Tutorials
Exploit DevelopmentInteger Overflows and Off-by-One Errors: Turning Arithmetic Bugs into Memory CorruptionA single wrapped multiplication or a fence-post loop error can corrupt heap metadata or pivot a stack frame into shellcode. This tutorial…Read →Windows InternalsIntegrity Levels and Mandatory Integrity ControlWindows Mandatory Integrity Control tags every process and object with an integrity level, enforcing Biba-style no-write-up before DACLs are ever consulted. Learn…Read →Adversary EmulationIntroduction to CALDERA: Architecture, Agents, Abilities, and Adversary ProfilesLearn how MITRE CALDERA's C2 server, Sandcat agents, YAML abilities, and adversary profiles work together to automate ATT&CK-mapped breach simulation - then…Read →Red TeamingHTA Files and mshta.exe Abuse for Payload DeliveryLearn how attackers weaponize mshta.exe and HTA files for fileless payload delivery, including inline monikers and WMI parent-chain breaking, then engineer layered…Read →Exploit DevelopmentFormat String Vulnerabilities: Read/Write Primitives via printf InternalsA user-controlled printf format string is a complete read/write primitive. This tutorial covers stack leaking, %n-based GOT overwrites, pwntools fmtstr_payload, and blue-team…Read →Active Directory ExploitationLLMNR, NBT-NS, and mDNS Poisoning with Responder: Capturing Net-NTLMv2 from ZeroLearn how Responder exploits Windows multicast name resolution fallback to capture Net-NTLMv2 credentials, relay them with ntlmrelayx, and how to shut the…Read →Active Directory ExploitationUsername Enumeration and Validation with Kerbrute: Abusing Kerberos Pre-AuthenticationLearn how Kerbrute abuses Kerberos AS-REQ error differentials to enumerate valid Active Directory usernames without triggering lockouts, harvest AS-REP hashes from pre-auth-disabled…Read →Windows InternalsThe Windows Access Check Algorithm: How SeAccessCheck WorksTrace the Windows access check algorithm from DesiredAccess through ObCheckObjectAccess into SeAccessCheck, learn how DACLs are evaluated against a caller's token, and…Read →Active Directory ExploitationAnonymous and Null-Session Enumeration: SMB, LDAP Anonymous Binds, and RID CyclingNo credentials? No problem. SMB null sessions, LDAP anonymous binds, and RID cycling can expose your entire Active Directory user roster before…Read →Active Directory ExploitationTrust, Share, and File Hunting: Mapping the Forest and Finding Credentials in DataLearn to enumerate AD forest trusts, discover misconfigured SMB shares, and harvest credentials from files using BloodHound, Snaffler, and GPP decryption -…Read →Active Directory ExploitationSPN and Delegation Enumeration: Kerberoastable Accounts, Unconstrained, Constrained, and Resource-Based DelegationMaster SPN enumeration and all three Kerberos delegation models - Kerberoasting weak service accounts, stealing DC TGTs via unconstrained delegation, S4U protocol…Read →Active Directory ExploitationSession, Logged-On User, and Local Admin Hunting: Finding Where Domain Admins Are Logged InDiscover how low-privileged domain users enumerate active sessions, interactive logons, and local admin membership to pinpoint where Domain Admins are authenticated -…Read →