Programming

Comprehensive guide to Bash scripting fundamentals with security best practices, modern techniques, and ethical penetration testing examples for red team professionals.

A working knowledge of the DOM matters on both sides of a web security engagement. This post covers the modern DOM APIs (querySelector, classList, dataset, event listeners), the DOM-based XSS patterns to recognize during code review, and the safer alternatives (Trusted Types, sanitization APIs) that defenders should reach for.

This article explores advanced object-oriented programming concepts in Python, such as decorators, inheritance, abstract base classes, composition, aggregation, and properties, with practical code examples tailored for security engineers building analysis, detection, and instrumentation tools.

This article covers the powerful metaprogramming techniques in Ruby, including method_missing, define_method, dynamically defining classes and modules, and executing code dynamically with eval, that allow writing code that writes code to make programs more flexible, dynamic, and powerful.

This article is an introduction to the Lua programming language for pen testers and red team members, covering its basic concepts and syntax, examples of its use in network analysis, password cracking, and web scraping, and weighing its pros and cons compared to other languages.

PowerShell for operators. The syntax you actually need, working examples for a port scanner, a hash-cracking loop, and a web crawler, and an honest take on where PowerShell fits and where it gets you caught on a Windows engagement.

A working tour of Kotlin from a security perspective. Language basics for operators who haven’t written Kotlin before, the Android RE reality (Kotlin became Google’s first-class Android language in 2017 and most modern Android apps you reverse-engineer are now Kotlin), the operator-side applications that make sense in Kotlin versus the ones that don’t, and the trade-offs versus Java, Python, and Go for offensive work in 2026.

A working tour of C from a security perspective. Language basics for operators who haven’t written C since college, then the offensive applications that make C indispensable (writing exploits against C-language vulnerabilities, crafting shellcode, building low-level tools and implants), reverse engineering of compiled C binaries, and the trade-offs of C versus modern alternatives (Rust, Go, Python) for operator work in 2026.

A working tour of Swift from a security perspective. Language basics for operators who haven’t written Swift before, then the offensive applications that matter on Apple platforms (network primitives via the Network framework, port scanning with NWConnection, hashing with CryptoKit and SwiftCrypto, file-system reconnaissance, OSINT-style API consumption, basic TCP listeners, payload encoding), and the trade-offs of Swift versus Python, Go, and Rust for operator use in 2026.

A working tour of Java from a security perspective. Language basics for operators who haven’t written Java before, then the offensive applications that matter (network scanning, web exploitation, Burp extensions, Java deserialization, JNDI injection and the Log4Shell era), reverse engineering of obfuscated Java with CFR and JADX, and the trade-offs of Java versus other languages on offensive engagements.

A working operator’s view of Go as the target-side language of choice. Cross-compilation for any OS from any host, statically linked binaries with no runtime dependencies, native Win32 calling, and the modern C2 agent ecosystem that runs on it (Sliver, Havoc’s Go agent). Plus the realities of Go in 2026, the static fingerprints EDR uses to identify it on disk, and what garble and -trimpath do (and don’t) help with.

A working tour of the Python that matters on offensive engagements. Raw sockets, binary parsing with struct, ctypes for Win32 calls and shellcode loaders, Scapy for packet crafting, and the current state of the libraries every operator ends up writing on top of (Impacket, NetExec, pwntools, mitm6).

A Rails primer for operators who need to assess or exploit a Rails application. Covers the MVC layout that tells you where the bugs live, strong parameters and the permit! footgun, what SECRET_KEY_BASE actually gives you on modern Rails versus the classic Marshal RCE chain on Rails 3, the raw/html_safe XSS surface, IDOR patterns, and the static-analysis tools (Brakeman, bundler-audit) that should be your first pass.

A guide to using Nim for offensive tooling. Covers language fundamentals, the winim WinAPI bindings, compile-time string obfuscation with macros, direct syscall stubs, the offensive Nim ecosystem (OffensiveNim, NimlineWhispers, Nim-RunPE, NimPackt, Nimcrypt2), and an honest take on what edge Nim actually still gives you against modern EDR.

A comprehensive deep-dive into the Rust programming language for offensive security. Learn the core concepts of ownership and borrowing, master idiomatic error handling, build a multi-threaded port scanner, and discover how to use “Unsafe Rust” for shellcode injection and high-performance exploit development.

A long-form Ruby walkthrough for security folks. Covers syntax, the object model, blocks and metaprogramming, networking, FFI, and writing Metasploit modules.