Tutorials
Adversary EmulationBuilding an Adversary Emulation Plan: From CTI to Executable PlaybookLearn to build a complete adversary emulation plan - from CTI research and ATT&CK technique mapping through a full AD lab execution…Read →Exploit DevelopmentStructured Exception Handler (SEH) Internals on WindowsTear apart Windows x86 Structured Exception Handler internals - from EXCEPTION_REGISTRATION_RECORD chain layout to a working POP/POP/RET exploit - then see exactly…Read →Red TeamingPayload Delivery via Email: Attachments, Links, and Bypassing FiltersTrace the full email delivery kill chain a red team assembles - ISO containers, LNK stomping, HTML smuggling, and AiTM - then…Read →Adversary EmulationEmulation Plan Architecture: Structuring Phases, Objectives, Scenarios, and Success CriteriaLearn how to architect an adversary emulation plan (AEP) the MITRE CTID way: intelligence summary, phased operational flow, TTP-by-TTP scenarios, and scorable…Read →Windows InternalsAccess Tokens and Privileges: The Kernel’s Security ContextEvery Windows process runs inside a security context defined by its access token. Learn how the kernel builds and enforces that context…Read →Windows InternalsSIDs and Security Descriptors: Identity in Windows SecurityUnderstand how Windows uses Security Identifiers and security descriptors to make every access decision - and how attackers abuse NULL DACLs, SID-History…Read →Exploit DevelopmentEgghunters: Staged Payload Delivery When Buffer Space Is TightWhen your overflow buffer is too small for real shellcode, an egghunter scans process memory for your tagged payload and jumps to…Read →Exploit DevelopmentShellcode Encoders: XOR Encoding, Custom Decoders, and Avoiding Bad CharsControl EIP but your shellcode dies in transit? This tutorial covers XOR encoding, custom x86 decoder stubs using JMP-CALL-POP, per-chunk keying, and…Read →Red TeamingPhishing Campaign Design: Pretexting, Lures, and Target ProfilingBuild effective authorized phishing simulations by mastering OSINT target profiling, pretext construction, and lure delivery selection - with full MITRE ATT&CK coverage…Read →Adversary EmulationAPT Profiling: How to Build a Comprehensive Adversary Profile from Open-Source IntelligenceMaster APT profiling by systematically collecting OSINT, mapping TTPs to MITRE ATT&CK, and serializing a full adversary dossier in STIX 2.1 -…Read →Red TeamingBuilding a Red Team Lab: Infrastructure, VMs, and C2 SetupDesign and deploy a self-contained red team lab with tiered network segmentation, Sliver C2, redirector chains, and a full blue team monitoring…Read →Exploit DevelopmentPosition-Independent Code: Writing PIC Shellcode Without Hardcoded AddressesDiscover how Windows shellcode achieves position independence by walking the PEB loader chain, hashing export names with ROR-13, and eliminating null bytes…Read →