n options.

Introducing Kaine User-Defined C2, expanded Linux post-ex capabilities, refactored port forwarding and sleep masking, enhanced .NET/PowerSafe execution, Beacon Object File improvements, In-Memory PE E...

YouTube video by Georgia Weidman

Same tactics, very different results. This advisory compares defensive outcomes from two red team assessments. Learn what drove detection and implement key actions to protect your organization from…

Golang Port of Crystal Palace. Contribute to sliverarmory/crystal-grotto development by creating an account on GitHub.

The IncludeSec team explores the practical considerations of AI-assisted source code analysis. Observing results produced with frontier vs locally-hosted models, various harness orchestration designs,...

Metasploit Framework 6.5 launches with Malleable C2 profile support, new MCP server integration support for AI-tooling, NTLM relaying upgrades, and MITRE ATT&CK tagging to streamline threat emulation

After 21 years of stewardship, UTSA and the Center for Infrastructure Assurance and Security are transitioning the National Collegiate Cyber Defense Competition to a new home. Dave Cowen and I are …

Esto no es un tutorial. Ya existen muchos. Esto es una inmersión arquitectónica profunda en Crystal Palace, el linker PIC y el lenguaje de script de enlazado cr

Flaneur. Hacker.

A feature tour of Crystal Palace.

Another Crystal Palace and Tradecraft Garden release is now available. This release fills some gaps from recent releases and rounds out the feature set (aka, stuff I wanted to ship, but didn’…

BingusLdr: CET Compatible Stack Spoofing

Almost all Active Directory enumeration goes through LDAP (389/636), which is precisely the most watched channel in the domain. ADWS is a side door on port 9389 that accepts the same LDAP queries but ...

A new Tradecraft Garden and Crystal Palace release is available. This release introduces a proper install script and consolidates its commands behind a cpl [verb] CLI interface. I’ve also added an …

There is a documented enforcement gap in Conditional Access policies that apply to “all resources” but have an exclusion for at least one resource. What is not documented, is that this gap is much lar...

An architectural POC for long-running BOFs.

An introduction to Havoc Professional 0.7 K-Noir, featuring a new Linux implant for x86_64 and AArch64, CET compliant stack spoofing and rules systems, new Direct and P2P communication channels, new m...

Crystal Palace Evasion kit for Sliver. Contribute to licitrasimone/CrystalSliver development by creating an account on GitHub.

We’re at the 12th release of Crystal Palace and marking one year in the Tradecraft Garden. This release adds reference relaxation to make global references PIC-friendly. I’ve also added stack unwin…

A reflective retrospective on Gargoyle, temporal memory state, the 2026 refresh, and what better validation teaches defenders.

Last week, memN0ps published DoublePulsar: A User-defined Reflective Loader in the Crystal Palace and Tradecraft Garden Era. It’s a lengthy blog post, about 50 printed pages. And, most of those are…

I just passed Certified Red Team Lead (CRTL) with full points! CRTL is an advanced malware development and EDR evasion certification, one of the more technical certs in the red team space. I got ac...