Tutorials
Adversary EmulationCyber Threat Intelligence (CTI) Fundamentals: Sources, Types, and the Intelligence LifecycleLearn how to build and operationalize a cyber threat intelligence program - covering the four intelligence types, the six-phase lifecycle, STIX 2.1/TAXII…Read →Adversary EmulationNavigating ATT&CK Navigator: Building, Annotating, and Exporting Technique LayersMaster ATT&CK Navigator to build technique layers, run gap analysis with score expressions, and export results for threat-informed defense and adversary emulation…Read →Adversary EmulationIntroduction to MITRE ATT&CK: Structure, Tactics, Techniques, and Sub-TechniquesA comprehensive introduction to the MITRE ATT&CK knowledge base covering its data model, 14 Enterprise tactics, related objects, Navigator layers, and how…Read →Red TeamingOSINT for People and Credentials: LinkedIn, Breach Data, and Email HarvestingDiscover how adversaries harvest employee identities, email addresses, and breached credentials from public sources - and how defenders can run the same…Read →Red TeamingActive OSINT: DNS, Certificate Transparency, and Subdomain EnumerationMaster subdomain enumeration from zero-noise CT log mining to active DNS brute-force. Covers AXFR attacks, crt.sh, subfinder, puredns, and Sysmon-based detection for…Read →Red TeamingPassive OSINT: Mapping the Target Without Touching ItDiscover how authorized red teamers build a complete external attack surface map using only public, third-party data sources - certificate transparency logs,…Read →Red TeamingOPSEC Principles for Red Teamers: Staying UndetectedLearn the OPSEC principles that separate realistic adversary simulations from noisy penetration tests - covering C2 infrastructure, process injection, network blending, and…Read →Exploit DevelopmentUnderstanding the Stack: Frames, Prologue/Epilogue, and Stack LayoutLearn how x86 and x64 Windows stack frames are structured - from EBP chains and shadow space to prologue/epilogue sequences - and…Read →Exploit Developmentx86 and x64 Calling Conventions: cdecl, stdcall, fastcall, and System VCalling conventions dictate exactly where return addresses and arguments sit in memory. This tutorial breaks down cdecl, stdcall, fastcall, Microsoft x64, and…Read →Exploit DevelopmentWinDbg Crash Course: Navigation, Commands, and Workflow for Exploit DevsLearn to drive WinDbg from first principles - attach to targets, read access violations, master every breakpoint type, and use Time Travel…Read →Exploit DevelopmentSetting Up Your Exploit Development Lab (VMs, Debuggers, Tools)Learn to build a fully isolated Windows exploit development lab with two VMs, WinDbg kernel debugging, x64dbg, mona.py, boofuzz, and vulnerable targets…Read →Adversary EmulationThreat-Informed Defense: Principles, Frameworks, and the Intelligence-Driven Security CycleMove beyond brittle IOCs with threat-informed defense. This tutorial covers the Pyramid of Pain, MITRE ATT&CK, the six-phase CTI lifecycle, STIX/TAXII, M3TID…Read →