How ICS and SCADA environments actually get breached, network segmentation, weak authentication, unpatched legacy software, thin monitoring, and vulnerable remote access, paired with the real incidents (Triton, Mirai, WannaCry, Stuxnet, Oldsmar, the Ukrainian grid attack) that show each failure mode in production.
A specialized guide for Red Team operators on exfiltrating and migrating data from a target MySQL database to a local PostgreSQL instance. Learn how to use Docker for rapid infrastructure deployment, pgloader for automated schema conversion, and handle both live network migrations and offline dump analysis.
A guide to SSH multiplexing and master control sockets for red team work. Covers running concurrent sessions over a single TCP connection, reducing connection churn, and the risks of socket hijacking.
This article explains Scenario-Based Testing (SBT) in detail, its benefits, tools and techniques used, and provides examples of how SBT can be used in Red Team Exercises to identify vulnerabilities and weaknesses in an organization’s security defenses.
Part three of the Red Team Operations series. How operators simulate supply chain attacks on engagement, the canonical real-world case studies that justify the budget (SolarWinds, NotPetya, CCleaner, Kaseya, Codecov, 3CX, MOVEit, XZ Utils), the engagement-scoping considerations that make supply-chain testing different from regular red team work, and the defender controls (SBOM, signing, build provenance via SLSA, dependency review) that actually move the needle.
A working overview of SharpSocks, Nettitude’s .NET tool for tunneling a SOCKS proxy through an implant inside the target network. Architecture, deployment, how it pairs with PoshC2 and other frameworks, the pivoting patterns operators actually use it for, and how it compares to modern alternatives (Chisel, ligolo-ng, gost) in 2026.
An operator’s walkthrough of red team engagement types (network pentest, social engineering, physical, red-vs-blue, purple team, multiscenario, full spectrum, tabletop), the five-phase methodology that structures most engagements (recon, scanning, exploitation, post-exploitation, reporting), the actual tooling stack at each phase, and the case studies (DoD Cyber Flag, Verizon DBIR-derived attack-pattern data) worth grounding the work in.
An operator’s tour of physical pen testing tradecraft. Social engineering and pretexting, lock picking and bypass, RFID and NFC cloning with the Proxmark3 and Flipper Zero, Wiegand attacks with BLEKey/ESPKey, surveillance and counter-surveillance, network dropboxes (Hak5 LAN Turtle, Packet Squirrel), HID attack tools (Bash Bunny, Rubber Ducky), and the USB-drop technique. Closes with the Coalfire Iowa courthouse arrest as a worked example of why authorization scope matters.
A working tour of IoT hacking from an operator’s perspective. Hardware attack surface (UART, JTAG, SPI flash dumps), firmware extraction and emulation with binwalk and qemu-user-static, radio attacks (SDR replay, BLE GATT writes, Zigbee key sniffing), the CAN bus and SocketCAN on automotive targets, and exposed MQTT brokers. Closes with Mirai, the Jeep Cherokee remote takeover, and Rose & Ramsey’s BLE smart-lock work at DEF CON 24.
A working operator’s view of firewall and IDS bypass in 2026. Fragmentation and decoy scanning against weak setups, DNS and ICMP tunneling where the channel is still open, SSH SOCKS proxying for quick pivots, Chisel and Ligolo-ng for serious tunneling work, and the realities of domain fronting now that the major CDNs have killed it. Plus what modern next-gen firewall and IDS technology (TLS inspection, JA3/JA4 fingerprinting, ECH) leaves open for the operator and what it doesn’t.
A working operator’s view of CSRF and XXE in 2026. Where the classic attacks still work, where browser defaults (SameSite=Lax in Chrome/Edge, secure-by-default XML parsers) have closed the textbook cases, and the modern attack surfaces that still produce findings (GET state-change endpoints, JSON content-type confusion, SVG and OOXML file upload, SAML implementations, the SysAid CVE-2025-2775 XXE-to-RCE chain).
A working operator’s view of what an incident responder finds when they run Volatility on a memory image. The plugins that hunt your beacon (pslist, psscan, malfind, netscan, windows.cmdline), the modern tradecraft that survives them (sleep masking via Ekko/FOLIAGE, module stomping vs phantom DLL hollowing, indirect syscalls), and the 2025-2026 changes that have made some of the old tricks stop working: Credential Guard, HVCI, ETW-based command line capture.
A working operator’s look at the layer 2 and layer 3 attacks that actually move an engagement forward: IPv6 shadow networks and mitm6/ntlmrelayx, NAC bypass against modern profiling-aware appliances, DTP and double-tagging VLAN hopping, and HSRP/VRRP gateway hijacking with Loki. Plus the 2024–2026 defender changes (Server 2025 EPA, LDAP channel binding) that have made some of these noisier.
A walk through the modern phishing campaign architecture from an operator’s seat. Domain warming, redirector tiers, ASN and geo cloaking, CAPTCHA gates to defeat sandbox click-time URL scanning, HTML smuggling via the Blob API, SVG smuggling, and homograph tricks. Plus the current state of the arms race in 2026 with AiTM kits like Tycoon and EvilProxy, and what defenders should actually focus on.
How a stack-based buffer overflow actually corrupts a stack frame, what the classic mitigations (ASLR, DEP/NX, stack canaries) do and how each gets bypassed, why modern Windows and Linux added more layers (CFG, CET shadow stacks, PIE, PAC), and the development workflow for writing a first exploit against an unhardened target. Aimed at operators who’ve used Metasploit but never written an exploit from scratch.
A working operator’s view of red teaming versus pen testing, the Unified Kill Chain as a practical mental model rather than a theoretical framework, how modern C2 infrastructure is actually built (and why domain fronting isn’t the answer anymore), purple teaming as collaborative tuning, deconfliction with the white cell, and the operator-side OPSEC habits that decide whether you finish the engagement quietly.
Past nmap -sC -sV — TCP/IP behavior that shapes scan results, NSE for real enumeration, IDS-aware timing, packet-level evasion, and where RustScan and Masscan are actually faster.
Manual UNION-based exfiltration, error-based and blind SQLi, WAF evasion, out-of-band data theft over DNS and HTTP, second-order injection, and the sqlmap flags that matter on real engagements.
A deep-dive into XSS from an offensive perspective. Beyond alert(1) — cookie theft, weaponized BeEF hooks, blind XSS, and bypassing modern WAFs and CSPs.
An introduction to penetration testing for people getting into the field. The differences between VA, PT, and red teaming; PTES as a workflow; what actually goes into a good report; and the legal lines you can’t cross.
A guide for red team operators coming from Linux. Where Darwin differs from Linux at the userland and kernel level, how SIP and TCC change what root means, how to live off the land with JXA and AppleScript, and how to persist with launchd.
Master the art of flight without leaving a footprint. A comprehensive guide to disabling shell history, managing operational hygiene, and understanding the forensic limit of these techniques across Bash, Zsh, Fish, and PowerShell on Linux.
This article explores how Red Team members can use alternate data streams on Windows NTFS to hide data, with specific examples and cautionary considerations.
A comprehensive guide to mastering port scanning on both Linux and Windows, covering standard tools like Nmap, stealthy built-in techniques, and modern PowerShell-based enumeration.