Guard side (protocol-native enforcement). Andrax articles such as the Guard protocol explainer and “Guard vs grade-only scanners” describe roles without shipping Guard SDK code from this site.

The /learn hub currently groups paths around Web App Security, Active Directory, and MCP — each path links only to existing published posts so you are not sent into empty URLs.

Lab Bench

/labs hosts interactive, browser-local checklists. The first lab is the MCP Server Hardening Checklist: hygiene items you can tick off while reviewing a server before you connect it to an agent. Progress stays in your browser storage; nothing sensitive is uploaded by that UI.

How to navigate without getting lost

1. Pick a path or a question. “I need Nmap flags” → cheat sheet. “I need to understand tool poisoning” → MCP article cluster. “I need ordered study” → /learn.
2. Stay in one cluster until you can explain it aloud. Jumping between Kali install posts and MCP theory in the same hour usually means neither sticks.
3. Prefer primary posts over near-duplicates. The site historically accumulated overlapping Kali and SQLi titles; when in doubt, use the longer methodology-heavy guide and the cheat sheet, not every sibling URL.
4. Use search and the footer Intelligence links for Learn, Labs, and MCP entry points.

Brand clarity

“Andrax Pentester” (this site) is an independent research and education project. It is not the Android ANDRAX mobile pentesting distribution. If you arrived from a search result about mobile ROM tooling, see the disambiguation article Andrax Pentester vs Android ANDRAX.

What we do not claim

• We do not invent CVE identifiers, leaderboard ranks, or bounty amounts.
• We do not encourage scanning or exploiting systems without authorization.
• We do not pretend every early stub post was already a deep guide — thin pages are being expanded with real methodology over time.

Suggested first hour

1. Skim this page and open /learn.
2. Run one MCP-oriented article from the MCP path, or one web fundamentals article if you are newer to appsec.
3. Keep /cheatsheets/nmap-cheat-sheet or the MCP security cheat sheet open in a second tab while you practice in a lab.

Welcome — build skill with evidence, not theater.