Hello, Open World

Search Ctrl + K

Hello, Open World

Search Ctrl + K

Published

Hello, Open World

1_RTO

1.1 Red Teaming 101

1.1.1 OW64

1. Linux

1.0 Linux Architecture

1.1a Linux Deep Dive P1

1.1b Linux Deep Dive — Part 1b: Privilege Escalation

1.1c Linux Deep Dive — Part 2: Looting, Persistence, Cleanup & C2

1.2 Linux Action Items

1. Linux — reading order

1. Linux Red Teaming & Privilege Escalation

2. Windows

2.0 Windows Architecture

2.1a Local Box Deep Dive

2.1b AD Attacks Deep Dive

2. Windows — reading order

2. Windows & Active Directory Attacks

Recon

Scenario 1: External Recon — Scanning From Outside The Network

Scenario 2: Internal Recon — On The Network, No Credentials

Scenario 3: Authenticated Pivot — SSH / Chisel / Ligolo-ng SOCKS

Stay Low: Proxychains/Pivoting OPSEC — Scenario 4: C2 SOCKS Proxy

Scenario 6: Low-Footprint Alternatives — When Nmap Says "Filtered"

Scenario 7: Blue Team Detection Architecture

8. Jump_Server_Quickstart

9. Detection_EventIDs_Splunk

Open-Source Intelligence — Corporate Finance Recon Reference

Windows AD Recon — GOAD-Light Lab

Windows Tradecraft

Active Directory

1. External Initial Access

2a. Credential Harvesting

2b. Gaining Access Without Credentials

3. Entering a Domain-Joined Machine

4. Enumerating a Domain-Joined Machine

5a. Privilege Escalation

5b. Establishing Persistence

6. Enumerating Forest and Trust Relationships

7. Pivoting to Other Machines on the Network

8. Owning a Domain Admin

LDAP & Active Directory Enumeration Notes

🛠️ PowerView / SharpView - AD Enumeration Cheat Sheet

Windows Authentication, Relay, and Lateral Movement

Case Studies

Part 1 - Bypassing Windows Defender Application Control with Loki C2

EDR Evasion

0. Binary creation and insertion

1. Download Prevention & Bypass Techniques

1a. AES, RC4, XOR encryption

**1. XOR-Based Self-Decrypting Payload (C++)**

1c. RC4-Based Self-Decrypting Payload (C++)

**3. AES-Based Self-Decrypting Payload (C++)**

1e. Advanced UPX Methods for Modifying Binary Structure

2. Direct syscalls intro

**1. EDR Detection & Bypass Techniques**

2a. Direct Syscalls cpp

2b. Indirect Syscalls intro

2c. Indirect Syscalls -Tool

Windows Attacks

Enumerate Windows

OW64 Windows Tradecraft — Detailed Notes

Red Teaming 101: Master Index

0.1 SecureHomelabs

Red Team Workspace Cheatsheet

Hardened Jump Hosts on OCI, AWS, and DigitalOcean

0.4 — Initial Access

1.1a Linux Deep Dive P1 (moved)

1.1b Linux Deep Dive P1b (moved)

1.1c Linux Deep Dive P2 (moved)

1.3 — macOS Post-Exploitation

1. Linux (moved)

2.1 Windows-ad-attacks (moved)

2. Windows AD (moved)

3. Web Application Pentesting

4.1 — Pivoting and Tunneling

4. Networking, Pivoting & Tunneling

5. Cloud Attack

Evading Network Defenses During Pentests

6.2 Syscall-Based Evasion — Deep Dive

6. EDR Bypass & Evasion

7. C2 Operations

8. Reporting & Portfolio Development

1.1 Red Teaming 101 — Index

1.2 Web

1.2.1 Learn Web

Web Architecture 101

Web security control map

2. DNS Security - Defen ding Against Attacks

3. Load Balancer Security- Defending Against Attacks

4. Web Application Server Security- Defending Against Attacks

6. Web Caching Security- Attacks & Mitigation Strategies

7a. Introduction to Job Queue Security

8. Microservices Security- Protecting APIs & Authentication Mechanisms

9. Introduction to Data Pipeline Security

1. HTTP Headers

1. What is WebAssembly (WASM) on the Web?

1.2.2 Attack Web

Data Wrapper

Bash Data Wrapper

Java Data Wrapper

Javascript Data Wrapper

PHP Data Wrapper

Debugger and Logger

Frappe - Python

Debugger - .net - DNN

Debugger - Apache Debugger start

Debugger - Docker and NodeJS

Debugger - ERPNext Frappe

Debugger - Java - VSCODE

Debugger-Docker

Debugger-VSCODE-Python

Logger - MongoDB

Logger - MS SQL Server

Logger - Oracle Database

Logger - PostgreSQL

Logger - SQLite

Deserialization - .net

Black Box Appraoch

Debug with dnspy - DNN

White Box Approach

XML Deserialization Vulnerabilities

GraphQL

0. GraphQL Attack Flow

0. GraphQL Resources

2. GraphQL Endpoints?

3. Introspection - Getting information

3.5 Connection Type

6. 'Something' doesn't exist on type 'Query'

JAVA

Java Servlets and Key Methods to Review

JAVA Web Testing - White box

Javascript

Session Riding CSRF

javascript payload session riding - CSRF

Javascript, Nodejs, Express, Webpack

NodeJS - Handlebars

Templating Engine

Use Dev Console

MYSQL

Collation - MySQL

MariaDB Query Logging

PHP

postgresSQL

0. PSQL Extensions attack - UDF

PostgreSQL large objects: server-side file write validation

1. PSQL Large Object exploit

Large Object Reverse shell Python code

poc.c Local execution arking.

psql poc.c - reverseshell

Remote execution py

Prototype

Main Prototype pollution

Regex

SOP_CORS

SSRF

SSTI

Server Side Template Injection

web_pentesting_checklist

3. Command Injection

Attack Web — validation index

1. What is JWT?

Web Fingerprint — Passive-First Python Script

Web Security — Index

1.3 Clouds

1.3.1 Learn Cloud

0.1.1. General

0.1.1.1. Clouds

0.1.1.2. Clouds testing Scoping

0.1.1.3. Associate roles and services

0.1.2 Azure

0.1.2.1. Azure General

IAM

How does a user authenticate to the cloud?

1 OpenID Connect

Security Token Service

AZURE CLI Tab Completion

Azure Powershell

Azure REST API with Azure CLI

Built-in Permissions

Microsoft Graph

Tenant, Subscription, Resource

0.1.2.2. Azure Services

Active Directory Federation Services (ADFS)

Azure API Management

Azure App Services

Azure Automation

Azure Function Apps

Azure Key Vaults

Azure Kubernetes

Azure Logic App

Azure Resource Manager

Azure Storage Account

Azure Virtual Machine

0.1.3 AWS

0.1.3.1. AWS Resources

AWS Cloud Services

1.3.2 Attack Cloud

0.2.1. General

Cloud Security Validation — Scope Before Access

0.2.1.2. Search for Credentials - Services

0.2.1.3. Search for Credentials - File

0.2.2. AWS

flaws.cloud

AWS Practice 2 -flaws2.cloud

skills

AWS Penetration Testing - Comprehensive Skill Reference

Tips

AWS Access Key to Web

AWS Signed API Request

AWS Signing and Authenticating REST requests

0.2.2.1. AWS - Search for Creds

0.2.3. Azure

PwnedLabs

0. Azure - Readme

1. Azure Blob Container to Initial Access

2. Unlock Access with Azure Key Vault

3. Azure with Bloodhound and Microsoft.Graph

4. Loot Exchange, Teams and SharePoint with GraphRunner

5. Unmask Privileged Access in Azure

8. Execute Azure Credential Shuffle to Achieve Objectives

skills

Azure - Search for Creds!

Enumerate with credentials

Enumerate without Credentials - Inside of Virtual Machine

Tool - AADInternal

Tool - Azrecon.sh

Tool - AZSubEnum - Subdomain Enum

Collection of custom BloodHound queries

Tool - BloodHound

Tool - GraphRunner

Tool - Name mesh

Tool- RoadRecon

Tools - Password spray

0.2.4 GCP

1. GCP - Search Creds

Cloud Security — Index

1.4 Tunneling

Tunneling — Index

SSH tunneling validation guide

1.5 Syntaxes

Syntax References — Index

Transfer files with SCP

SharpHound collection reference

Mount an approved SMB share read-only

Connect with FreeRDP

1.6 Kubernetes

Kubernetes — Index

Kubernetes Validation Catalog

1.7 Wireless

Wireless and SDR — Index

Wireless and SDR lab reference

Docker

Docker — Index

1_RTO — Index

2_AI

2.1 Learn AI

01-foundations

AI Foundations — Index

AI, Machine Learning, Deep Learning, and Generative AI

Data, Training, Validation, and Inference

Neural-Network Basics

Transformers and Attention

Tokens, Embeddings, and Context

Generation, Decoding, and Hallucinations

Model Families and Multimodality

AI as a Glass Box — Observe the Complete Run

AI as a White Box — Trace a Tiny Language Model

02-using-ai

Using AI Effectively — Index

Frame the Job and Success Criteria

Context Engineering for Users

Verification, Citations, and Abstention

Model Selection, Cost, and Privacy

Repeatable User Workflows

03-harness-engineering

AI Harness Engineering — Index

What Is an AI Harness?

AI Harness Reference Architecture

Instruction and Context Assembly

Model Adapters and Routing

Tools and Structured Outputs

State, Memory, and Checkpoints

Permissions, Sandboxing, and Human Approval

Retries, Idempotency, and Recovery

Observability, Cost, and Run Records

Harness Contract and Lifecycle

04-agents-and-tools

90-existing-mcp-notes

MCP Discovery — Authorized Inventory

MCP Version History and Compatibility

MCP Security Engineering

91-existing-agentic-ai-note

Agents and Tools — Index

Agents Versus Workflows

AI Workflow Patterns

Planning Loops and State Graphs

Tool Use and the Model Context Protocol

Multi-Agent Systems

Human-in-the-Loop Control

Skills and Capability Packages

05-knowledge-systems

AI Knowledge Systems — Index

RAG Reference Pipeline

Ingestion, Chunking, and Metadata

Retrieval, Hybrid Search, and Reranking

Grounding, Citations, and RAG Evaluation

Memory, RAG, CAG, and Fine-Tuning

Graph and Structured Retrieval

06-building-and-deployment

Building and Deploying AI — Index

API-Hosted Versus Local Models

AI Frameworks Without Lock-In

Fine-Tuning, PEFT, and Distillation

Inference, Quantization, and Serving

Multimodal Application Pipelines

AI Production Release Lifecycle

07-evaluation-and-operations

AI Evaluation and Operations — Index

Evaluation Layers and Metrics

Evaluation Datasets, Rubrics, and Edge Cases

Deterministic Checks, Model Judges, and Humans

Online Monitoring and Drift

Experiments, Versioning, and Regression Gates

AI Incidents and Change Management

08-security-privacy-governance

AI Security, Privacy, and Governance — Index

Threat-Model the Complete AI System

Prompt Injection and Untrusted Content

Data Privacy and Sensitive Information

Model, Data, and Software Supply Chain

Excessive Agency and Tool Risk

Govern, Map, Measure, and Manage AI Risk

09-automation

AI Automation — Index

Event-Driven AI Automation

Scheduled AI Research and Reporting

n8n AI Workflow Safety and Operations

10-labs

02-local-rag-cas-existing

rag_backend

**Dockerfile Breakdown: Headless RAG Pipeline with OCR and Cron**

**Python Requirements Overview**

4. doc_processor.py

5a. vectorizer.py

5b. ollama_embed.py

**api.py Breakdown**

**config.py Breakdown**

**.env Breakdown**

**uploader.py Breakdown**

**🐳 Docker Compose Overview**

Practical AI Labs — Index

Lab 1 — Prompt and Verification

Lab 2 — Local RAG

Lab 3 — Read-Only Tool Agent

Lab 4 — Production Harness Capstone

11-reference

AI Reference — Index

AI Authoritative Source Ledger

Dumpster AI Research Map

agentctl Research Audit — Learn AI Curriculum

Legacy AI Content Fact-Check Matrix

Core Curriculum Verification Register

Learn AI — Curriculum Index

2.2 Daily Learning

20261012 Transformer

3_Platform Internals

3.2 Windows OS

6.1 Learn Windows

1. Windows Basic

Windows Authentication System

LSA and LSASS: local and domain authentication

Security Account Manager: local accounts

Windows Credential Manager

Windows internals learning path

1. Portable Executable Structure

From PE file to process memory

3. Flow of System Calls - ntdll.dll, kernel32.dll

Win32 API and Windows Native API

4a. NTDLL.DLL - Overview and Functionality

5. Syscalls Flow

Windows system calls: deeper flow

5b. From Memory - PEB_TEB

1. Execution of EXE and DLL Files

Platform Invoke in .NET

Windows Service Control Manager

USB device discovery and driver loading

Windows authentication systems

Windows Management Instrumentation architecture

Windows Remote Management

Windows User Rights

1a. Windows Defense Mechanism

1. EDR Intro

1. Let's understand EDR like a blue team

Windows defense mechanisms

Windows Code Integrity and App Control

Platform Internals — Index

4_Domain Playbooks

Drones

Drone Landscape

Drone Radio and Frequency Guide

Safe Drone Learning Path

LiteWing ESP32 Drone — From Box to First Flight

LiteWing First-Flight Runbook

LiteWing ML Autonomy — Phased Project Plan

RadioMaster Boxer ELRS — bench-only setup reference

RadioMaster Boxer — EdgeTX and internal ELRS firmware upgrade bench guide

11-wifi-fpv-drone-101-target-to-attack

Sources and Fact-Check Gates

linux

Linux Domain Playbook — Index

01-linux-internal-device-scan

02-linux-log-system

Mobility

01-methodology

Mobility Research Guideline — Initial Entry Vectors (Equipment & Site Focus)

02-theory

Mobility Security Assessment Threat Model

Mobility — The 5G Core, End to End

03-phases

Phase 2 - UE, Android, and SIM Security Assessment

04-open5gs_lab

Open5GS Lab Guide Index

Part 1: 4G / LTE Fundamentals

Part 2: 5G NSA (Non-Standalone) Architecture

Part 3: 5G SA (Standalone) Architecture

Part 4: Docker Lab - 4G LTE EPC with Open5GS

Part 5: 5G NSA - Guided Lab Path

Part 6: Docker Lab - 5G SA Core with UERANSIM

Part 7: Kubernetes Deployment

Part 8: Threat Model - 4G LTE Attack Surface

Part 9: Threat Model - 5G Attack Surface

Part 10: Threat Model - Kubernetes + Telecom

Part 11: Real-World Attacks — Core Signaling (SS7 / Diameter / GTP)

Part 12: Real-World Attacks — Subscriber Identity, SIM & Carrier Data

Part 13: Real-World Attacks — SMS Abuse, Mobile Malware & MFA Bypass

Part 14: Real-World Attacks — APT & Gang Mobile Infrastructure Operations

Part 15: Real-World Attack Matrix & Defense Roadmap

Part 16: 4G/5G Analysis Toolkit — Mobile & PC

Holistic 4G/5G Security and Functional Test Plan

Mobility 4G/5G Site-to-Core Security Test Plan

05-hardware

Mobile Security Research Lab — Equipment Guide

Pixel 9 — Mobile Security Research Setup

OnePlus 9 — Qualcomm Instrument UE Acquisition and Validation

06-toolkit

MBX-02 & MBX-08 — App Interception Toolkit

07-test-plans

Master Blackbox UE-to-Node Test Plan

09-evidence

Telecom Fraud Evidence Matrix

Scattered Spider to Telecom Fraud Evidence Matrix

12-incidents

Pixel 9 Browser Proxy Issue Resolution

Android Proxy Cleanup Script

13-apt-threat-intelligence

Mobility APT Threat Intelligence — Index

Documented APT and Telecom Intrusion Campaigns

Mobility Attack Surfaces and Inspection Files

Local Open5GS Lab APT Exposure Map

Mobility APT Defensive Validation Backlog

Mobility APT Research Source Ledger

Mobility Domain Playbook — Index

windows

Choosing a DLL for Read-only Inspection

Windows Playbook — Index

Read-only DLL Inspection — amsi.dll (Part 1)

Windows 11 Security Engineering — Map of Content

Module 1 — Kernel and Privilege Rings

Module 2 — User Mode and Syscalls

Module 3 — DLLs, Loaders, and PE

Module 4 — Filesystem, Folders, and Artifacts

Module 5 — Processes, Threads, and Handles

Module 6 — Applications, Services, and Autoruns

Module 7 — Security Engineer Map

Lab Workbook — Windows 11 (192.168.50.114)

Windows Defender — Architecture and Rulesets (Deep Dive)

Lab Baseline — Windows 11 (192.168.50.114)

Module 9 — Evidence, Event Logs, and Artifacts

Module 10 — LSASS, Identity, and Authentication

Lab Tools Inventory — Windows 11 (.114)

Module 11 — Sysmon First Hunt Workbook

AD Domain Lab Setup — TESTER.LAB

Module 26 — c2_rust Win11 Implant Hunt Correlation

30-windows-internal-device-scan

Domain Playbooks — Index

5_Projects

Phase 1 — Mobility (M1–M6)

999. Stuff

Automation

Automate OSWE starting routine

Learn Programming

Learn C_C++

**🔹 Fixing "openssl-mingw-w64 not found" & Missing OpenSSL Headers in MinGW**

Learn Python

Learn Rust

Rust Cross-Compilation Guide (Linux to Windows)

Publish Stuff

Digital Garden and github issue

Digital Garden Resources

Using Gemini (and other tools) with the Obsidian Terminal

9999. Projects with Kids

Published — Index

2. Windows AD (moved)

#redteam #training #windows #redirect

Moved

Pillar 2 now lives under 2. Windows/.

Hub: 2. Windows
Architecture: 2.0 Windows Architecture
Deep dives: 2.1a · 2.1b

Connected Pages

2. Windows AD (moved)

Moved

Pages mentioning this page

No other pages mentions this page

Enter your search text in the box above

Select a result to preview

Enter to select

⇅ to navigate

ESC to close