Tutorials
Active Directory ExploitationKerberos Authentication Internals: AS-REQ to TGS-REP, the PAC, SPNs, and the krbtgt AccountTrace every Kerberos message from AS-REQ to TGS-REP, dissect the PAC field by field, and understand exactly why Kerberoasting, AS-REP Roasting, and…Read →Active Directory ExploitationNTLM Authentication Internals: Challenge-Response, Hashes, and Why Relay WorksUnderstand exactly why NTLM relay is possible at the protocol level - from MD4 NT hashes and NTLMv2 HMAC mechanics to the…Read →Active Directory ExploitationReading AD Object Security: DACLs, ACEs, and Rights on Every ObjectLearn how every AD object's DACL encodes exploitable rights - GenericAll, WriteDACL, ForceChangePassword - and walk a helpdesk-to-DCSync escalation chain with full…Read →Active Directory ExploitationSecurity Principals, SIDs, Tokens, and Trusts: How Identity and Authorization Really Work in ADUnderstand how Active Directory authorization really works - from SID binary format and kernel access tokens to SeImpersonatePrivilege exploitation, SIDHistory injection, and…Read →Active Directory ExploitationLDAP and the Active Directory Schema: How the Directory Stores Everything You Will AttackEvery Active Directory attack path traces to a specific schema attribute. Learn how the LDAP schema, naming contexts, and key attributes like…Read →Active Directory ExploitationActive Directory Architecture: Domains, Forests, Trees, OUs, Sites, and GPOsMaster Active Directory's logical and physical architecture before your first exploit. Covers forests, domains, OUs, sites, GPOs, FSMO roles, and trust boundaries…Read →Windows InternalsACLs, DACLs, and SACLs: Access Control InternalsUnderstand the kernel-level structures behind every Windows access check - SECURITY_DESCRIPTOR, DACL, SACL, and ACE types - then learn how attackers exploit…Read →Exploit DevelopmentSEH Overwrite Exploits: Hijacking Exception DispatchLearn how SEH overwrite exploits corrupt the on-stack exception registration record and use POP/POP/RET gadgets to hijack Windows exception dispatch - with…Read →Adversary EmulationAtomic Red Team Deep Dive: Writing Custom Atomics and Contributing to the LibraryLearn to write schema-valid custom Atomic Red Team tests for T1547.001 Registry Run Key persistence, capture Sysmon telemetry, build a paired Sigma…Read →Red TeamingLNK File Weaponization for Initial AccessTear apart the MS-SHLLINK binary format, build a weaponized LNK disguised as a PDF invoice, deliver it inside an ISO, and catch…Read →Red TeamingMalicious Office Macros: VBA Basics to Shellcode ExecutionLearn how malicious Office macros go from 'Enable Content' to a Meterpreter session - covering the three-API shellcode runner, AMSI bypass, VBA…Read →Adversary EmulationIntroduction to Atomic Red Team: Installation, Structure, and Running Your First Atomic TestInstall Atomic Red Team on an isolated Windows VM, explore the ATT&CK-mapped YAML test structure, and execute your first atomic against T1059.001…Read →