Red team operations
Authorized adversary operations measured through their business objective, runtime authority, technical actions, defender signals, response decisions, evidence, and verified recovery—not access alone.
Every matching record.
Methods and named-vulnerability research remain visually and editorially separate.
Field notes 3
Resilient Out-of-Band C2 Pipelines: Framing, AEAD Encryption, and Covert Channels in Go
Designing fault-tolerant, out-of-band command-and-control pipelines for authorized security testing: forward error correction via XOR parity, P-256 ECDHE session encryption, and 9 covert transport protocols in ghostlink.
8 min read ↗Red Team · Nov 9, 2026Kernel-Level Packet Sniffing with eBPF/XDP: Real-Time Credential Extraction and Exposure Auditing
How eBPF and XDP bypass userspace packet-capture bottlenecks to intercept authentication handshakes, NetNTLMv2 hashes, and cleartext credentials at line rate: architecture, protocol dissectors, and exposure auditing with driftnet2.
8 min read ↗Pentest · Nov 6, 2026Skeleton Key: A Master Password for Every Account in the Domain
After Domain Admin, the game changes from getting in to staying in. The Skeleton Key patches the Domain Controller's KDC in memory so the single password 'mimikatz' unlocks every account — demonstrated live against KINGSLANDING, alongside the memory SSP and why DSRM does not apply in this lab.
7 min read ↗