JF / 2026 Tools, labs, and experiments — offensive, defensive, and everything in between.
A complete penetration test report of a Windows Active Directory environment: NFS unauthenticated export, plaintext credentials, Kerberos password spraying, PetitPotam coercion, NTLM relay to AD CS web enrollment, and DCSync. Four chained vulnerabilities leading to domain admin in under two hours.
A complete staged payload pipeline: Sliver mTLS beacon, XOR-obfuscated URL in a custom C stager, PEB process path spoofing, Startup-folder persistence, and delivery wrapped inside a fake Chrome installer with a spoofed Authenticode signature.
A .bat script that weaponizes an unlocked workstation and a USB port — disables Defender, dumps browser credentials with SharpChromium, restores Defender, gone in under a minute. A study of what physical access actually buys an attacker.
Using an open-source terminal-native AI agent to autonomously enumerate and exploit HackTheBox machines. An honest evaluation of what LLM agents can do with Nemotron 3 Ultra 550B, where they fail, and the prompt engineering that makes the difference between a stalled session and a root shell.
A complete setup guide for turning a Raspberry Pi Pico (or Pico W) into a USB HID device that executes pre-defined keystroke payloads. Includes the keyboard layout problem, payload syntax, and the defensive controls that actually work.
A minimal ransomware written in C for Linux, built to understand symmetric encryption, C2 check-in, and the exact telemetry each stage produces on the endpoint.
A browser extension that steals session cookies from Instagram, exfiltrates them to a Flask collector, and demonstrates why unverified extensions are a first-class threat. Also: why HttpOnly does not save you.