Tutorials
Windows InternalsVirtual Address Descriptors: The VAD Tree and Memory Region TrackingThe VAD tree is the kernel's authoritative memory ledger - immune to user-mode forgery. Learn to walk _MMVAD nodes live in WinDbg,…Read →Adversary EmulationCALDERA Plugin Ecosystem: Sandcat, Manx, Response, and Custom Plugin DevelopmentDeploy Sandcat, Manx, and Response plugins in an isolated lab, then build your own CALDERA plugin from scratch. Covers dynamic compilation, P2P…Read →Red TeamingIntroduction to C2 Frameworks: Cobalt Strike, Havoc, and SliverMaster Cobalt Strike, Havoc, and Sliver C2 frameworks with real operator commands, lab setup, and detection coverage using Sysmon, ETW, and Sigma…Read →Adversary EmulationCALDERA Operations: Building and Running Automated Adversary Emulation CampaignsLearn to stand up Apache CALDERA v5.3.0, deploy Sandcat agents, and run multi-phase ATT&CK-mapped operations link by link - turning every procedure…Read →Red TeamingHTML Smuggling and ISO/IMG-Based Payload DeliveryHTML smuggling assembles payloads inside the browser, defeating perimeter inspection. This lab builds the full ISO/LNK delivery chain used by NOBELIUM and…Read →Exploit DevelopmentStack Canaries and GS Cookies: How They Work and When They FailUnderstand how GCC stack canaries and MSVC /GS cookies protect against stack overflows - then reproduce three practical bypass techniques against a…Read →Windows InternalsUAC Internals: Elevation, Consent, and Token FilteringUnderstand how UAC works under the hood - split tokens, Mandatory Integrity Control, and the AppInfo/consent.exe pipeline - then execute a fodhelper…Read →Exploit DevelopmentInteger Overflows and Off-by-One Errors: Turning Arithmetic Bugs into Memory CorruptionA single wrapped multiplication or a fence-post loop error can corrupt heap metadata or pivot a stack frame into shellcode. This tutorial…Read →Windows InternalsIntegrity Levels and Mandatory Integrity ControlWindows Mandatory Integrity Control tags every process and object with an integrity level, enforcing Biba-style no-write-up before DACLs are ever consulted. Learn…Read →Adversary EmulationIntroduction to CALDERA: Architecture, Agents, Abilities, and Adversary ProfilesLearn how MITRE CALDERA's C2 server, Sandcat agents, YAML abilities, and adversary profiles work together to automate ATT&CK-mapped breach simulation - then…Read →Red TeamingHTA Files and mshta.exe Abuse for Payload DeliveryLearn how attackers weaponize mshta.exe and HTA files for fileless payload delivery, including inline monikers and WMI parent-chain breaking, then engineer layered…Read →Exploit DevelopmentFormat String Vulnerabilities: Read/Write Primitives via printf InternalsA user-controlled printf format string is a complete read/write primitive. This tutorial covers stack leaking, %n-based GOT overwrites, pwntools fmtstr_payload, and blue-team…Read →