A working tour of Cody Thomas’s Mythic C2 framework. Architecture (Docker-deployed server plus pluggable agents and C2 profiles), the actual current agent lineup in 2026 (Apollo, Poseidon, Apfell, Athena, Xenon, Medusa, Thanatos, Freyja, Sage), the install workflow with mythic-cli, how Mythic compares to Sliver, Cobalt Strike, and Havoc, and where it fits in a modern engagement stack.
A working tour of Ryan Cobb’s Covenant C2 framework from an operator’s perspective. Architecture (server, Grunts, listeners, dynamically compiled .NET tasks), AMSI and ETW patching as a survival prerequisite on modern Windows, SMB named-pipe P2P routing for jumping into segmented zones, Donut shellcode wrapping for non-.NET payloads, and writing custom tasks. Covenant is effectively unmaintained, but the design choices it pioneered are still in Sliver, Mythic, and Havoc.
A working operator’s view of Nishang, the PowerShell post-exploitation toolkit Nikhil Mittal built starting in 2012. What it does well, where Defender catches it on sight in 2026, which modules still matter, and how it fits with modern frameworks (Empire 5.x, Sliver, Mythic). Plus an operator-honest read on AMSI and Constrained Language Mode and what they leave behind for stock PowerShell tools on a current Windows endpoint.
A working tour of the BC Security Empire fork in 2026. Listeners, stagers, and the four agent types Empire ships today (PowerShell, Python, IronPython, and Sharpire/C#). Plus an honest read on where Empire still earns its keep in 2026, where Sliver and Havoc have eaten its lunch, and what AMSI evasion actually looks like now that Defender has shipped signatures for the obvious bypasses.
A working operator’s guide to Metasploit. Covers the module taxonomy, why you actually want the database initialized, staged vs non-staged payloads and when each one matters, Meterpreter’s load-bearing extensions (stdapi, kiwi, incognito, priv), pivoting (autoroute, portfwd, SOCKS), and resource scripts for the listener setup you’d otherwise type a hundred times an engagement.
A comprehensive deep-dive into advanced Windows command-line tools. Learn how to leverage modern binaries like curl and tar, abuse legacy tools for download and execution, and perform stealthy data theft and persistence without triggering alerts.