# Security labs, built from the inside out > Hands-on labs by Steven Foerster for exploit development, vulnerability research, AI red teaming, and securing tool-using agents. - Source: https://stevenfoerster.com/tutorials/ Tutorials Start with a learning path below, each one a sequence built to be worked in order. The complete reference library is still available by topic after them. Start here ## Learning paths (10) Every multi-part series, ordered with the paths closest to my current research and practice first. Featured ### [Tuxscope: Linux Kernel Observability with eBPF](https://stevenfoerster.com/tutorials/paths/tuxscope/) Learn how your Linux kernel works by watching it: eleven cumulative labs that build a single eBPF-powered observability tool in Rust, from syscall tracing to container-level visibility and portable CO-RE. 7 tutorial s Featured ### [Embedded Systems & Firmware](https://stevenfoerster.com/tutorials/paths/embedded-systems-firmware/) Build an embedded security lab with Buildroot and QEMU, audit attack surfaces, reverse-engineer firmware, exploit UART consoles and ARM services, and implement secure boot. 7 tutorial s Featured ### [Securing AI Agents](https://stevenfoerster.com/tutorials/paths/securing-ai-agents/) Threat-model and harden autonomous AI agents: reason about the attack surface of agents that run tools, execute shell commands, and act on untrusted input, then design defenses in depth. 4 tutorial s ### [Linux Exploitation Fundamentals](https://stevenfoerster.com/tutorials/paths/linux-exploitation-fundamentals/) A progressive path from CPU registers to remote exploitation, covering stack overflows, ROP chains, NX and ASLR bypasses on x86 and x64 Linux. 14 tutorial s ### [Windows Exploitation](https://stevenfoerster.com/tutorials/paths/windows-exploitation/) Exploit development on Windows, from classic stack overflows through SEH hijacking and egghunter techniques to DEP and ASLR bypasses, culminating in kernel pool exploitation. 7 tutorial s ### [Windows Service Internals](https://stevenfoerster.com/tutorials/paths/windows-service-internals/) Analyze Windows service DLLs, follow local RPC dispatch, reason about impersonation and access tokens, and understand registry authorization across privilege boundaries. 1 tutorial ### [ML for Security](https://stevenfoerster.com/tutorials/paths/ml-for-security/) Apply machine learning to security problems with explicit baselines and constraints: gadget ranking, network anomaly detection, adversarial evasion, binary similarity, temporal validation, and model operations. 9 tutorial s ### [LLM Red Teaming](https://stevenfoerster.com/tutorials/paths/llm-red-teaming/) A progressive path through prompt injection first principles, indirect injection from untrusted data, jailbreaking, system-prompt extraction, and agentic tool-use exploitation. 6 tutorial s ### [Transformers & LLMs](https://stevenfoerster.com/tutorials/paths/transformers-and-llms/) Build core transformer components from scratch and work through the full LLM pipeline: from tokenization and attention through fine-tuning, alignment, and evaluation. 8 tutorial s ### [Local RAG Pipeline](https://stevenfoerster.com/tutorials/paths/local-rag/) Build a local RAG pipeline, connect it to live CVE data, test retrieval poisoning, apply it to SOC alerts, and improve exact-match retrieval with hybrid search. 8 tutorial s Reference library ## Browse by topic - [All tutorials](https://stevenfoerster.com/tutorials/) - [AI](https://stevenfoerster.com/tutorials/#tag=ai) - [Cryptography](https://stevenfoerster.com/tutorials/#tag=cryptography) - [eBPF](https://stevenfoerster.com/tutorials/#tag=ebpf) - [Embedded](https://stevenfoerster.com/tutorials/#tag=embedded) - [Exploitation](https://stevenfoerster.com/tutorials/#tag=exploitation) - [Infrastructure](https://stevenfoerster.com/tutorials/#tag=infrastructure) - [Internals](https://stevenfoerster.com/tutorials/#tag=internals) - [Linux](https://stevenfoerster.com/tutorials/#tag=linux) - [Red Teaming](https://stevenfoerster.com/tutorials/#tag=red-teaming) - [Security](https://stevenfoerster.com/tutorials/#tag=security) - [Windows](https://stevenfoerster.com/tutorials/#tag=windows) - [Adversarial ML](https://stevenfoerster.com/tutorials/#tag=adversarial-ml) - [BM25](https://stevenfoerster.com/tutorials/#tag=bm25) - [CET](https://stevenfoerster.com/tutorials/#tag=cet) - [CFG](https://stevenfoerster.com/tutorials/#tag=cfg) - [Containers](https://stevenfoerster.com/tutorials/#tag=containers) - [Evaluation](https://stevenfoerster.com/tutorials/#tag=evaluation) - [Exploit Development](https://stevenfoerster.com/tutorials/#tag=exploit-development) - [Flash Dumping](https://stevenfoerster.com/tutorials/#tag=flash-dumping) - [Format String](https://stevenfoerster.com/tutorials/#tag=format-string) - [Ghidra](https://stevenfoerster.com/tutorials/#tag=ghidra) - [GOT Overwrite](https://stevenfoerster.com/tutorials/#tag=got-overwrite) - [JTAG](https://stevenfoerster.com/tutorials/#tag=jtag) - [Least Privilege](https://stevenfoerster.com/tutorials/#tag=least-privilege) - [Mitigation Bypass](https://stevenfoerster.com/tutorials/#tag=mitigation-bypass) - [Mitigations](https://stevenfoerster.com/tutorials/#tag=mitigations) - [Ollama](https://stevenfoerster.com/tutorials/#tag=ollama) - [Python](https://stevenfoerster.com/tutorials/#tag=python) - [Sandboxing](https://stevenfoerster.com/tutorials/#tag=sandboxing) - [Search](https://stevenfoerster.com/tutorials/#tag=search) - [seccomp](https://stevenfoerster.com/tutorials/#tag=seccomp) - [Services](https://stevenfoerster.com/tutorials/#tag=services) - [Shadow Stack](https://stevenfoerster.com/tutorials/#tag=shadow-stack) - [SPI](https://stevenfoerster.com/tutorials/#tag=spi) - [Stack Canary](https://stevenfoerster.com/tutorials/#tag=stack-canary) - [Windows Internals](https://stevenfoerster.com/tutorials/#tag=windows-internals) Complete archive ## All tutorials Aug 14, 2026 advanced ## Anatomy of a Windows Service DLL in Ghidra Load a Windows service DLL with matching public symbols, separate hosting from service logic, and turn decompiler output into a reliable component map. - [Embedded](https://stevenfoerster.com/tutorials/#tag=embedded) - [Windows](https://stevenfoerster.com/tutorials/#tag=windows) - [Windows Internals](https://stevenfoerster.com/tutorials/#tag=windows-internals) - [Ghidra](https://stevenfoerster.com/tutorials/#tag=ghidra) - [Services](https://stevenfoerster.com/tutorials/#tag=services) [Read the tutorial](https://stevenfoerster.com/tutorials/anatomy-of-a-windows-service-dll-in-ghidra/) Jun 25, 2026 intermediate ## Least Privilege for Agent Tools: Capability-Scoped Actions Add executor-level policy enforcement to miniagent so each tool is restricted to a declared, narrow set of operations. - [AI](https://stevenfoerster.com/tutorials/#tag=ai) - [Red Teaming](https://stevenfoerster.com/tutorials/#tag=red-teaming) - [Security](https://stevenfoerster.com/tutorials/#tag=security) - [Least Privilege](https://stevenfoerster.com/tutorials/#tag=least-privilege) [Read the tutorial](https://stevenfoerster.com/tutorials/least-privilege-for-agent-tools/) Jun 24, 2026 advanced ## Sandboxing Agent Tool Execution with Containers and seccomp Run miniagent tool execution inside a locked-down container with dropped capabilities and a seccomp profile to close T5 and T8. - [AI](https://stevenfoerster.com/tutorials/#tag=ai) - [Infrastructure](https://stevenfoerster.com/tutorials/#tag=infrastructure) - [Red Teaming](https://stevenfoerster.com/tutorials/#tag=red-teaming) - [Security](https://stevenfoerster.com/tutorials/#tag=security) - [Containers](https://stevenfoerster.com/tutorials/#tag=containers) - [Sandboxing](https://stevenfoerster.com/tutorials/#tag=sandboxing) - [seccomp](https://stevenfoerster.com/tutorials/#tag=seccomp) [Read the tutorial](https://stevenfoerster.com/tutorials/sandboxing-agent-tool-execution/) Jun 23, 2026 intermediate ## Threat Modeling an AI Agent with Shell Access Apply STRIDE threat modeling to an AI agent that can execute shell commands, read files, and act on untrusted user input. - [AI](https://stevenfoerster.com/tutorials/#tag=ai) - [Red Teaming](https://stevenfoerster.com/tutorials/#tag=red-teaming) - [Security](https://stevenfoerster.com/tutorials/#tag=security) [Read the tutorial](https://stevenfoerster.com/tutorials/threat-modeling-ai-agent-with-shell-access/) Jun 22, 2026 intermediate ## Building a Minimal Tool-Calling Agent You Can Harden Build miniagent: a bare-bones Python tool-calling agent with shell, file, and HTTP access, then map the attack surface it creates. - [AI](https://stevenfoerster.com/tutorials/#tag=ai) - [Red Teaming](https://stevenfoerster.com/tutorials/#tag=red-teaming) - [Security](https://stevenfoerster.com/tutorials/#tag=security) - [Ollama](https://stevenfoerster.com/tutorials/#tag=ollama) - [Python](https://stevenfoerster.com/tutorials/#tag=python) [Read the tutorial](https://stevenfoerster.com/tutorials/building-a-minimal-tool-calling-agent/) Jun 6, 2026 intermediate ## Hybrid Search and Reranking for Local RAG Pair BM25 keyword retrieval with dense embedding search via Reciprocal Rank Fusion, then rerank with a cross-encoder to improve recall on rare terms. - [AI](https://stevenfoerster.com/tutorials/#tag=ai) - [Cryptography](https://stevenfoerster.com/tutorials/#tag=cryptography) - [Search](https://stevenfoerster.com/tutorials/#tag=search) - [BM25](https://stevenfoerster.com/tutorials/#tag=bm25) [Read the tutorial](https://stevenfoerster.com/tutorials/hybrid-search-and-reranking-for-rag/) Jun 5, 2026 intermediate ## Evaluating RAG Pipelines with RAGAS and TruLens Build an eval set and measure faithfulness, context precision, context recall, and answer relevancy with RAGAS and TruLens to know if changes actually help. - [AI](https://stevenfoerster.com/tutorials/#tag=ai) - [Cryptography](https://stevenfoerster.com/tutorials/#tag=cryptography) - [Evaluation](https://stevenfoerster.com/tutorials/#tag=evaluation) [Read the tutorial](https://stevenfoerster.com/tutorials/evaluating-rag-pipelines-with-ragas-and-trulens/) Jun 4, 2026 intermediate ## Run a Private AI Assistant in Your SOC Build a RAG pipeline over Wazuh alerts that helps analysts triage incidents without sending data to external services. - [AI](https://stevenfoerster.com/tutorials/#tag=ai) - [Security](https://stevenfoerster.com/tutorials/#tag=security) [Read the tutorial](https://stevenfoerster.com/tutorials/run-a-private-ai-assistant-in-your-soc/) Jun 3, 2026 advanced ## Binary Function Similarity with Graph Neural Networks Represent disassembled functions as control flow graphs, train a graph neural network for similarity embeddings, and apply it to patch diffing. - [AI](https://stevenfoerster.com/tutorials/#tag=ai) - [Embedded](https://stevenfoerster.com/tutorials/#tag=embedded) - [Security](https://stevenfoerster.com/tutorials/#tag=security) [Read the tutorial](https://stevenfoerster.com/tutorials/binary-function-similarity-with-graph-neural-networks/) Jun 2, 2026 intermediate ## Tuxscope Lab 7: Profiling Disk I/O Latency with eBPF HashMaps Use eBPF HashMap state to trace the block layer and measure per-request I/O latency from issue to completion. - [eBPF](https://stevenfoerster.com/tutorials/#tag=ebpf) - [Linux](https://stevenfoerster.com/tutorials/#tag=linux) [Read the tutorial](https://stevenfoerster.com/tutorials/tuxscope-disk-io-profiling/) Jun 1, 2026 advanced ## Bypassing GCC Stack Canaries on Linux Defeat -fstack-protector by leaking canaries via format strings, brute-forcing them across forks, and overwriting \_\_stack\_chk\_fail in the GOT. - [Linux](https://stevenfoerster.com/tutorials/#tag=linux) - [Exploit Development](https://stevenfoerster.com/tutorials/#tag=exploit-development) - [Stack Canary](https://stevenfoerster.com/tutorials/#tag=stack-canary) - [Mitigation Bypass](https://stevenfoerster.com/tutorials/#tag=mitigation-bypass) [Read the tutorial](https://stevenfoerster.com/tutorials/bypassing-stack-canaries-on-linux/) May 14, 2026 advanced ## Threat Intelligence Extraction with Named Entity Recognition Fine-tune a BERT token classifier to extract IOCs, threat actors, and techniques from security reports, then wrap it in a structured extraction function. - [AI](https://stevenfoerster.com/tutorials/#tag=ai) - [Security](https://stevenfoerster.com/tutorials/#tag=security) [Read the tutorial](https://stevenfoerster.com/tutorials/threat-intelligence-extraction-with-ner/) May 13, 2026 intermediate ## Building a Tool-Calling Agent with RAG Build a RAG pipeline with ChromaDB, implement a ReAct-style tool-calling agent, and measure retrieval with precision, recall, MRR, and nDCG. [AI](https://stevenfoerster.com/tutorials/#tag=ai) [Read the tutorial](https://stevenfoerster.com/tutorials/building-a-tool-calling-agent-with-rag/) May 12, 2026 intermediate ## RAG Poisoning: How Adversarial Documents Break Retrieval Pipelines Understand how hidden instructions, topic hijacking, and authority impersonation attacks break RAG pipelines, and build defenses against them. - [AI](https://stevenfoerster.com/tutorials/#tag=ai) - [Cryptography](https://stevenfoerster.com/tutorials/#tag=cryptography) - [Security](https://stevenfoerster.com/tutorials/#tag=security) [Read the tutorial](https://stevenfoerster.com/tutorials/rag-poisoning-how-adversarial-documents-break-retrieval-pipelines/) May 11, 2026 intermediate ## Tuxscope Lab 6: Observing Memory with Page Fault Tracing Trace page faults and OOM kills to understand how Linux implements virtual memory through demand paging. - [eBPF](https://stevenfoerster.com/tutorials/#tag=ebpf) - [Linux](https://stevenfoerster.com/tutorials/#tag=linux) [Read the tutorial](https://stevenfoerster.com/tutorials/tuxscope-memory-observation/) May 9, 2026 advanced ## Encrypted Traffic Classification Classify application types and detect malicious channels in TLS-encrypted traffic using only flow metadata, with a 1D CNN and a gradient boosting baseline. - [AI](https://stevenfoerster.com/tutorials/#tag=ai) - [Infrastructure](https://stevenfoerster.com/tutorials/#tag=infrastructure) - [Security](https://stevenfoerster.com/tutorials/#tag=security) [Read the tutorial](https://stevenfoerster.com/tutorials/encrypted-traffic-classification/) May 8, 2026 intermediate ## System Prompt Extraction and Defense Hardening Techniques for extracting hidden system prompts from LLM applications, and how to harden your prompts against extraction attacks. - [AI](https://stevenfoerster.com/tutorials/#tag=ai) - [Red Teaming](https://stevenfoerster.com/tutorials/#tag=red-teaming) [Read the tutorial](https://stevenfoerster.com/tutorials/system-prompt-extraction/) May 7, 2026 intermediate ## Format String Vulnerabilities on x86 Exploit printf-family functions when user input is the format argument: leak stack values, dump memory at arbitrary addresses, and write a byte into the GOT. - [Internals](https://stevenfoerster.com/tutorials/#tag=internals) - [Linux](https://stevenfoerster.com/tutorials/#tag=linux) - [Exploit Development](https://stevenfoerster.com/tutorials/#tag=exploit-development) - [Format String](https://stevenfoerster.com/tutorials/#tag=format-string) - [GOT Overwrite](https://stevenfoerster.com/tutorials/#tag=got-overwrite) [Read the tutorial](https://stevenfoerster.com/tutorials/format-string-vulnerabilities-x86/) May 6, 2026 advanced ## SPI and JTAG Flash Dumping from Hardware Identify SPI flash chips, dump them with a CH341A programmer or in-circuit SOIC clip, and use OpenOCD over JTAG to extract firmware with no removable chip. - [Embedded](https://stevenfoerster.com/tutorials/#tag=embedded) - [SPI](https://stevenfoerster.com/tutorials/#tag=spi) - [JTAG](https://stevenfoerster.com/tutorials/#tag=jtag) - [Flash Dumping](https://stevenfoerster.com/tutorials/#tag=flash-dumping) [Read the tutorial](https://stevenfoerster.com/tutorials/spi-and-jtag-flash-dumping-from-hardware/) May 2, 2026 advanced ## Adversarial Evasion of ML Security Classifiers Attack a differentiable malware-feature classifier, measure evasion under explicit constraints, and evaluate adversarial training as one defense. - [AI](https://stevenfoerster.com/tutorials/#tag=ai) - [Security](https://stevenfoerster.com/tutorials/#tag=security) - [Adversarial ML](https://stevenfoerster.com/tutorials/#tag=adversarial-ml) [Read the tutorial](https://stevenfoerster.com/tutorials/adversarial-evasion-of-ml-security-classifiers/) May 1, 2026 advanced ## Windows CFG and Hardware-Enforced Stack Protection (CET) How Control Flow Guard validates indirect call targets, why it cripples JOP on Windows 8.1+, and how Win11 hardware shadow stacks layer on via Intel CET. - [Windows](https://stevenfoerster.com/tutorials/#tag=windows) - [Exploit Development](https://stevenfoerster.com/tutorials/#tag=exploit-development) - [Mitigations](https://stevenfoerster.com/tutorials/#tag=mitigations) - [CFG](https://stevenfoerster.com/tutorials/#tag=cfg) - [CET](https://stevenfoerster.com/tutorials/#tag=cet) - [Shadow Stack](https://stevenfoerster.com/tutorials/#tag=shadow-stack) [Read the tutorial](https://stevenfoerster.com/tutorials/windows-cfg-and-cet-mitigations/) Apr 29, 2026 advanced ## DNS Exfiltration Detection with Sequence Models Build an LSTM that detects DNS tunneling and data exfiltration by analyzing sequences of DNS queries, and compare against a per-query feature baseline. - [AI](https://stevenfoerster.com/tutorials/#tag=ai) - [Infrastructure](https://stevenfoerster.com/tutorials/#tag=infrastructure) - [Security](https://stevenfoerster.com/tutorials/#tag=security) [Read the tutorial](https://stevenfoerster.com/tutorials/dns-exfiltration-detection-with-sequence-models/) Apr 28, 2026 advanced ## Secure Boot and Firmware Integrity Verification Implement a verified boot chain on embedded Linux with U-Boot FIT image signing, then attack it: downgrade attacks, unsigned image rejection, and bypasses. - [Embedded](https://stevenfoerster.com/tutorials/#tag=embedded) - [Linux](https://stevenfoerster.com/tutorials/#tag=linux) - [Security](https://stevenfoerster.com/tutorials/#tag=security) [Read the tutorial](https://stevenfoerster.com/tutorials/secure-boot-and-firmware-integrity-verification/) Apr 27, 2026 intermediate ## Tool Use and Agentic Exploitation Attack LLM agents through confused deputy problems, tool argument injection, and data exfiltration via tool chains, with hands-on Ollama exercises. - [AI](https://stevenfoerster.com/tutorials/#tag=ai) - [Red Teaming](https://stevenfoerster.com/tutorials/#tag=red-teaming) [Read the tutorial](https://stevenfoerster.com/tutorials/tool-use-agentic-exploitation/) Apr 21, 2026 intermediate ## Connect Your RAG Pipeline to Live CVE Feeds Pull from the NVD API and OSV.dev, implement incremental ingestion, and add metadata filtering to your local RAG pipeline. - [AI](https://stevenfoerster.com/tutorials/#tag=ai) - [Cryptography](https://stevenfoerster.com/tutorials/#tag=cryptography) - [Security](https://stevenfoerster.com/tutorials/#tag=security) [Read the tutorial](https://stevenfoerster.com/tutorials/connect-your-rag-pipeline-to-live-cve-feeds/) Apr 20, 2026 intermediate ## Local RAG with PDF Documents Parse PDFs, handle tables and layout-aware chunking, extract metadata, and feed structured content into your local RAG pipeline. - [AI](https://stevenfoerster.com/tutorials/#tag=ai) - [Cryptography](https://stevenfoerster.com/tutorials/#tag=cryptography) - [Infrastructure](https://stevenfoerster.com/tutorials/#tag=infrastructure) [Read the tutorial](https://stevenfoerster.com/tutorials/local-rag-with-pdf-documents/) Apr 18, 2026 intermediate ## Add a Chat Interface to Your Local RAG Pipeline Wrap your local RAG pipeline in a Streamlit chat UI with conversation history, streaming responses, and source citations that show where every answer came from. - [AI](https://stevenfoerster.com/tutorials/#tag=ai) - [Cryptography](https://stevenfoerster.com/tutorials/#tag=cryptography) - [Infrastructure](https://stevenfoerster.com/tutorials/#tag=infrastructure) [Read the tutorial](https://stevenfoerster.com/tutorials/add-a-chat-interface-to-your-local-rag-pipeline/) Apr 17, 2026 intermediate ## Chain-of-Thought and Reasoning Evaluation Compare direct and chain-of-thought prompting on math, implement self-consistency via majority voting, and evaluate code generation with Pass@K. [AI](https://stevenfoerster.com/tutorials/#tag=ai) [Read the tutorial](https://stevenfoerster.com/tutorials/chain-of-thought-and-reasoning-evaluation/) Apr 13, 2026 advanced ## Phishing URL Detection with Fine-Tuned Transformers Fine-tune a DistilBERT model to classify phishing vs legitimate URLs, compare against a TF-IDF baseline, and explore tokenization challenges with URL strings. - [AI](https://stevenfoerster.com/tutorials/#tag=ai) - [Security](https://stevenfoerster.com/tutorials/#tag=security) [Read the tutorial](https://stevenfoerster.com/tutorials/phishing-url-detection-with-fine-tuned-transformers/) Apr 11, 2026 advanced ## Exploiting an Embedded Service: Buffer Overflow on ARM Cross-compile a vulnerable network daemon for ARM, exploit a stack buffer overflow with ARM-specific techniques, and build ARM ROP chains in a QEMU/GDB lab. - [Embedded](https://stevenfoerster.com/tutorials/#tag=embedded) - [Exploit Development](https://stevenfoerster.com/tutorials/#tag=exploit-development) [Read the tutorial](https://stevenfoerster.com/tutorials/exploiting-an-embedded-service-buffer-overflow-on-arm/) Apr 10, 2026 intermediate ## Tuxscope Lab 5: Tracing Process Lifecycle with eBPF Trace fork, exec, and exit events in real time to understand how Linux creates, transforms, and destroys processes. - [eBPF](https://stevenfoerster.com/tutorials/#tag=ebpf) - [Linux](https://stevenfoerster.com/tutorials/#tag=linux) [Read the tutorial](https://stevenfoerster.com/tutorials/tuxscope-process-lifecycle/) Apr 8, 2026 advanced ## Windows Kernel Pool Overflow Foundations with HEVD Trigger and analyze a pool buffer overflow in a vulnerable Windows kernel driver, groom the kernel pool, and map the privilege-escalation stage that follows. - [Exploitation](https://stevenfoerster.com/tutorials/#tag=exploitation) - [Internals](https://stevenfoerster.com/tutorials/#tag=internals) - [Linux](https://stevenfoerster.com/tutorials/#tag=linux) - [Windows](https://stevenfoerster.com/tutorials/#tag=windows) - [Exploit Development](https://stevenfoerster.com/tutorials/#tag=exploit-development) [Read the tutorial](https://stevenfoerster.com/tutorials/windows-kernel-exploitation-pool-overflow/) Apr 7, 2026 intermediate ## Network Intrusion Detection with Autoencoders Build a PyTorch autoencoder trained only on normal network flows to detect intrusions as high-reconstruction-error outliers, and compare with Isolation Forest. - [AI](https://stevenfoerster.com/tutorials/#tag=ai) - [Infrastructure](https://stevenfoerster.com/tutorials/#tag=infrastructure) - [Security](https://stevenfoerster.com/tutorials/#tag=security) [Read the tutorial](https://stevenfoerster.com/tutorials/network-intrusion-detection-with-autoencoders/) Mar 24, 2026 advanced ## Bypassing ASLR on Windows Defeat Windows ASLR with non-ASLR modules, partial pointer overwrites, and information leaks to build reliable exploits against randomized address spaces. - [Exploitation](https://stevenfoerster.com/tutorials/#tag=exploitation) - [Internals](https://stevenfoerster.com/tutorials/#tag=internals) - [Windows](https://stevenfoerster.com/tutorials/#tag=windows) - [Exploit Development](https://stevenfoerster.com/tutorials/#tag=exploit-development) [Read the tutorial](https://stevenfoerster.com/tutorials/bypassing-aslr-on-windows/) Mar 23, 2026 advanced ## Preference Tuning with DPO Implement the third stage of LLM training: train a reward model on preference pairs, run DPO to align without reinforcement learning, and compare to best-of-N. [AI](https://stevenfoerster.com/tutorials/#tag=ai) [Read the tutorial](https://stevenfoerster.com/tutorials/preference-tuning-with-dpo/) Mar 23, 2026 intermediate ## Tuxscope Lab 4: Network Monitoring Monitor TCP connections in real time by probing tcp\_v4\_connect and inet\_csk\_accept, capture source and destination IPs, ports, and connection direction. - [eBPF](https://stevenfoerster.com/tutorials/#tag=ebpf) - [Infrastructure](https://stevenfoerster.com/tutorials/#tag=infrastructure) - [Linux](https://stevenfoerster.com/tutorials/#tag=linux) [Read the tutorial](https://stevenfoerster.com/tutorials/tuxscope-network-monitoring/) Mar 20, 2026 intermediate ## Indirect Prompt Injection Through Untrusted Data Explore how adversarial content in retrieved documents, emails, and web pages can hijack LLM behavior, from RAG poisoning to cross-plugin attacks. - [AI](https://stevenfoerster.com/tutorials/#tag=ai) - [Red Teaming](https://stevenfoerster.com/tutorials/#tag=red-teaming) [Read the tutorial](https://stevenfoerster.com/tutorials/indirect-prompt-injection-untrusted-data/) Mar 20, 2026 intermediate ## Tuxscope Lab 3: File I/O Observation Probe the VFS layer with kprobes on vfs\_read and vfs\_write to observe per-process file I/O volume in real time. - [eBPF](https://stevenfoerster.com/tutorials/#tag=ebpf) - [Linux](https://stevenfoerster.com/tutorials/#tag=linux) [Read the tutorial](https://stevenfoerster.com/tutorials/tuxscope-file-io-observation/) Mar 19, 2026 intermediate ## Efficient Fine-Tuning with LoRA and Quantization Fine-tune a language model with LoRA on a fraction of its parameters, compare FP32/FP16/INT8/NF4 inference, and weigh Flash Attention's tradeoffs. [AI](https://stevenfoerster.com/tutorials/#tag=ai) [Read the tutorial](https://stevenfoerster.com/tutorials/efficient-fine-tuning-with-lora-and-quantization/) Mar 18, 2026 advanced ## Bypassing DEP with ROP on Windows Build a ROP chain on Windows to bypass Data Execution Prevention, using mona.py to find gadgets and VirtualProtect to mark shellcode executable. - [Exploitation](https://stevenfoerster.com/tutorials/#tag=exploitation) - [Internals](https://stevenfoerster.com/tutorials/#tag=internals) - [Windows](https://stevenfoerster.com/tutorials/#tag=windows) - [Exploit Development](https://stevenfoerster.com/tutorials/#tag=exploit-development) [Read the tutorial](https://stevenfoerster.com/tutorials/bypassing-dep-with-rop-on-windows/) Mar 18, 2026 intermediate ## UART and Serial Console Exploitation Identify and interact with UART interfaces on embedded devices using QEMU, extract boot logs, interrupt U-Boot for a root shell, and dump flash over serial. [Embedded](https://stevenfoerster.com/tutorials/#tag=embedded) [Read the tutorial](https://stevenfoerster.com/tutorials/uart-and-serial-console-exploitation/) Mar 17, 2026 intermediate ## Tuxscope Lab 1: Hello eBPF Build your first eBPF program in Rust, trace write syscalls and stream events from kernel space to userspace with PerfEventArray. - [eBPF](https://stevenfoerster.com/tutorials/#tag=ebpf) - [Linux](https://stevenfoerster.com/tutorials/#tag=linux) [Read the tutorial](https://stevenfoerster.com/tutorials/tuxscope-hello-ebpf/) Mar 17, 2026 beginner ## Tuxscope Lab 2: Syscall Tracing Trace all system calls in real time, capture syscall IDs from raw\_syscalls/sys\_enter, resolve them to names, and switch from PerfEventArray to RingBuf. - [eBPF](https://stevenfoerster.com/tutorials/#tag=ebpf) - [Linux](https://stevenfoerster.com/tutorials/#tag=linux) [Read the tutorial](https://stevenfoerster.com/tutorials/tuxscope-syscall-tracing/) Mar 16, 2026 intermediate ## Jailbreaking: Bypassing LLM Alignment Controls A taxonomy of jailbreak techniques: persona attacks, encoding tricks, few-shot poisoning, and multi-turn escalation, with a rubric for scoring bypasses. - [AI](https://stevenfoerster.com/tutorials/#tag=ai) - [Red Teaming](https://stevenfoerster.com/tutorials/#tag=red-teaming) [Read the tutorial](https://stevenfoerster.com/tutorials/jailbreaking-bypassing-alignment/) Mar 16, 2026 intermediate ## LLM Decoding and Prompt Strategies Compare greedy, beam search, top-k, and nucleus decoding on GPT-2, visualize MoE routing, and test zero-shot, few-shot, and chain-of-thought prompting. [AI](https://stevenfoerster.com/tutorials/#tag=ai) [Read the tutorial](https://stevenfoerster.com/tutorials/llm-decoding-and-prompt-strategies/) Mar 10, 2026 intermediate ## BERT Fine-Tuning and Position Embeddings Explore encoder-only transformers through BERT: inspect masked-LM predictions, fine-tune on sentiment, compare position embeddings, and benchmark distillation. [AI](https://stevenfoerster.com/tutorials/#tag=ai) [Read the tutorial](https://stevenfoerster.com/tutorials/bert-fine-tuning-and-position-embeddings/) Mar 10, 2026 beginner ## Tokenization and Attention from Scratch Build the four foundational transformer components from scratch in NumPy: tokenization, word embeddings, self-attention, and positional encoding. [AI](https://stevenfoerster.com/tutorials/#tag=ai) [Read the tutorial](https://stevenfoerster.com/tutorials/tokenization-and-attention-from-scratch/) Mar 10, 2026 beginner ## Transformers & LLMs: Series Introduction and Environment Setup An overview of the Transformers and LLMs series: what it covers, who it is for, how the companion code is structured, and how to set up your environment. - [AI](https://stevenfoerster.com/tutorials/#tag=ai) - [Infrastructure](https://stevenfoerster.com/tutorials/#tag=infrastructure) [Read the tutorial](https://stevenfoerster.com/tutorials/transformers-and-llms-series-introduction/) Mar 9, 2026 advanced ## Multi-Tenant GPU Isolation Analyze GPU isolation (MIG, MPS, vGPU, time-slicing) from an offensive angle, mapping the attack surface of shared GPUs and what leaks across tenant boundaries. - [AI](https://stevenfoerster.com/tutorials/#tag=ai) - [Infrastructure](https://stevenfoerster.com/tutorials/#tag=infrastructure) - [Security](https://stevenfoerster.com/tutorials/#tag=security) [Read the tutorial](https://stevenfoerster.com/tutorials/multi-tenant-gpu-isolation/) Mar 6, 2026 beginner ## Prompt Injection from First Principles Build a vulnerable LLM chatbot with Ollama, exploit it with direct and indirect prompt injection, then layer defenses to see why it is fundamentally hard. - [AI](https://stevenfoerster.com/tutorials/#tag=ai) - [Red Teaming](https://stevenfoerster.com/tutorials/#tag=red-teaming) [Read the tutorial](https://stevenfoerster.com/tutorials/prompt-injection-first-principles/) Mar 4, 2026 beginner ## Ollama: Run LLMs Locally Install and manage local LLMs with Ollama: CLI usage, model management, Modelfiles, the REST API, tool-calling models, Open WebUI, and coding-tool integration. [AI](https://stevenfoerster.com/tutorials/#tag=ai) [Read the tutorial](https://stevenfoerster.com/tutorials/ollama/) Mar 2, 2026 intermediate ## Linux Exploitation Lab Setup Build and run the vulnerable binaries used throughout the Linux Exploitation Fundamentals series, in Docker or natively. - [Exploitation](https://stevenfoerster.com/tutorials/#tag=exploitation) - [Infrastructure](https://stevenfoerster.com/tutorials/#tag=infrastructure) - [Linux](https://stevenfoerster.com/tutorials/#tag=linux) - [Exploit Development](https://stevenfoerster.com/tutorials/#tag=exploit-development) [Read the tutorial](https://stevenfoerster.com/tutorials/linux-exploitation-lab-setup/) Feb 27, 2026 beginner ## LLM Tokens, Context Windows, and the Attack Surface How LLMs process text through tokenization, manage context windows, and where these mechanics create exploitable attack surface for red teamers. - [AI](https://stevenfoerster.com/tutorials/#tag=ai) - [Red Teaming](https://stevenfoerster.com/tutorials/#tag=red-teaming) [Read the tutorial](https://stevenfoerster.com/tutorials/llm-tokens-context-attack-surface/) Feb 20, 2026 intermediate ## WebMCP Attack Surfaces Build a web app that exposes tools to AI agents via WebMCP, then demonstrate tool poisoning, schema mismatch, response injection, and cross-tool exfiltration. - [AI](https://stevenfoerster.com/tutorials/#tag=ai) - [Red Teaming](https://stevenfoerster.com/tutorials/#tag=red-teaming) [Read the tutorial](https://stevenfoerster.com/tutorials/webmcp-attack-surfaces/) Jan 30, 2026 advanced ## Container Escape: Namespace and Privilege Breakouts Exploit four container escape techniques, privileged mounts, Docker socket abuse, namespace escapes, and cgroup release\_agent, then harden against each one. - [Infrastructure](https://stevenfoerster.com/tutorials/#tag=infrastructure) - [Linux](https://stevenfoerster.com/tutorials/#tag=linux) - [Exploit Development](https://stevenfoerster.com/tutorials/#tag=exploit-development) [Read the tutorial](https://stevenfoerster.com/tutorials/container-escape-namespace-and-privilege-breakouts/) Jan 15, 2026 advanced ## Training a ROP Gadget Classifier with XGBoost Build a machine learning classifier that predicts whether a ROP gadget is useful for exploit chains, using features extracted from x64 disassembly and XGBoost. - [AI](https://stevenfoerster.com/tutorials/#tag=ai) - [Exploitation](https://stevenfoerster.com/tutorials/#tag=exploitation) - [Exploit Development](https://stevenfoerster.com/tutorials/#tag=exploit-development) [Read the tutorial](https://stevenfoerster.com/tutorials/training-a-rop-gadget-classifier-with-xgboost/) Jan 9, 2026 intermediate ## Embedded Linux Attack Surface Analysis Build a stripped embedded Linux image with Buildroot, then audit open ports, syscalls, suid binaries, kernel modules, and writable paths, and harden it. - [Embedded](https://stevenfoerster.com/tutorials/#tag=embedded) - [Linux](https://stevenfoerster.com/tutorials/#tag=linux) - [Security](https://stevenfoerster.com/tutorials/#tag=security) [Read the tutorial](https://stevenfoerster.com/tutorials/attack-surface-analysis-of-a-minimal-embedded-linux-image/) Jan 8, 2026 advanced ## Firmware RE with Binwalk and Ghidra Extract firmware from an IoT update file, unpack the filesystem, identify interesting binaries, and reverse engineer them in Ghidra to find bugs. [Embedded](https://stevenfoerster.com/tutorials/#tag=embedded) [Read the tutorial](https://stevenfoerster.com/tutorials/firmware-extraction-and-reverse-engineering-with-binwalk-and-ghidra/) Dec 18, 2025 intermediate ## Cross-Compiling with Buildroot and QEMU Set up an embedded Linux dev environment: build a custom ARM image with Buildroot, boot it in QEMU, and remotely debug binaries with GDB. No hardware required. - [Embedded](https://stevenfoerster.com/tutorials/#tag=embedded) - [Exploitation](https://stevenfoerster.com/tutorials/#tag=exploitation) - [Linux](https://stevenfoerster.com/tutorials/#tag=linux) [Read the tutorial](https://stevenfoerster.com/tutorials/cross-compiling-and-debugging-with-buildroot-qemu-and-gdb/) Dec 11, 2025 intermediate ## Anomaly Detection on Linux Audit Logs Build a lightweight anomaly detection pipeline that flags suspicious Linux sessions using auditd logs, feature engineering, and scikit-learn; no GPU required. - [AI](https://stevenfoerster.com/tutorials/#tag=ai) - [Linux](https://stevenfoerster.com/tutorials/#tag=linux) - [Security](https://stevenfoerster.com/tutorials/#tag=security) [Read the tutorial](https://stevenfoerster.com/tutorials/anomaly-detection-on-linux-audit-logs-with-isolation-forest/) Dec 4, 2025 intermediate ## Build a Local RAG Pipeline with Ollama and ChromaDB A hands-on guide to building a retrieval-augmented generation pipeline that runs entirely on your machine, using security advisories as the knowledge base. - [AI](https://stevenfoerster.com/tutorials/#tag=ai) - [Cryptography](https://stevenfoerster.com/tutorials/#tag=cryptography) - [Infrastructure](https://stevenfoerster.com/tutorials/#tag=infrastructure) [Read the tutorial](https://stevenfoerster.com/tutorials/build-a-local-rag-pipeline-with-ollama-and-chromadb/) Nov 6, 2025 advanced ## Windows Egghunter Exploitation Use egghunter shellcode to locate and execute a larger payload when buffer space is limited. - [Exploitation](https://stevenfoerster.com/tutorials/#tag=exploitation) - [Internals](https://stevenfoerster.com/tutorials/#tag=internals) - [Windows](https://stevenfoerster.com/tutorials/#tag=windows) - [Exploit Development](https://stevenfoerster.com/tutorials/#tag=exploit-development) [Read the tutorial](https://stevenfoerster.com/tutorials/windows-egghunter-exploitation/) Oct 30, 2025 advanced ## Windows SEH Overflow Exploitation Exploit Structured Exception Handler (SEH) overflows on Windows, bypassing SafeSEH protections to achieve code execution. - [Exploitation](https://stevenfoerster.com/tutorials/#tag=exploitation) - [Internals](https://stevenfoerster.com/tutorials/#tag=internals) - [Windows](https://stevenfoerster.com/tutorials/#tag=windows) - [Exploit Development](https://stevenfoerster.com/tutorials/#tag=exploit-development) [Read the tutorial](https://stevenfoerster.com/tutorials/windows-seh-overflow-exploitation/) Oct 23, 2025 intermediate ## Windows Stack Buffer Overflow Exploit a classic stack buffer overflow on Windows, from crash discovery to shellcode execution using Immunity Debugger and mona.py. - [Exploitation](https://stevenfoerster.com/tutorials/#tag=exploitation) - [Internals](https://stevenfoerster.com/tutorials/#tag=internals) - [Windows](https://stevenfoerster.com/tutorials/#tag=windows) - [Exploit Development](https://stevenfoerster.com/tutorials/#tag=exploit-development) [Read the tutorial](https://stevenfoerster.com/tutorials/windows-stack-buffer-overflow/) Oct 16, 2025 advanced ## Remote Exploitation with Socket Reuse Shellcode Exploit a remote x86 Linux service: leak addresses to bypass PIE, split shellcode across discontinuous buffers, and reuse the socket to evade firewall rules. - [Exploitation](https://stevenfoerster.com/tutorials/#tag=exploitation) - [Internals](https://stevenfoerster.com/tutorials/#tag=internals) - [Linux](https://stevenfoerster.com/tutorials/#tag=linux) - [Exploit Development](https://stevenfoerster.com/tutorials/#tag=exploit-development) [Read the tutorial](https://stevenfoerster.com/tutorials/remote-exploitation-socket-reuse/) Oct 9, 2025 advanced ## Bypassing ASLR on x64 Linux Defeat Address Space Layout Randomization using fixed addresses in the binary when PIE is disabled. - [Exploitation](https://stevenfoerster.com/tutorials/#tag=exploitation) - [Internals](https://stevenfoerster.com/tutorials/#tag=internals) - [Linux](https://stevenfoerster.com/tutorials/#tag=linux) - [Exploit Development](https://stevenfoerster.com/tutorials/#tag=exploit-development) [Read the tutorial](https://stevenfoerster.com/tutorials/bypassing-aslr-x64/) Oct 2, 2025 advanced ## Bypassing NX with mprotect ROP Chains Use Return-Oriented Programming to call mprotect() and make stack memory executable, then jump to shellcode on x64 Linux. - [Exploitation](https://stevenfoerster.com/tutorials/#tag=exploitation) - [Internals](https://stevenfoerster.com/tutorials/#tag=internals) - [Linux](https://stevenfoerster.com/tutorials/#tag=linux) - [Exploit Development](https://stevenfoerster.com/tutorials/#tag=exploit-development) [Read the tutorial](https://stevenfoerster.com/tutorials/bypassing-nx-with-mprotect-rop/) Sep 25, 2025 advanced ## Bypassing NX with ROP on x64 Linux Use Return-Oriented Programming to bypass NX protection on 64-bit Linux, chaining gadgets to call system() with /bin/sh. - [Exploitation](https://stevenfoerster.com/tutorials/#tag=exploitation) - [Internals](https://stevenfoerster.com/tutorials/#tag=internals) - [Linux](https://stevenfoerster.com/tutorials/#tag=linux) - [Exploit Development](https://stevenfoerster.com/tutorials/#tag=exploit-development) [Read the tutorial](https://stevenfoerster.com/tutorials/bypassing-nx-with-rop-x64/) Sep 18, 2025 intermediate ## ROP Gadget Hunting Toolkit A practical reference for finding, filtering, and verifying ROP gadgets with ropper, ROPgadget, and GDB-PEDA, plus chaining strategies. - [Exploitation](https://stevenfoerster.com/tutorials/#tag=exploitation) - [Internals](https://stevenfoerster.com/tutorials/#tag=internals) - [Linux](https://stevenfoerster.com/tutorials/#tag=linux) - [Exploit Development](https://stevenfoerster.com/tutorials/#tag=exploit-development) [Read the tutorial](https://stevenfoerster.com/tutorials/rop-gadget-hunting-toolkit/) Sep 11, 2025 intermediate ## Stack Buffer Overflow on x64 Linux Exploit stack buffer overflows on 64-bit Linux systems, understanding the differences from x86 including register usage and address handling. - [Exploitation](https://stevenfoerster.com/tutorials/#tag=exploitation) - [Internals](https://stevenfoerster.com/tutorials/#tag=internals) - [Linux](https://stevenfoerster.com/tutorials/#tag=linux) - [Exploit Development](https://stevenfoerster.com/tutorials/#tag=exploit-development) [Read the tutorial](https://stevenfoerster.com/tutorials/stack-buffer-overflow-x64/) Sep 4, 2025 intermediate ## Return-to-libc Attack on x86 Bypass NX protection by returning to libc functions instead of executing shellcode on the stack. Learn to leak addresses and chain function calls. - [Exploitation](https://stevenfoerster.com/tutorials/#tag=exploitation) - [Internals](https://stevenfoerster.com/tutorials/#tag=internals) - [Linux](https://stevenfoerster.com/tutorials/#tag=linux) - [Exploit Development](https://stevenfoerster.com/tutorials/#tag=exploit-development) [Read the tutorial](https://stevenfoerster.com/tutorials/return-to-libc-attack-x86/) Aug 28, 2025 beginner ## Redirecting Execution to Hidden Functions Learn how to exploit a basic stack buffer overflow to redirect execution to a hidden function in a SUID binary and gain elevated privileges. - [Exploitation](https://stevenfoerster.com/tutorials/#tag=exploitation) - [Internals](https://stevenfoerster.com/tutorials/#tag=internals) - [Linux](https://stevenfoerster.com/tutorials/#tag=linux) - [Exploit Development](https://stevenfoerster.com/tutorials/#tag=exploit-development) [Read the tutorial](https://stevenfoerster.com/tutorials/redirecting-execution-to-hidden-functions/) Aug 21, 2025 intermediate ## Basic Stack Buffer Overflow on x86 Exploit a stack buffer overflow on 32-bit Linux, from vulnerability discovery to shellcode execution. - [Exploitation](https://stevenfoerster.com/tutorials/#tag=exploitation) - [Internals](https://stevenfoerster.com/tutorials/#tag=internals) - [Linux](https://stevenfoerster.com/tutorials/#tag=linux) - [Exploit Development](https://stevenfoerster.com/tutorials/#tag=exploit-development) [Read the tutorial](https://stevenfoerster.com/tutorials/basic-stack-buffer-overflow-x86/) Aug 14, 2025 intermediate ## Linux Syscalls for Exploit Development How Linux syscalls work at the instruction level, int 0x80 vs syscall, register setup, and the key syscalls used in shellcode and ROP chains. - [Exploitation](https://stevenfoerster.com/tutorials/#tag=exploitation) - [Internals](https://stevenfoerster.com/tutorials/#tag=internals) - [Linux](https://stevenfoerster.com/tutorials/#tag=linux) - [Exploit Development](https://stevenfoerster.com/tutorials/#tag=exploit-development) [Read the tutorial](https://stevenfoerster.com/tutorials/linux-syscalls-for-exploit-development/) Aug 8, 2025 beginner ## The Stack: Memory Layout and Function Frames How the stack works in x86 and x64 Linux: memory layout, push/pop mechanics, function prologues and epilogues, and why overflows overwrite the return address. - [Internals](https://stevenfoerster.com/tutorials/#tag=internals) - [Linux](https://stevenfoerster.com/tutorials/#tag=linux) [Read the tutorial](https://stevenfoerster.com/tutorials/stack-memory-layout-and-function-frames/) Aug 7, 2025 beginner ## x86 and x64 Registers and Calling Conventions A practical guide to CPU registers, partial register access, flags, and how function arguments are passed on x86 and x64 Linux. - [Internals](https://stevenfoerster.com/tutorials/#tag=internals) - [Linux](https://stevenfoerster.com/tutorials/#tag=linux) [Read the tutorial](https://stevenfoerster.com/tutorials/x86-x64-registers-and-calling-conventions/) No tutorials match the selected topic.