Malware & C2 Living-off-the-Land Binaries (LOLBins) for Evasion
Disclaimer: This article is provided strictly for educational purposes and authorized security testing. Only run these t...
Post-Exploitation
Malware & C2 
Malware & C2 C2 Frameworks Compared: Cobalt Strike, Sliver, and Mythic
Disclaimer: This article is provided strictly for educational purposes and authorized security testing. Only run these t...
Malware & C2 Beacon Object Files and In-Memory Tradecraft
Disclaimer: This article is provided strictly for educational purposes and authorized security testing. Only run these t...
Linux Privesc Linux Persistence: systemd Timers, udev Rules, and PAM Modules
Disclaimer: This article is provided strictly for educational purposes and authorized security testing. Only run these t...
Windows Privesc Volume Shadow Copies (VSS) for Credential and File Recovery
Disclaimer: This article is provided strictly for educational purposes and authorized security testing. Only run these t...
Malware & C2 COM Hijacking for Persistence and Privilege Escalation
Disclaimer: This article is provided strictly for educational purposes and authorized security testing. Only run these t...
Windows Privesc Windows Access Tokens Deep Dive: Integrity Levels and Privileges
Disclaimer: This article is provided strictly for educational purposes and authorized security testing. Only run these t...
Tools & Defense Windows Firewall and WFP Tampering: Risks and Detection
Disclaimer: This article is provided strictly for educational purposes and authorized security testing. Only run these t...
Malware & C2 Abusing BITS Jobs for Download and Persistence
Disclaimer: This article is provided strictly for educational purposes and authorized security testing. Only run these t...
Windows Privesc Windows Subsystem for Linux (WSL) as an Attack Surface
Disclaimer: This article is provided strictly for educational purposes and authorized security testing. Only run these t...
Windows Privesc Looting Windows Secrets: Attacking DPAPI and Credential Manager
How attackers decrypt DPAPI-protected Credential Manager vaults and browser secrets, plus how blue teams detect and stop it.
Linux Privesc Exploiting SUID/SGID Binaries for Linux Privilege Escalation
How attackers abuse SUID/SGID binaries to escalate to root on Linux, plus blue-team detection and hardening.
Linux Privesc Abusing Linux Capabilities for Privilege Escalation
How attackers abuse cap_setuid and cap_dac_read_search file capabilities to escalate to root, and how blue teams detect it.
Linux Privesc Abusing NFS no_root_squash for Local Privilege Escalation
How a misconfigured NFS export with no_root_squash lets a low-priv user plant a root SUID binary and escalate.
Linux Privesc Abusing a World-Writable /etc/passwd for Root
How a writable /etc/passwd or /etc/shadow leads to instant root, with PoC and Blue Team defenses.
Linux Privesc SSH Key Hunting and Lateral Movement on Linux
Find SSH private keys, abuse authorized_keys and known_hosts, and pivot via agent forwarding across Linux hosts.
Linux Privesc Credential Hunting on Linux: From .bash_history to Config Files
A practical guide to hunting cleartext credentials on Linux hosts via history files, config files, and grep, plus defenses.
Linux Privesc Linux Persistence Techniques: Maintaining Access After Initial Compromise
A practical tour of Linux persistence: authorized_keys, cron, systemd, rc.local, and ld.so.preload, plus detection.
Linux Privesc Linux Enumeration Cheat Sheet for Privilege Escalation
A practical Linux post-exploitation enumeration cheat sheet covering id, uname -a, sudo -l, SUID hunting, and process inspection.
Security Reverse Shell Cheat Sheet: From One-Liners to a Stable TTY
A practical reverse shell cheat sheet covering bash, nc, python and PowerShell payloads plus TTY upgrade and detection.