Tutorials

Technical guides and walkthroughs.

Hands-on tutorials covering system administration, security hardening, and infrastructure automation.

Learning Paths

Structured series that build skills progressively.

Windows Exploitation

Exploit development on Windows — from classic stack overflows through SEH hijacking to egghunter techniques using Immunity Debugger and mona.py.

  1. 1
  2. 2
  3. 3

Embedded Systems & Firmware

Build an embedded security lab with Buildroot and QEMU, audit the attack surface of minimal Linux images, and reverse-engineer real firmware.

  1. 1
  2. 2
  3. 3

ML for Security

Apply machine learning to security operations — from local RAG pipelines and anomaly detection to ROP gadget classification with XGBoost.

  1. 1
  2. 2
  3. 3

LLM Red Teaming

A progressive path from LLM fundamentals through prompt injection, jailbreaking, and agentic exploitation to structured red teaming methodology for production AI systems.

  1. 1

Feb 27, 2026

beginner

LLM Tokens, Context Windows, and the Attack Surface

Understand how large language models process text through tokenization, manage context windows, and where these mechanics create exploitable attack surface for red teamers.

Read the tutorial

Jan 15, 2026

advanced

Training a ROP Gadget Classifier with XGBoost

Build a machine learning classifier that predicts whether a ROP gadget is useful for exploit chains, using features extracted from x64 disassembly and XGBoost.

Read the tutorial

Jan 9, 2026

intermediate

Attack Surface Analysis of a Minimal Embedded Linux Image

Build a stripped embedded Linux image with Buildroot, then systematically audit it: open ports, exposed syscalls, suid binaries, kernel modules, and writable paths — then harden it and measure the difference.

Read the tutorial

Jan 8, 2026

advanced

Firmware Extraction and Reverse Engineering with Binwalk and Ghidra

Extract firmware from an IoT device update file, unpack the filesystem, identify interesting binaries, and reverse engineer them in Ghidra to find real vulnerabilities.

Read the tutorial

Dec 18, 2025

intermediate

Cross-Compiling and Debugging with Buildroot, QEMU, and GDB

Set up a complete embedded Linux development environment: build a custom ARM image with Buildroot, boot it in QEMU, and remotely debug binaries with GDB — no hardware required.

Read the tutorial

Dec 11, 2025

intermediate

Anomaly Detection on Linux Audit Logs with Isolation Forest

Build a lightweight anomaly detection pipeline that flags suspicious Linux sessions using auditd logs, feature engineering, and scikit-learn — no GPU required.

Read the tutorial

Dec 4, 2025

intermediate

Build a Local RAG Pipeline with Ollama and ChromaDB

A hands-on guide to building a retrieval-augmented generation pipeline that runs entirely on your machine, using security advisories as the knowledge base.

Read the tutorial

Nov 13, 2025

intermediate

Recovering from a Pop!_OS Kernel Panic on System76

Step-by-step recovery for a Pop!_OS kernel panic after an interrupted update.

Read the tutorial

Oct 23, 2025

intermediate

Windows Stack Buffer Overflow

Exploit a classic stack buffer overflow on Windows, from crash discovery to shellcode execution using Immunity Debugger and mona.py.

Read the tutorial

Oct 16, 2025

advanced

Remote Exploitation with Socket Reuse Shellcode

Exploit a remote x86 Linux service by leaking addresses to bypass PIE, splitting shellcode across discontinuous buffers, and reusing the existing socket to evade firewall rules.

Read the tutorial

Oct 2, 2025

advanced

Bypassing NX with mprotect ROP Chains

Use Return-Oriented Programming to call mprotect() and make stack memory executable, then jump to shellcode on x64 Linux.

Read the tutorial

Sep 25, 2025

advanced

Bypassing NX with ROP on x64 Linux

Use Return-Oriented Programming to bypass NX protection on 64-bit Linux, chaining gadgets to call system() with /bin/sh.

Read the tutorial

Sep 18, 2025

intermediate

ROP Gadget Hunting Toolkit: ropper, ROPgadget, and GDB-PEDA

A practical reference for finding, filtering, and verifying ROP gadgets using ropper, ROPgadget, and GDB-PEDA. Covers common workflows, advanced filtering, and chaining strategies.

Read the tutorial

Sep 11, 2025

intermediate

Stack Buffer Overflow on x64 Linux

Exploit stack buffer overflows on 64-bit Linux systems, understanding the differences from x86 including register usage and address handling.

Read the tutorial

Sep 4, 2025

intermediate

Return-to-libc Attack on x86

Bypass NX protection by returning to libc functions instead of executing shellcode on the stack. Learn to leak addresses and chain function calls.

Read the tutorial

Aug 28, 2025

beginner

Redirecting Execution to Hidden Functions

Learn how to exploit a basic stack buffer overflow to redirect execution to a hidden function in a SUID binary and gain elevated privileges.

Read the tutorial

Aug 21, 2025

intermediate

Basic Stack Buffer Overflow on x86

A comprehensive guide to exploiting stack buffer overflows on 32-bit Linux systems, from vulnerability discovery to shellcode execution.

Read the tutorial

Aug 14, 2025

intermediate

Linux Syscalls for Exploit Development

How Linux syscalls work at the instruction level — int 0x80 vs syscall, register setup, and the key syscalls used in shellcode and ROP chains.

Read the tutorial

Aug 8, 2025

beginner

The Stack: Memory Layout and Function Frames

How the stack works in x86 and x64 Linux — process memory layout, push and pop mechanics, function prologues and epilogues, and why buffer overflows can overwrite the return address.

Read the tutorial

Aug 7, 2025

beginner

x86 and x64 Registers and Calling Conventions

A practical guide to CPU registers, partial register access, flags, and how function arguments are passed on x86 and x64 Linux.

Read the tutorial