Tutorials
Active Directory ExploitationGPP cPassword in SYSVOL: Decrypting Group Policy Preferences Passwords with Get-GPPPasswordEvery domain user can read SYSVOL - and GPP cPassword values stored there are encrypted with a publicly documented static AES key.…Read →Adversary EmulationIntroduction to Sigma: Rule Syntax, Backends, and Converting Rules to SIEM QueriesLearn to write Sigma rules in YAML, validate them with sigma-cli, and compile them into Splunk SPL, Microsoft Sentinel KQL, and Elastic…Read →Red TeamingAV and EDR Concepts: How Detections Work Against Offensive ToolsTear apart every EDR detection layer - inline NTDLL hooks, kernel callbacks, ETW Threat-Intelligence, AMSI, and WFP - against a real injector.…Read →Exploit DevelopmentJump-Oriented Programming (JOP): Dispatcher Gadgets and Functional ChainsJump-Oriented Programming replaces RET-driven ROP with a dispatcher gadget walking a register-held dispatch table - making stack-based defenses structurally blind. Learn how…Read →Active Directory ExploitationFrom-Zero AS-REP Roasting and Password Spraying: Getting Your First Credential with No CredsNo username, no password, no problem. Learn how to chain unauthenticated Kerberos enumeration, password spraying, and AS-REP roasting to get your first…Read →Adversary EmulationSysmon Event Deep Dive: Mapping Event IDs to ATT&CK Techniques for Detection CoverageBuild an exact map from every Sysmon Event ID (1-29) to MITRE ATT&CK techniques, then validate it in a lab by firing…Read →Red TeamingDomain Fronting and CDN Redirection for C2 ResilienceLearn how domain fronting exploits the SNI/Host header split to route C2 traffic through CDN infrastructure undetected. Covers full redirector chain setup…Read →Exploit Developmentret2libc and ret2plt: Leveraging Existing Code Without ShellcodeNX killed shellcode - ret2libc and ret2plt bring it back via code reuse. This tutorial builds a GOT-based libc leak chain defeating…Read →Windows InternalsWorking Sets and the Memory Manager’s Trimming PolicyLearn how Windows trims process working sets via MmWorkingSetManager, why EmptyWorkingSet is an anti-forensics primitive, and how to detect cross-process trimming with…Read →Active Directory ExploitationPassword Spraying Active Directory: Policy Enumeration First, Lockouts NeverBefore you spray a single credential, read the domain lockout policy and every Fine-Grained Password Policy. This guide shows how to enumerate…Read →Adversary EmulationSysmon Deployment and Configuration: Designing a High-Fidelity Telemetry PipelineDeploy Sysmon v15 the right way: modular XML config, noise-tuned filtering, SIEM forwarding, and Atomic Red Team validation that proves each detection…Read →Red TeamingMalleable C2 Profiles: Blending Into Legitimate TrafficLearn how Cobalt Strike's Malleable C2 DSL disguises Beacon as legitimate jQuery traffic - then flip perspectives and catch it with Sysmon,…Read →