Tutorials
Exploit DevelopmentInformation Leaks: Stack/Heap Disclosures, Format Strings, and Partial OverwritesModern exploits start with a leak. This tutorial walks the full chain - format string reads, heap metadata disclosures, and partial pointer…Read →Windows InternalsDLL Search Order and Hijacking PrimitivesLearn how the Windows loader resolves bare DLL names and how attackers exploit the search order for code execution. Covers search-order, phantom,…Read →Active Directory ExploitationKerberoasting From Zero: How TGS-REP Encryption Hands You Service Account HashesAny authenticated domain user can request service tickets encrypted with a service account's password-derived key - and crack them offline. This guide…Read →Adversary EmulationEmulating T1059 – Command and Scripting Interpreters: PowerShell, CMD, and WScript TechniquesReproduce real adversary tradecraft for T1059 - PowerShell encoded commands, CMD batch droppers, and WScript phishing chains - then wire up Sysmon,…Read →Red TeamingAMSI Internals and Bypass TechniquesLearn how AMSI works in-process, then defeat it three ways - AmsiScanBuffer memory patch, amsiInitFailed reflection, and DLL hijacking - while understanding…Read →Exploit DevelopmentASLR Internals: Randomization Scope, Entropy, and Weak ImplementationsUnderstand how Windows ASLR seeds randomization at boot, where entropy falls short on 32-bit targets, and how partial overwrites and format-string leaks…Read →Windows InternalsDLL Loading Internals: The Loader, LdrLoadDll, and Load OrderDive deep into Windows DLL loading internals - trace the LdrLoadDll call chain, walk PEB_LDR_DATA by hand, understand loader lock semantics, and…Read →Adversary EmulationWriting Sigma Rules for ATT&CK Techniques: Field Mapping, Conditions, and TuningLearn to write, tune, and convert production-quality Sigma rules for ATT&CK techniques - covering logsource taxonomy, field mapping pitfalls, condition logic, and…Read →Red TeamingObfuscation Techniques: String Encoding, XOR, and Payload EncryptionBuild a shellcode loader that stacks Base64, XOR, RC4, and AES-256 obfuscation against a benign calc.exe payload - then learn exactly which…Read →Exploit DevelopmentBypassing DEP with ROP on Windows: VirtualAlloc and VirtualProtect ChainsHardware DEP blocks stack shellcode at the NX bit level. Learn how to build VirtualProtect and VirtualAlloc ROP chains to flip page…Read →Windows InternalsWindows Heap Internals: NT Heap and Segment Heap ArchitectureDissect Windows NT Heap and Segment Heap internals from root descriptors to size-class components, XOR mitigations, and WinDbg walkthroughs - essential knowledge…Read →Active Directory ExploitationGPP cPassword in SYSVOL: Decrypting Group Policy Preferences Passwords with Get-GPPPasswordEvery domain user can read SYSVOL - and GPP cPassword values stored there are encrypted with a publicly documented static AES key.…Read →