How ICS and SCADA environments actually get breached, network segmentation, weak authentication, unpatched legacy software, thin monitoring, and vulnerable remote access, paired with the real incidents (Triton, Mirai, WannaCry, Stuxnet, Oldsmar, the Ukrainian grid attack) that show each failure mode in production.
A specialized guide for Red Team operators on exfiltrating and migrating data from a target MySQL database to a local PostgreSQL instance. Learn how to use Docker for rapid infrastructure deployment, pgloader for automated schema conversion, and handle both live network migrations and offline dump analysis.
A guide to SSH multiplexing and master control sockets for red team work. Covers running concurrent sessions over a single TCP connection, reducing connection churn, and the risks of socket hijacking.
Comprehensive guide to Bash scripting fundamentals with security best practices, modern techniques, and ethical penetration testing examples for red team professionals.
Apple from the garage to the present, told as a story. The Apple I and II, the Lisa and the first Macintosh, the Dark Ages and the clone era, the NeXT acquisition that brought Steve Jobs back, the PowerPC and Intel transitions, and the iPod-iPhone-iPad run that followed.
A long look at Unix from its 1960s origins through commercial AT&T System V, the BSD lineage, Linux, the modern Unix-derived stack underneath everything from macOS to cloud containers, and the security debt that comes with a 1970s permission model still running in 2026.
Threat hunting is the proactive search for adversary activity that automated detections missed. This post covers the hunting loop (hypothesis, investigation, verification, feedback), the four standard hunting surfaces (network, endpoint, log, threat intelligence), the current tooling (Zeek, Suricata, Velociraptor, OSQuery, Sigma, MITRE ATT&CK), and the operational patterns that turn one-off hunts into a detection engineering program.
Wireshark and tcpdump are the two packet-analysis tools every network defender, incident responder, and pen tester ends up using. This post covers modern capture workflow (non-root operation, display and BPF filters, TLS decryption via SSLKEYLOGFILE, SSH remote captures) with concrete examples for both tools.
A working knowledge of the DOM matters on both sides of a web security engagement. This post covers the modern DOM APIs (querySelector, classList, dataset, event listeners), the DOM-based XSS patterns to recognize during code review, and the safer alternatives (Trusted Types, sanitization APIs) that defenders should reach for.
The Commodore 64 shipped over 17 million units, taught a generation how computers actually worked, and seeded the demo scene, chiptune, and early BBS hacker culture. This post traces its arc across five phases, from the calculator wars that produced MOS Technology to the modern FPGA implementations that keep the platform alive four decades later.
Serverless functions shift infrastructure responsibility to the provider but leave application code, IAM policies, and resource configurations in your hands. This post covers the common misconfiguration classes (function-level, resource-level, infrastructure-level), the tooling that catches them (Checkov, Prowler, ScoutSuite, Trivy), and the attack surfaces unique to serverless (event injection, denial-of-wallet).
This article explores advanced object-oriented programming concepts in Python, such as decorators, inheritance, abstract base classes, composition, aggregation, and properties, with practical code examples tailored for security engineers building analysis, detection, and instrumentation tools.
An analyst-facing tour of the obfuscation techniques that show up in real malware samples, code, binary, and anti-analysis, with real-world examples and the modern EDR context that shapes how obfuscation actually works in the wild today.
A working overview of the NIST Cybersecurity Framework (six functions after CSF 2.0), ISO/IEC 27001:2022 (10 clauses plus 93 Annex A controls in 4 themes), and CIS Controls v8/v8.1 (18 controls organized by Implementation Group), including how they fit together and where each earns its keep in real security programs.
This article provides a comprehensive overview of wireless security, including technical details of wireless networking, best practices for securing wireless networks, common attacks, social engineering tactics, wireless network penetration testing, regulatory compliance, and the future of wireless security.
This article covers the powerful metaprogramming techniques in Ruby, including method_missing, define_method, dynamically defining classes and modules, and executing code dynamically with eval, that allow writing code that writes code to make programs more flexible, dynamic, and powerful.
How Linux and the open-source movement grew out of 1990s proprietary-software dominance, from the GNU Project and the Linux kernel through the LAMP stack, Netscape’s source release, the SCO lawsuit, and Red Hat’s rise, plus what it means for security when critical infrastructure like OpenSSL runs on volunteer maintenance.
This article explores the importance of TTP (tactics, techniques, and procedures) analysis in detecting and mitigating cyber threats, including its role in guiding investigations, assisting in attribution, and informing predictive analysis, using examples of TTP analysis in well-known attack campaigns.
This article explains Scenario-Based Testing (SBT) in detail, its benefits, tools and techniques used, and provides examples of how SBT can be used in Red Team Exercises to identify vulnerabilities and weaknesses in an organization’s security defenses.
This article provides an in-depth overview of advanced malware analysis techniques, including manual and automated disassembly, decompilers, debuggers, and dynamic binary instrumentation (DBI), with examples of tools and outputs provided for each technique.
This article is an introduction to the Lua programming language for pen testers and red team members, covering its basic concepts and syntax, examples of its use in network analysis, password cracking, and web scraping, and weighing its pros and cons compared to other languages.
This article is a comprehensive overview of the history and evolution of the x86 architecture, including its predecessors, competitors, and its significance to cybersecurity.
How application layer firewalls inspect traffic beyond IP and port, protocol analysis, content filtering, application identification, behavioral analysis, and deep packet inspection, plus the tools for testing whether one actually holds up.
PowerShell for operators. The syntax you actually need, working examples for a port scanner, a hash-cracking loop, and a web crawler, and an honest take on where PowerShell fits and where it gets you caught on a Windows engagement.
The CTI lifecycle from an operator’s seat. Setting collection requirements, OSINT and closed-source gathering, kill-chain and Diamond Model analysis, STIX/TAXII dissemination, and feeding real adversary TTPs back into red team planning.
This article explores advanced heap spraying techniques used by red teams and pen testers to exploit vulnerabilities in software applications, including non-ASLR and ASLR-based heap spraying, and Unicode heap spraying, with real-world examples and tools.
A defender’s field guide to threat hunting and incident response: behavioral analysis and UEBA, EDR, network traffic analysis with Zeek, the ELK stack, Sysmon on Windows, and the commercial SIEM/EDR/NSM tooling you actually run. Plus what Target, Equifax, and NotPetya taught defenders about detection.
How IBM lost control of the PC standard it created, traced from Hollerith’s punch cards and the System/360 through Compaq’s clean-room BIOS, Phoenix, and the Apple v. Franklin ruling that made cloning legal, and why that open architecture still drives firmware and supply-chain security today.
This article explores advanced memory forensics techniques for detecting malicious activity in memory, including process timelining, high-low level analysis, walking the VAD tree, and detecting rogue processes, kernel-level rootkits, DLL hijacking, process hollowing, and sophisticated persistence mechanisms.
This article explores the prevention techniques for Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS) attacks in web applications, providing real-world examples, and includes code samples in various web programming languages.
BloodHound is a powerful tool for analyzing Active Directory environments, helping red teamers and pen testers visualize complex relationships, identify security risks and attack paths, and develop effective mitigation strategies to strengthen an organization’s security posture.
Part three of the Red Team Operations series. How operators simulate supply chain attacks on engagement, the canonical real-world case studies that justify the budget (SolarWinds, NotPetya, CCleaner, Kaseya, Codecov, 3CX, MOVEit, XZ Utils), the engagement-scoping considerations that make supply-chain testing different from regular red team work, and the defender controls (SBOM, signing, build provenance via SLSA, dependency review) that actually move the needle.
A working tour of Kotlin from a security perspective. Language basics for operators who haven’t written Kotlin before, the Android RE reality (Kotlin became Google’s first-class Android language in 2017 and most modern Android apps you reverse-engineer are now Kotlin), the operator-side applications that make sense in Kotlin versus the ones that don’t, and the trade-offs versus Java, Python, and Go for offensive work in 2026.
Story Time with Uncle Sp1d3r on the five-year speculative frenzy that taught the world the internet existed, then taught Wall Street that “eyeballs” wasn’t a financial metric. The technical infrastructure that survived (HTTP, DNS, SSL, the search-engine architecture, the e-commerce stack), the famous failures (Pets.com, Webvan, Boo.com, Kozmo), and the security shortcuts that the era baked into systems we still operate.
The defender-side companion to the IoT hacking post. What actually works for securing IoT devices in 2026, organized around the controls operators look for during testing (secure boot, signed firmware updates, TLS 1.3 with mutual auth, credential management, IoT-VLAN segmentation, anomaly detection). Includes the canonical IoT vulnerability families (Ripple20, URGENT/11, Name:Wreck, AMNESIA:33), the modern IoT-specific monitoring platforms (Armis, Forescout, Claroty, Nozomi, Microsoft Defender for IoT), and the Matter protocol that’s finally bringing baseline crypto identity to consumer smart-home devices.
A working operator’s tour of IPS and IDS in 2026. The three detection models (signature, anomaly, behavioral), how IPS gets deployed (inline, passive, hybrid), where it sits on the network, the open-source stack (Snort 3, Suricata, Zeek the renamed Bro), the commercial NGFW market (Cisco, Palo Alto, Fortinet), the testing tradecraft operators use to evaluate IPS deployments, and the shift toward NDR products as IPS evolves.
A working tour of Cody Thomas’s Mythic C2 framework. Architecture (Docker-deployed server plus pluggable agents and C2 profiles), the actual current agent lineup in 2026 (Apollo, Poseidon, Apfell, Athena, Xenon, Medusa, Thanatos, Freyja, Sage), the install workflow with mythic-cli, how Mythic compares to Sliver, Cobalt Strike, and Havoc, and where it fits in a modern engagement stack.
An operator-relevant tour of cloud security in 2026. The shared-responsibility model, the controls that actually matter (IAM, encryption, network isolation, logging), the findings that show up on every engagement (misconfigured S3, IMDS abuse, over-privileged IAM roles, public Kubernetes consoles), the modern tooling stack (Prowler, ScoutSuite, Steampipe, commercial CSPMs), and corrected versions of the canonical case studies (Capital One, Tesla, Marriott, Deep Root, Docker Hub).
A working tour of C from a security perspective. Language basics for operators who haven’t written C since college, then the offensive applications that make C indispensable (writing exploits against C-language vulnerabilities, crafting shellcode, building low-level tools and implants), reverse engineering of compiled C binaries, and the trade-offs of C versus modern alternatives (Rust, Go, Python) for operator work in 2026.
Story Time with Uncle Sp1d3r on the half-century history of the medium most of us still spend half the day in. Tomlinson and the @-sign, Postel and SMTP, the listserv era, the AOL/CompuServe walled gardens, Hotmail and Gmail, the BlackBerry years, MIME and multimedia mail, and the security battles that email has been winning and losing in cycles since the very first spam in 1978.
This article introduces and explains exploit development techniques, best practices, and examples for a technical audience of red teams and pen testers.
Operator-side walkthrough of targeted phishing. OSINT-driven target research, Cialdini’s principles applied to email lures, the technical kit (GoPhish, Evilginx, SET), what whaling actually means (and doesn’t), the mistakes that get phishing campaigns caught, and corrected case studies (the 2016 Podesta phish, the Bangladesh Bank heist, the 2023 Scattered Spider helpdesk vishing of MGM and Caesars).
A working overview of SharpSocks, Nettitude’s .NET tool for tunneling a SOCKS proxy through an implant inside the target network. Architecture, deployment, how it pairs with PoshC2 and other frameworks, the pivoting patterns operators actually use it for, and how it compares to modern alternatives (Chisel, ligolo-ng, gost) in 2026.
An operator’s walkthrough of red team engagement types (network pentest, social engineering, physical, red-vs-blue, purple team, multiscenario, full spectrum, tabletop), the five-phase methodology that structures most engagements (recon, scanning, exploitation, post-exploitation, reporting), the actual tooling stack at each phase, and the case studies (DoD Cyber Flag, Verizon DBIR-derived attack-pattern data) worth grounding the work in.
A working tour of Swift from a security perspective. Language basics for operators who haven’t written Swift before, then the offensive applications that matter on Apple platforms (network primitives via the Network framework, port scanning with NWConnection, hashing with CryptoKit and SwiftCrypto, file-system reconnaissance, OSINT-style API consumption, basic TCP listeners, payload encoding), and the trade-offs of Swift versus Python, Go, and Rust for operator use in 2026.
Story Time with Uncle Sp1d3r on the half-century evolution of the medium that taught most of us what a computer was for. Four phases that mattered, arcade through modern, with the technical and cultural detours that made each one work, plus the cybersecurity industry that grew up alongside the games as a parallel cottage industry of cheats, account theft, DDoS extortion, and (more recently) million-dollar ransomware against game studios.
A working analyst’s tour of dynamic malware analysis. Static triage of the PE header in PEStudio and Detect It Easy, unpacking with x64dbg and Scylla, memory forensics with Volatility 3, VBA macro de-obfuscation with olevba, network monitoring with Wireshark, and the anti-analysis tricks (PEB checks, RDTSC timing, MAC address sniffing, sandbox-detection via mouse movement) that modern families ship by default. Case studies include WannaCry, TrickBot, and Emotet.
An operator’s tour of physical pen testing tradecraft. Social engineering and pretexting, lock picking and bypass, RFID and NFC cloning with the Proxmark3 and Flipper Zero, Wiegand attacks with BLEKey/ESPKey, surveillance and counter-surveillance, network dropboxes (Hak5 LAN Turtle, Packet Squirrel), HID attack tools (Bash Bunny, Rubber Ducky), and the USB-drop technique. Closes with the Coalfire Iowa courthouse arrest as a worked example of why authorization scope matters.
A working tour of Ryan Cobb’s Covenant C2 framework from an operator’s perspective. Architecture (server, Grunts, listeners, dynamically compiled .NET tasks), AMSI and ETW patching as a survival prerequisite on modern Windows, SMB named-pipe P2P routing for jumping into segmented zones, Donut shellcode wrapping for non-.NET payloads, and writing custom tasks. Covenant is effectively unmaintained, but the design choices it pioneered are still in Sliver, Mythic, and Havoc.
A working tour of IoT hacking from an operator’s perspective. Hardware attack surface (UART, JTAG, SPI flash dumps), firmware extraction and emulation with binwalk and qemu-user-static, radio attacks (SDR replay, BLE GATT writes, Zigbee key sniffing), the CAN bus and SocketCAN on automotive targets, and exposed MQTT brokers. Closes with Mirai, the Jeep Cherokee remote takeover, and Rose & Ramsey’s BLE smart-lock work at DEF CON 24.
A working tour of Java from a security perspective. Language basics for operators who haven’t written Java before, then the offensive applications that matter (network scanning, web exploitation, Burp extensions, Java deserialization, JNDI injection and the Log4Shell era), reverse engineering of obfuscated Java with CFR and JADX, and the trade-offs of Java versus other languages on offensive engagements.
The full arc of the internet’s history, from ARPANET and packet switching through the BBS era, Usenet, the Web at CERN, the commercial online services (AOL, CompuServe, Prodigy), search engines, the Napster era, mobile, cloud, IoT, and the cybersecurity history (Morris Worm, BGP hijacking, Kaminsky DNS) the modern operator still inherits.
A working operator’s view of ransomware in 2026. How the RaaS model splits the work between operators and affiliates, the double- and data-only extortion patterns that replaced “just encrypt the files,” the state of the ecosystem after Operation Cronos took down LockBit and ALPHV exit-scammed itself, what reverse engineering a current sample actually looks like, and the incident response sequence when the ransom note lands.
A working operator’s view of firewall and IDS bypass in 2026. Fragmentation and decoy scanning against weak setups, DNS and ICMP tunneling where the channel is still open, SSH SOCKS proxying for quick pivots, Chisel and Ligolo-ng for serious tunneling work, and the realities of domain fronting now that the major CDNs have killed it. Plus what modern next-gen firewall and IDS technology (TLS inspection, JA3/JA4 fingerprinting, ECH) leaves open for the operator and what it doesn’t.
A working operator’s view of Nishang, the PowerShell post-exploitation toolkit Nikhil Mittal built starting in 2012. What it does well, where Defender catches it on sight in 2026, which modules still matter, and how it fits with modern frameworks (Empire 5.x, Sliver, Mythic). Plus an operator-honest read on AMSI and Constrained Language Mode and what they leave behind for stock PowerShell tools on a current Windows endpoint.
A working operator’s view of CSRF and XXE in 2026. Where the classic attacks still work, where browser defaults (SameSite=Lax in Chrome/Edge, secure-by-default XML parsers) have closed the textbook cases, and the modern attack surfaces that still produce findings (GET state-change endpoints, JSON content-type confusion, SVG and OOXML file upload, SAML implementations, the SysAid CVE-2025-2775 XXE-to-RCE chain).
A working operator’s view of Go as the target-side language of choice. Cross-compilation for any OS from any host, statically linked binaries with no runtime dependencies, native Win32 calling, and the modern C2 agent ecosystem that runs on it (Sliver, Havoc’s Go agent). Plus the realities of Go in 2026, the static fingerprints EDR uses to identify it on disk, and what garble and -trimpath do (and don’t) help with.
A storyteller’s tour of the graphics card, from the oscilloscope-style vector monitors that drew Asteroids and the SGI workstations that rendered Jurassic Park, through the 3dfx Voodoo and the GeForce 256 that gave us hardware T&L, into the CUDA era when NVIDIA quietly turned the gaming GPU into the most-shipped parallel math processor in computing. With the security-side punchline: the same architecture that draws Cyberpunk in real time also runs Hashcat at hundreds of gigahashes per second.
A working operator’s view of what an incident responder finds when they run Volatility on a memory image. The plugins that hunt your beacon (pslist, psscan, malfind, netscan, windows.cmdline), the modern tradecraft that survives them (sleep masking via Ekko/FOLIAGE, module stomping vs phantom DLL hollowing, indirect syscalls), and the 2025-2026 changes that have made some of the old tricks stop working: Credential Guard, HVCI, ETW-based command line capture.
A working operator’s view of pretexting in 2026. Cialdini’s six (plus one) principles applied to actual engagements, building a legend that survives a target’s google check, handling the “let me verify with my manager” pushback, and the modern state of the discipline after Scattered Spider’s MGM/Caesars helpdesk attacks, AI voice cloning, STIR/SHAKEN, and AiTM kits eating MFA fatigue’s lunch.
A working tour of the BC Security Empire fork in 2026. Listeners, stagers, and the four agent types Empire ships today (PowerShell, Python, IronPython, and Sharpire/C#). Plus an honest read on where Empire still earns its keep in 2026, where Sliver and Havoc have eaten its lunch, and what AMSI evasion actually looks like now that Defender has shipped signatures for the obvious bypasses.
A working operator’s look at the layer 2 and layer 3 attacks that actually move an engagement forward: IPv6 shadow networks and mitm6/ntlmrelayx, NAC bypass against modern profiling-aware appliances, DTP and double-tagging VLAN hopping, and HSRP/VRRP gateway hijacking with Loki. Plus the 2024–2026 defender changes (Server 2025 EPA, LDAP channel binding) that have made some of these noisier.
A working tour of the Python that matters on offensive engagements. Raw sockets, binary parsing with struct, ctypes for Win32 calls and shellcode loaders, Scapy for packet crafting, and the current state of the libraries every operator ends up writing on top of (Impacket, NetExec, pwntools, mitm6).
A look back at the Millennium Bug as the largest successful preventative engineering project in computing history. Why the two-digit year was an economic decision rather than laziness, how the fixes actually worked (date expansion, windowing, bridging), what did break at midnight on January 1 2000, and what the same pattern looks like for the 2038 Unix time_t overflow that’s coming for embedded Linux next.
A working primer on static and dynamic PE analysis from the operator’s seat. What an EDR actually sees when your payload lands on disk, why your IAT and entropy and PDB paths are doing most of the talking, and a self-audit loop that catches the obvious tells before the payload ever touches a customer machine.
A working operator’s view of password cracking past rockyou.txt. Building a dedicated GPU rig (and when to burst to cloud), tuning Hashcat for fast and slow hash types, generating context-specific wordlists with CeWL and PRINCE, and writing rules that target how humans actually compose passwords inside an enterprise.
A walk through the modern phishing campaign architecture from an operator’s seat. Domain warming, redirector tiers, ASN and geo cloaking, CAPTCHA gates to defeat sandbox click-time URL scanning, HTML smuggling via the Blob API, SVG smuggling, and homograph tricks. Plus the current state of the arms race in 2026 with AiTM kits like Tycoon and EvilProxy, and what defenders should actually focus on.
A Rails primer for operators who need to assess or exploit a Rails application. Covers the MVC layout that tells you where the bugs live, strong parameters and the permit! footgun, what SECRET_KEY_BASE actually gives you on modern Rails versus the classic Marshal RCE chain on Rails 3, the raw/html_safe XSS surface, IDOR patterns, and the static-analysis tools (Brakeman, bundler-audit) that should be your first pass.
How Netscape Navigator went from 80% market share to bankruptcy in roughly twelve years, the technologies it left behind (SSL, JavaScript, cookies, the same-origin policy), the 1995 Goldberg–Wagner RNG break that ended “the algorithm is strong” as a defense, Microsoft’s antitrust-defining “cut off air supply” campaign, and what survives of Netscape in the modern browser stack a working operator interacts with every day.
How a stack-based buffer overflow actually corrupts a stack frame, what the classic mitigations (ASLR, DEP/NX, stack canaries) do and how each gets bypassed, why modern Windows and Linux added more layers (CFG, CET shadow stacks, PIE, PAC), and the development workflow for writing a first exploit against an unhardened target. Aimed at operators who’ve used Metasploit but never written an exploit from scratch.
A working operator’s view of red teaming versus pen testing, the Unified Kill Chain as a practical mental model rather than a theoretical framework, how modern C2 infrastructure is actually built (and why domain fronting isn’t the answer anymore), purple teaming as collaborative tuning, deconfliction with the white cell, and the operator-side OPSEC habits that decide whether you finish the engagement quietly.
A working operator’s guide to Metasploit. Covers the module taxonomy, why you actually want the database initialized, staged vs non-staged payloads and when each one matters, Meterpreter’s load-bearing extensions (stdapi, kiwi, incognito, priv), pivoting (autoroute, portfwd, SOCKS), and resource scripts for the listener setup you’d otherwise type a hundred times an engagement.
A working guide to social engineering for red team engagements. Covers Cialdini’s six principles of persuasion as they’re actually used in pretexting, OSINT for building a credible story, Adversary-in-the-Middle phishing against MFA-protected accounts, MFA fatigue, vishing, physical entry, and how to write findings up without throwing individual employees under the bus.
A guide to using Nim for offensive tooling. Covers language fundamentals, the winim WinAPI bindings, compile-time string obfuscation with macros, direct syscall stubs, the offensive Nim ecosystem (OffensiveNim, NimlineWhispers, Nim-RunPE, NimPackt, Nimcrypt2), and an honest take on what edge Nim actually still gives you against modern EDR.
PE/ELF/Mach-O structure, x86/x64 assembly, disassembly versus decompilation, dynamic analysis with debuggers and Frida, and the anti-RE tricks you’ll meet on the way.
Past nmap -sC -sV — TCP/IP behavior that shapes scan results, NSE for real enumeration, IDS-aware timing, packet-level evasion, and where RustScan and Masscan are actually faster.
Manual UNION-based exfiltration, error-based and blind SQLi, WAF evasion, out-of-band data theft over DNS and HTTP, second-order injection, and the sqlmap flags that matter on real engagements.
A comprehensive deep-dive into the Rust programming language for offensive security. Learn the core concepts of ownership and borrowing, master idiomatic error handling, build a multi-threaded port scanner, and discover how to use “Unsafe Rust” for shellcode injection and high-performance exploit development.
A comprehensive deep-dive into the history and evolution of the computer mouse. From Douglas Engelbart’s wooden prototype to modern laser sensors and wireless HID attacks, we explore the tech that changed how we interact with machines - and the security implications of implicit peripheral trust.
A deep-dive into XSS from an offensive perspective. Beyond alert(1) — cookie theft, weaponized BeEF hooks, blind XSS, and bypassing modern WAFs and CSPs.
An introduction to penetration testing for people getting into the field. The differences between VA, PT, and red teaming; PTES as a workflow; what actually goes into a good report; and the legal lines you can’t cross.
A guide for red team operators coming from Linux. Where Darwin differs from Linux at the userland and kernel level, how SIP and TCC change what root means, how to live off the land with JXA and AppleScript, and how to persist with launchd.
A deep-dive into PsExec for offensive work. How it works under the hood, how to leverage pass-the-hash with Impacket, service-name evasion, and the forensic footprint it leaves so you know when to reach for it and when to reach for something else.
A deep-dive into sc.exe for offensive work. Weaponize the Windows Service Control Manager for remote code execution, persist via service failure actions, exploit weak service ACLs, and load kernel drivers.
A deep-dive into Wmic for offensive work. Interrogate system internals, move laterally, find security software, abuse XSL transforms for code execution, and understand the forensic footprint WMI leaves behind.
A deep-dive into microcode. How it works, why updates aren’t persistent, where the cryptography is (and isn’t) bulletproof, and why microarchitectural attacks like Downfall and Zenbleed keep happening.
A guide to Active Directory reconnaissance with built-in tooling. Discover privileged accounts, identify service accounts, spot unconstrained delegation, and operate when RSAT isn’t installed.
A comprehensive deep-dive into advanced Windows command-line tools. Learn how to leverage modern binaries like curl and tar, abuse legacy tools for download and execution, and perform stealthy data theft and persistence without triggering alerts.
A practical walkthrough of Chisel for tunneling — reverse SOCKS, port forwarding, TLS hardening with a real cert, source-level evasion tweaks, and how it compares to Ligolo-ng.
How Pass-the-Hash actually works against RDP — what makes it normally fail, why Restricted Admin Mode flips that around, the correct xfreerdp syntax, RDP-over-SOCKS tuning, and the Logon Type 3 anomaly that gives the technique away.
A working guide to network tunneling for offensive ops — iptables NAT, every flavor of SSH forwarding (including reverse SOCKS and ProxyJump), Windows netsh portproxy, socat, and the modern compiled tools that have largely replaced everything else (Chisel and Ligolo-ng).
A red team walkthrough of Impacket’s mssqlclient.py — discovery, every common auth method, RCE via xp_cmdshell / OLE Automation / CLR, hash capture via xp_dirtree, linked-server hops, file transfer over TDS, and finding the data that actually matters.
A walkthrough of Impacket’s SMB tooling for offensive work — smbclient.py, smbserver.py, secretsdump.py, and ntlmrelayx.py. Covers Pass-the-Hash, hash capture via UNC paths, DCSync, and cross-protocol NTLM relay.
A long walkthrough of smbclient for offensive work — SMB dialects, enumeration, bulk exfiltration, Pass-the-Ticket via Kerberos, opsec around credentials, and what the blue team sees when you connect.
A long-form Ruby walkthrough for security folks. Covers syntax, the object model, blocks and metaprogramming, networking, FFI, and writing Metasploit modules.
Master the art of flight without leaving a footprint. A comprehensive guide to disabling shell history, managing operational hygiene, and understanding the forensic limit of these techniques across Bash, Zsh, Fish, and PowerShell on Linux.
This article explores how Red Team members can use alternate data streams on Windows NTFS to hide data, with specific examples and cautionary considerations.
A comprehensive guide to mastering port scanning on both Linux and Windows, covering standard tools like Nmap, stealthy built-in techniques, and modern PowerShell-based enumeration.