Introduction

One of the most common questions I get from readers (besides asking for my CPTS study notes, which I’ll publish eventually) is how I built this very website you’re browsing.

The short answer is that I used the Hugo web framework along with a fairly customized version of the PaperMod theme. I then purchased a domain from NameCheap and hosted the site on Cloudflare Pages.

However, since this is a cybersecurity blog, I should mention that you could actually discover all this information yourself by enumerating the website.

How to footprint this website’s technology stack

By examining the communication between your web browser and the web server, you can uncover details hidden behind the scenes.

For instance, when you request something from my website, the HTTP header reveals the server header, which indicates cloudflare. This header shows the software used by the origin server to handle the request and generate the response, confirming that Cloudflare hosts this site.

[user@mydesktop ~]$ curl -I https://www.brunorochamoura.com/
HTTP/2 200 
date: Sat, 12 Oct 2024 15:51:10 GMT
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ty0ZzgGEXzgwop791Zir7xyggcMZhwkKbR%2BG7wawgTkz1HWk69u17rT7OjrH%2BrNn3TUknuHMgPSdFKx92dtJhvTpTE5%2F5HZIOougt7N0QRo%2FVXuBUGEUZ7AR4ilW1TBbPod5Y9sEt0nup0SH3f0xcoiu4m0tlQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
speculation-rules: "/cdn-cgi/speculation"
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8d183ff4bf332150-MAD
alt-svc: h3=":443"; ma=86400

Additionally, we can often gather information from the HTML page itself. In my case, the document’s head includes a tag that discloses the Hugo version used to generate the page.

[user@mydesktop ~]$ curl https://www.brunorochamoura.com/ 
<!DOCTYPE html>
<html lang="en" dir="auto">

<head>
	<meta name="generator" content="Hugo 0.121.2"><meta charset="utf-8">
<SNIP>

Manual enumeration isn’t always necessary. CLI tools like WhatWeb or the Wappalyzer browser extension can automatically identify common web technologies for you.

For information about the domain name provider, you can query the WHOIS database. This reveal that my website’s domain provider is Namecheap.

[user@mydesktop ~]$ whois brunorochamoura.com                  
   Domain Name: BRUNOROCHAMOURA.COM
   Registry Domain ID: 2841795135_DOMAIN_COM-VRSN
   Registrar WHOIS Server: whois.namecheap.com
   Registrar URL: http://www.namecheap.com

The PaperMod theme, which is a bit trickier to detect, could have been uncovered by examining the CSS file.

This should go without saying, but be careful when enumerating hosts you don’t have permission to probe. What I covered here is generally safe, but more aggressive methods can get you into trouble.

In this post, I’ll cover how I developed and hosted my website for very cheap and without too much hassle.

Hugo

Hugo is an open-source web framework for building static websites written in Go.

Hugo works by letting you write the content for your site in Markdown files while using a theme to define the site’s appearance. Hugo then processes these Markdown files, merges them with the theme, and generates a set of static HTML, CSS, and other assets that form the final website.

Hugo’s main benefit for us is that we won’t need a dynamic web server to host the site since it consists entirely of static files that can be served directly, which makes deploying it easier.

Demonstration on how the markdown file gets turned into an HTML page.

Demonstration on how the markdown file gets turned into an HTML page.

To get started with Hugo, you should read the official documentation. A good place to start is the Quick Start article, which will walk you through creating a Hugo project.

You can get a decent overview of the fundamentals in just 152 seconds with this video (not quite 100 seconds).

If you’re looking for something more in-depth, check out Luke Smith’s longer video.

PaperMod

Hugo themes are essentially templates that define the HTML and CSS structure of the website’s pages, determining where the content is injected when Hugo builds the site and generates the static files.

Of course, you can develop your own theme from scratch if you have a solid understanding of web development and how Hugo’s theme engine works. However, most of us are perfectly happy with choosing one from the many high-quality themes curated by the Hugo authors. Plus, you can always customize these themes to make them your own.

Some of the themes on themes.hugo.io.

Some of the themes on themes.hugo.io.

The theme I chose for my blog is called PaperMod. It’s one of the most popular Hugo themes, and you’re likely to come across many websites using it.

It is very customizable, so you can fairly easily modify it to make it look different from other blogs using this theme, especially if you take a look under the hood and make your own changes, like I did. It’s not hard if you have a decent grasp of web development.

Again, refer to the official Hugo documentation on how to use a theme for your own project and how it works if you want to make your own modifications.

Set up a Hugo project and experiment with it locally until you’re satisfied with it. Once it looks the way you want, you can proceed with deploying it online.

Cloudflare Pages

As I mentioned, one of the main benefits of Hugo is that while it is very flexible and customizable, by the point you build your website it is nothing more than static files. This makes it so you don’t need a VPS to host your website, which opens a lot of options for cheap hosting.

There are some criticisms to be made about Cloudflare and its impact on the Internet. However, they do offer free hosting for static websites through their Cloudflare Pages product, and the price of free is hard to beat. So, I decided to use that for now until I find someplace else to host it.

Cloudflare has an article in their official documentation detailing how to go about deploying Hugo with Cloudflare Pages. It’s so simple you can’t go wrong, but if you want the key points:

  1. Host your Hugo project in a GitHub repository.
  2. Connect your Cloudflare account to your GitHub profile through the Cloudflare dashboard and select the repository you want to deploy.
  3. Cloudflare will automatically set up a CI/CD pipeline to automate the deployment of your Hugo project.

Just like that, your Hugo site will be live. Plus, whenever you make a change and commit it to your remote repository, the pipeline will trigger a new build, ensuring your site is updated within seconds.

Domain Name

So far, we have successfully deployed a static website at no cost. However, one downside is that the URL for our blog will look something like https://*.pages.dev, which is a little ugly.

You can easily improve this by purchasing a domain name. Domain names usually cost literal pocket change, so once you find one you like that isn’t already taken, it’s a good idea to buy it to ensure it doesn’t get snatched up by someone else.

There are plenty of registrars to choose from when buying your domain. Personally, I went with Namecheap, and it lived up to its name. I got brunorochamoura.com for an entire year for less than six euros.

Once you’ve purchased your domain name, you can easily link it to your Cloudflare Page by following the video tutorial below:

Conclusion

Having your own cybersecurity blog is, in my opinion, one of the best value-for-effort ways to boost your appeal to recruiters, especially if you have little or no professional experience in the field.

Take your time exploring the resources mentioned here, and before you know it, you’ll have your own blog up and running. If you decide to create one after reading this post, feel free to email me the link.

For those looking to carve out their own space on the internet, I highly recommend Luke Smith’s site about self-hosting. Setting up your own server instead of relying on Cloudflare Pages lets you host a bunch of cool services, like an email server, cryptocurrency nodes, game servers, and more. Definitely give it a look if you’re into that kind of stuff.