JF / 2026 Available
JF / 2026 Machine walkthroughs, malware analysis, and technique deep-dives — always with a defender's eye on detection.
Reading ntdll.dll from disk to overwrite the EDR's userland hooks — the step-by-step technique, the two offset representations (1024 vs 4096), and the modern context: why unhooking alone is dead and what replaced it.
Combining PPID Spoofing, Memory Mapping, and Early Bird APC injection to hide process lineage, dodge WriteProcessMemory detections, and execute before a process's own entry point — plus why ETW-Ti still catches it.
How runtime SSN resolution works, why indirect syscalls still leave a trail, and how Module Stomping hides a payload inside a legitimate DLL to defeat static memory classification — plus the four ways modern EDRs still find it.
How endpoint security products hook ntdll in userland to see every kernel call, and the three main techniques offensive tooling uses to bypass that visibility — with the exact artifacts each one leaves behind.
How to escalate from any domain credential to Domain Admin by coercing the DC to authenticate, relaying that authentication to Active Directory Certificate Services, and extracting a certificate for the machine account. A deep dive into the AD CS misconfiguration that requires no template abuse — and the Kerberos relay technique that bypasses a domain-wide NTLM block.
How to build and detect a covert channel over ICMP. The protocol most networks allow by default, why it works, and the specific telemetry that catches it — including a defense that costs nothing to deploy.
The two-VM design that makes Whonix different from every other anonymity tool, why stream isolation matters more than encryption, and a practical workflow for downloading files from the dark web without becoming the next victim.
A Docker-based hacking environment that replaces the monolithic Kali VM with per-engagement containers. How the wrapper works, why isolation matters more than tools, and the security trade-offs that the container model introduces.
Rolling your own VPN instead of trusting a provider: SSH hardening, OpenVPN setup, certificate management, and the honest trade-offs — maintenance, attribution, and what a self-hosted tunnel does and does not protect against.
A single USB drive that boots a dozen operating systems, each with its own persistent storage. How Ventoy's architecture works, how the persistence plugin binds data to ISOs, and why the project's security posture has drawn comparison to the xz-utils backdoor.
Microsoft removed it in 2020. The community kept it alive. A technical analysis of the architecture behind booting a full Windows installation from a USB drive, why feature upgrades break it, and the forensic traces it leaves on every host it touches.
Running Windows apps on Linux without Wine, without dual-booting, and without noticing the VM underneath. A technical analysis of how WinBoat works, the critical RCE that exposed its local API, and why seamless cross-system integration is a security trade most users never see.
Open-source face-swapping used to be a research toy. It is now a pipeline that runs on a consumer GPU, produces broadcast-quality results, and defeats the liveness checks that KYC and video verification rely on.
Modern voice cloning needs seconds of audio and a few dollars of compute. What that means for the phone-based verification that every bank, help desk, and government office still relies on — and why the defense is not better voice authentication.
A phishing technique that runs a real Firefox inside a Docker container, redirects the victim through a hosts file modification, and steals the authenticated session — no cloned login page, no certificate warning, no URL to spot.
The FBI used a Microsoft Global Device Identifier (GDID) to track a member of Scattered Spider across countries, despite his use of a VPN. A technical deep-dive into the persistent Windows identifier that makes anonymity on Windows a myth — including how to see your own.
The Grayhat Warfare problem: a walkthrough of how misconfigured S3 buckets are discovered, indexed, and exploited, why the default configuration makes this easy, and what actually fixes it.
A practical guide to FOFA, Shodan, Censys and ZoomEye for attack surface discovery. Query syntax, real workflows, the differences between engines, and how defenders can reduce their exposure.
The EXIF data is gone. It doesn't matter. A complete workflow for going from a photo to a name, a city, or a map pin using open-source tools, reverse image search, and disciplined pivoting.