Tutorials
Red TeamingLNK File Weaponization for Initial AccessTear apart the MS-SHLLINK binary format, build a weaponized LNK disguised as a PDF invoice, deliver it inside an ISO, and catch…Read →Red TeamingMalicious Office Macros: VBA Basics to Shellcode ExecutionLearn how malicious Office macros go from 'Enable Content' to a Meterpreter session - covering the three-API shellcode runner, AMSI bypass, VBA…Read →Adversary EmulationIntroduction to Atomic Red Team: Installation, Structure, and Running Your First Atomic TestInstall Atomic Red Team on an isolated Windows VM, explore the ATT&CK-mapped YAML test structure, and execute your first atomic against T1059.001…Read →Adversary EmulationBuilding an Adversary Emulation Plan: From CTI to Executable PlaybookLearn to build a complete adversary emulation plan - from CTI research and ATT&CK technique mapping through a full AD lab execution…Read →Exploit DevelopmentStructured Exception Handler (SEH) Internals on WindowsTear apart Windows x86 Structured Exception Handler internals - from EXCEPTION_REGISTRATION_RECORD chain layout to a working POP/POP/RET exploit - then see exactly…Read →Red TeamingPayload Delivery via Email: Attachments, Links, and Bypassing FiltersTrace the full email delivery kill chain a red team assembles - ISO containers, LNK stomping, HTML smuggling, and AiTM - then…Read →Adversary EmulationEmulation Plan Architecture: Structuring Phases, Objectives, Scenarios, and Success CriteriaLearn how to architect an adversary emulation plan (AEP) the MITRE CTID way: intelligence summary, phased operational flow, TTP-by-TTP scenarios, and scorable…Read →Windows InternalsAccess Tokens and Privileges: The Kernel’s Security ContextEvery Windows process runs inside a security context defined by its access token. Learn how the kernel builds and enforces that context…Read →Windows InternalsSIDs and Security Descriptors: Identity in Windows SecurityUnderstand how Windows uses Security Identifiers and security descriptors to make every access decision - and how attackers abuse NULL DACLs, SID-History…Read →Exploit DevelopmentEgghunters: Staged Payload Delivery When Buffer Space Is TightWhen your overflow buffer is too small for real shellcode, an egghunter scans process memory for your tagged payload and jumps to…Read →Exploit DevelopmentShellcode Encoders: XOR Encoding, Custom Decoders, and Avoiding Bad CharsControl EIP but your shellcode dies in transit? This tutorial covers XOR encoding, custom x86 decoder stubs using JMP-CALL-POP, per-chunk keying, and…Read →Red TeamingPhishing Campaign Design: Pretexting, Lures, and Target ProfilingBuild effective authorized phishing simulations by mastering OSINT target profiling, pretext construction, and lure delivery selection - with full MITRE ATT&CK coverage…Read →