Cactus Template & Markdown Reference

This post serves as a complete living reference for everything the Astro Cactus template and its Markdown engine can do. Use this page as a cheat sheet and boilerplate when drafting advisories, write-ups, and technical research notes.

Frontmatter Reference

Every post starts with a YAML frontmatter block enclosed by triple dashes (---). The supported schema fields defined in src/content.config.ts are:

---
title: "Title Here (Max 60 Characters)"
description: "A concise summary for previews, RSS, and SEO."
publishDate: "18 Oct 2026"
updatedDate: "19 Oct 2026" # Optional: displays modified date
tags: ["redteam", "research"] # Array of tags, lowercased automatically
pinned: true # Optional: pin to the top of post listings
draft: false # Optional: hide from production builds
ogImage: "/social-card.png" # Optional: custom Open Graph image path
# coverImage: # Optional: hero image
#   src: "./cover.png"
#   alt: "Cover description"
---

Admonitions (Callout Boxes)

Astro Cactus includes the satteriAdmonitionsPlugin, providing built-in directive callouts via triple colons (:::).

Supported Types

Note

:::note
Informational note highlighting context readers should keep in mind.
:::

Tip

:::tip
Helpful recommendation or operational best practice.
:::

Important

:::important
Crucial technical information or operational requirement.
:::

Caution

:::caution
Potential unintended side-effects or operational risks.
:::

Warning

:::warning
High-severity warning demanding immediate attention before proceeding.
:::

Custom Admonition Titles

Append square brackets immediately after the directive name to override the default title label:

:::important[Rules of Engagement (RoE)]
Ensure written authorization has been obtained prior to executing payloads on target infrastructure.
:::

Code Blocks & Expressive Code

Astro Cactus uses Expressive Code with dual-theme support (dracula for dark mode and github-light for light mode).

Syntax Highlighting with File Titles

Add title="filename.ext" to the code fence to render an authentic terminal/editor title tab:

import ldap3

def query_domain_admins(server_ip, domain, username, password):
    server = ldap3.Server(server_ip, get_info=ldap3.ALL)
    conn = ldap3.Connection(server, user=f"{domain}\\{username}", password=password, auto_bind=True)
    conn.search("DC=corp,DC=local", "(&(objectClass=user)(memberOf=CN=Domain Admins,*))")
    return conn.entries

Diff Highlighting (ins and del)

Highlight inserted and deleted lines using ins={lines} and del={lines}:

# Deprecated default jitter
set jitter "5";
# Stealth jitter profile for evasion
set jitter "35";
set useragent "Mozilla/5.0 (Windows NT 10.0; Win64; x64)";

def authenticate(token):
    if token == "hardcoded_backdoor": # Vulnerable legacy logic
    hashed_input = hash_token(token)
    if secure_compare(hashed_input, EXPECTED_HASH):
        return True
    return False

Line Markers & Highlighting

Highlight specific lines using {line_numbers}:

#!/usr/bin/env bash
TARGET="target-corp.com"
echo "[*] Enumerating subdomains for: ${TARGET}"
subfinder -d "${TARGET}" -silent | httpx -silent -status-code -title
echo "[*] Probing open perimeter services..."
nmap -sS -T4 -p 80,443,8443,8080 -Pn "${TARGET}"

Terminal Commands

Code fences without file titles format cleanly as terminal execution blocks:

curl -s -k https://darkocelot.com/api/v1/telemetry | jq '.status'

GitHub Cards

The satteriGithubCardPlugin renders dynamic repository and user cards loaded via the GitHub API.

Repository Card

::github{repo="chrismwilliams/astro-theme-cactus"}

User Card

::github{user="withastro"}

Footnotes & References

Create linked references using standard markdown footnote syntax [^label]. Satteri automatically renders anchor jump links and back-references at the bottom of the article.

Here is an assertion regarding evasion telemetry¹, followed by an observation on credential boundary tiering².

Typography & Formatting

Headings & Auto-Generated Anchor Links

All H2 through H6 headings automatically generate URL slug anchor IDs (#) and populate the sticky Table of Contents (TOC) component on the side:

## Heading 2
### Heading 3
#### Heading 4

Text Emphasis

• Bold text: **Bold text** or __Bold text__
• Italic text: *Italic text* or _Italic text_
• Bold & Italic: ***Bold & Italic***
• Strikethrough: ~~Strikethrough~~
• Inline code: `inline code`

Keyboard Shortcuts (<kbd>)

Use <kbd> elements to style terminal and operating system key combinations:

• Open Search: Ctrl + K (or Cmd + K on macOS)
• Terminate payload process: Ctrl + C
• Toggle full-screen debugger: F11

Blockquotes & Nested Quotes

Standard quote:

“Security is not a product, but a process.” — Bruce Schneier

Nested quote:

Initial perimeter breach detected at 03:14 UTC.

Operator escalated to Domain Controller via Kerberoasting ticket reuse.

Lists & Checklists

Unordered & Nested Lists

• Reconnaissance
  • Passive OSINT
  • Certificate Transparency logs
  • Subdomain brute-forcing
• Initial Access
  • Phishing & Device Registration
  • External perimeter vulnerability exploitation

Ordered Lists

1. Scoping & Rules of Engagement definition
2. Threat actor profile selection
3. Covert execution and payload staging
4. Debrief, log analysis, and blue team retesting

Task Checklists (GFM)

• Scope verification and authorization letter signed
• Out-of-band de-confliction channel established
• Initial perimeter attack surface mapped
• Active Directory privilege escalation path executed
• Goal achievement and simulated flag exfiltration

Tables & Alignment

Tables format cleanly with custom border rules and typography.

Column Alignment Syntax

• Left align: :---
• Center align: :---:
• Right align: ---:

Images

Standard markdown image syntax is fully supported:

![Dark Ocelot Logo](/logo_white.svg)

Relative images co-located inside the post directory or static files in /public render with responsive styles and image optimization:

External & Internal Links

• Internal Links: Use standard root-relative paths like [Home](/), [About](/about/), or [Blog](/posts/).
• External Links: Links like [MITRE ATT&CK](https://attack.mitre.org/) are automatically processed by the satteriExternalLinksPlugin to include secure attributes (rel="noopener noreferrer").