Tutorials
Active Directory ExploitationLDAP and the Active Directory Schema: How the Directory Stores Everything You Will AttackEvery Active Directory attack path traces to a specific schema attribute. Learn how the LDAP schema, naming contexts, and key attributes like…Read →Active Directory ExploitationActive Directory Architecture: Domains, Forests, Trees, OUs, Sites, and GPOsMaster Active Directory's logical and physical architecture before your first exploit. Covers forests, domains, OUs, sites, GPOs, FSMO roles, and trust boundaries…Read →Windows InternalsACLs, DACLs, and SACLs: Access Control InternalsUnderstand the kernel-level structures behind every Windows access check - SECURITY_DESCRIPTOR, DACL, SACL, and ACE types - then learn how attackers exploit…Read →Exploit DevelopmentSEH Overwrite Exploits: Hijacking Exception DispatchLearn how SEH overwrite exploits corrupt the on-stack exception registration record and use POP/POP/RET gadgets to hijack Windows exception dispatch - with…Read →Adversary EmulationAtomic Red Team Deep Dive: Writing Custom Atomics and Contributing to the LibraryLearn to write schema-valid custom Atomic Red Team tests for T1547.001 Registry Run Key persistence, capture Sysmon telemetry, build a paired Sigma…Read →Red TeamingLNK File Weaponization for Initial AccessTear apart the MS-SHLLINK binary format, build a weaponized LNK disguised as a PDF invoice, deliver it inside an ISO, and catch…Read →Red TeamingMalicious Office Macros: VBA Basics to Shellcode ExecutionLearn how malicious Office macros go from 'Enable Content' to a Meterpreter session - covering the three-API shellcode runner, AMSI bypass, VBA…Read →Adversary EmulationIntroduction to Atomic Red Team: Installation, Structure, and Running Your First Atomic TestInstall Atomic Red Team on an isolated Windows VM, explore the ATT&CK-mapped YAML test structure, and execute your first atomic against T1059.001…Read →Adversary EmulationBuilding an Adversary Emulation Plan: From CTI to Executable PlaybookLearn to build a complete adversary emulation plan - from CTI research and ATT&CK technique mapping through a full AD lab execution…Read →Exploit DevelopmentStructured Exception Handler (SEH) Internals on WindowsTear apart Windows x86 Structured Exception Handler internals - from EXCEPTION_REGISTRATION_RECORD chain layout to a working POP/POP/RET exploit - then see exactly…Read →Red TeamingPayload Delivery via Email: Attachments, Links, and Bypassing FiltersTrace the full email delivery kill chain a red team assembles - ISO containers, LNK stomping, HTML smuggling, and AiTM - then…Read →Adversary EmulationEmulation Plan Architecture: Structuring Phases, Objectives, Scenarios, and Success CriteriaLearn how to architect an adversary emulation plan (AEP) the MITRE CTID way: intelligence summary, phased operational flow, TTP-by-TTP scenarios, and scorable…Read →