PowerShell for operators. The syntax you actually need, working examples for a port scanner, a hash-cracking loop, and a web crawler, and an honest take on where PowerShell fits and where it gets you caught on a Windows engagement.
A working tour of Cody Thomas’s Mythic C2 framework. Architecture (Docker-deployed server plus pluggable agents and C2 profiles), the actual current agent lineup in 2026 (Apollo, Poseidon, Apfell, Athena, Xenon, Medusa, Thanatos, Freyja, Sage), the install workflow with mythic-cli, how Mythic compares to Sliver, Cobalt Strike, and Havoc, and where it fits in a modern engagement stack.
A working overview of SharpSocks, Nettitude’s .NET tool for tunneling a SOCKS proxy through an implant inside the target network. Architecture, deployment, how it pairs with PoshC2 and other frameworks, the pivoting patterns operators actually use it for, and how it compares to modern alternatives (Chisel, ligolo-ng, gost) in 2026.
A working tour of Ryan Cobb’s Covenant C2 framework from an operator’s perspective. Architecture (server, Grunts, listeners, dynamically compiled .NET tasks), AMSI and ETW patching as a survival prerequisite on modern Windows, SMB named-pipe P2P routing for jumping into segmented zones, Donut shellcode wrapping for non-.NET payloads, and writing custom tasks. Covenant is effectively unmaintained, but the design choices it pioneered are still in Sliver, Mythic, and Havoc.
A working operator’s view of Nishang, the PowerShell post-exploitation toolkit Nikhil Mittal built starting in 2012. What it does well, where Defender catches it on sight in 2026, which modules still matter, and how it fits with modern frameworks (Empire 5.x, Sliver, Mythic). Plus an operator-honest read on AMSI and Constrained Language Mode and what they leave behind for stock PowerShell tools on a current Windows endpoint.
A deep-dive into PsExec for offensive work. How it works under the hood, how to leverage pass-the-hash with Impacket, service-name evasion, and the forensic footprint it leaves so you know when to reach for it and when to reach for something else.
A deep-dive into sc.exe for offensive work. Weaponize the Windows Service Control Manager for remote code execution, persist via service failure actions, exploit weak service ACLs, and load kernel drivers.
A deep-dive into Wmic for offensive work. Interrogate system internals, move laterally, find security software, abuse XSL transforms for code execution, and understand the forensic footprint WMI leaves behind.
A guide to Active Directory reconnaissance with built-in tooling. Discover privileged accounts, identify service accounts, spot unconstrained delegation, and operate when RSAT isn’t installed.
A comprehensive deep-dive into advanced Windows command-line tools. Learn how to leverage modern binaries like curl and tar, abuse legacy tools for download and execution, and perform stealthy data theft and persistence without triggering alerts.
How Pass-the-Hash actually works against RDP — what makes it normally fail, why Restricted Admin Mode flips that around, the correct xfreerdp syntax, RDP-over-SOCKS tuning, and the Logon Type 3 anomaly that gives the technique away.
A working guide to network tunneling for offensive ops — iptables NAT, every flavor of SSH forwarding (including reverse SOCKS and ProxyJump), Windows netsh portproxy, socat, and the modern compiled tools that have largely replaced everything else (Chisel and Ligolo-ng).
A walkthrough of Impacket’s SMB tooling for offensive work — smbclient.py, smbserver.py, secretsdump.py, and ntlmrelayx.py. Covers Pass-the-Hash, hash capture via UNC paths, DCSync, and cross-protocol NTLM relay.
This article explores how Red Team members can use alternate data streams on Windows NTFS to hide data, with specific examples and cautionary considerations.
A comprehensive guide to mastering port scanning on both Linux and Windows, covering standard tools like Nmap, stealthy built-in techniques, and modern PowerShell-based enumeration.