Tutorials
Adversary EmulationAPT Profiling: How to Build a Comprehensive Adversary Profile from Open-Source IntelligenceMaster APT profiling by systematically collecting OSINT, mapping TTPs to MITRE ATT&CK, and serializing a full adversary dossier in STIX 2.1 -…Read →Red TeamingBuilding a Red Team Lab: Infrastructure, VMs, and C2 SetupDesign and deploy a self-contained red team lab with tiered network segmentation, Sliver C2, redirector chains, and a full blue team monitoring…Read →Exploit DevelopmentPosition-Independent Code: Writing PIC Shellcode Without Hardcoded AddressesDiscover how Windows shellcode achieves position independence by walking the PEB loader chain, hashing export names with ROR-13, and eliminating null bytes…Read →Exploit DevelopmentWriting x64 Shellcode: Differences, Shadow Space, and Register ConventionsLearn the ABI-level differences between x86 and x64 Windows shellcode, including shadow space, register conventions, PEB walking via GS:[0x60], and export table…Read →Windows InternalsFibers: User-Mode Cooperative ThreadsDeep dive into Windows fibers: how cooperative context switches work entirely in user mode, how the TEB and undocumented FIBER structure tie…Read →Exploit DevelopmentWriting Your First Shellcode: x86 Reverse Shell from ScratchLearn to hand-craft a Windows x86 reverse shell in NASM - resolving APIs via PEB walk and PE export parsing, initialising Winsock,…Read →Exploit DevelopmentBad Characters, Null Bytes, and Restricted Character SetsDiscover why bad characters like null bytes corrupt shellcode in buffer overflows, how to enumerate restricted character sets with mona.py, and how…Read →Windows InternalsJobs and Silos: Process Grouping and Resource LimitsExplore how the Windows kernel uses job objects and silos to manage process groups, enforce resource limits, and isolate containers - and…Read →Windows InternalsWindows Scheduler Internals: Priority Levels, Quantum, and Thread SelectionExplore Windows scheduler internals: the 32-level priority model, KPRCB ready queues, quantum mechanics, and boost/decay logic - with defender detection strategies for…Read →Exploit DevelopmentFinding the EIP Offset: Pattern Creation and Cyclic PatternsMaster EIP offset discovery using De Bruijn cyclic patterns and tools like msf-pattern_create, mona.py, and pwntools. A repeatable, tool-agnostic workflow for x86…Read →Exploit DevelopmentClassic Stack Buffer Overflow: Smashing the Stack on WindowsMaster the classic stack buffer overflow on Windows x86: corrupt the saved EIP, pivot through a JMP ESP trampoline, and understand how…Read →Adversary EmulationMapping CTI Reports to ATT&CK TTPs: A Step-by-Step MethodologyConvert threat intelligence reports into precise MITRE ATT&CK TTP layers using a structured four-step methodology - producing reusable artifacts that drive detection…Read →