Tutorials

Security labs, built from the inside out

Start with a learning path below, each one a sequence built to be worked in order. The complete reference library is still available by topic after them.

Start here

Learning paths (10)

Every multi-part series, ordered with the paths closest to my current research and practice first.

Featured

Tuxscope: Linux Kernel Observability with eBPF

Learn how your Linux kernel works by watching it: eleven cumulative labs that build a single eBPF-powered observability tool in Rust, from syscall tracing to container-level visibility and portable CO-RE.

7 tutorial s

Featured

Embedded Systems & Firmware

Build an embedded security lab with Buildroot and QEMU, audit attack surfaces, reverse-engineer firmware, exploit UART consoles and ARM services, and implement secure boot.

7 tutorial s

Featured

Securing AI Agents

Threat-model and harden autonomous AI agents: reason about the attack surface of agents that run tools, execute shell commands, and act on untrusted input, then design defenses in depth.

4 tutorial s

Linux Exploitation Fundamentals

A progressive path from CPU registers to remote exploitation, covering stack overflows, ROP chains, NX and ASLR bypasses on x86 and x64 Linux.

14 tutorial s

Windows Exploitation

Exploit development on Windows, from classic stack overflows through SEH hijacking and egghunter techniques to DEP and ASLR bypasses, culminating in kernel pool exploitation.

7 tutorial s

Windows Service Internals

Analyze Windows service DLLs, follow local RPC dispatch, reason about impersonation and access tokens, and understand registry authorization across privilege boundaries.

4 tutorial s

ML for Security

Apply machine learning to security problems with explicit baselines and constraints: gadget ranking, network anomaly detection, adversarial evasion, binary similarity, temporal validation, and model operations.

9 tutorial s

LLM Red Teaming

A progressive path through prompt injection first principles, indirect injection from untrusted data, jailbreaking, system-prompt extraction, and agentic tool-use exploitation.

6 tutorial s

Transformers & LLMs

Build core transformer components from scratch and work through the full LLM pipeline: from tokenization and attention through fine-tuning, alignment, and evaluation.

8 tutorial s

Local RAG Pipeline

Build a local RAG pipeline, connect it to live CVE data, test retrieval poisoning, apply it to SOC alerts, and improve exact-match retrieval with hybrid search.

8 tutorial s

Complete archive

All tutorials

Sep 4, 2026

advanced

Windows Registry Security: DACLs, Access Tokens, and Privileged Services

Understand how Windows authorizes registry access, how key handles preserve granted rights, and why privileged services can cross a caller boundary.

Security labs, built from the inside out

Learning paths (10)

Tuxscope: Linux Kernel Observability with eBPF

Embedded Systems & Firmware

Securing AI Agents

Linux Exploitation Fundamentals

Windows Exploitation

Windows Service Internals

ML for Security

LLM Red Teaming

Transformers & LLMs

Local RAG Pipeline

Browse by topic

All tutorials

Windows Registry Security: DACLs, Access Tokens, and Privileged Services

Windows Service Impersonation: Which Token Does an RPC Handler Use?

Windows Local RPC and ALPC: From Client Call to Service Dispatcher

Anatomy of a Windows Service DLL in Ghidra

Least Privilege for Agent Tools: Capability-Scoped Actions

Sandboxing Agent Tool Execution with Containers and seccomp

Threat Modeling an AI Agent with Shell Access

Building a Minimal Tool-Calling Agent You Can Harden

Hybrid Search and Reranking for Local RAG

Evaluating RAG Pipelines with RAGAS and TruLens

Run a Private AI Assistant in Your SOC

Binary Function Similarity with Graph Neural Networks

Tuxscope Lab 7: Profiling Disk I/O Latency with eBPF HashMaps

Bypassing GCC Stack Canaries on Linux

Threat Intelligence Extraction with Named Entity Recognition

Building a Tool-Calling Agent with RAG

RAG Poisoning: How Adversarial Documents Break Retrieval Pipelines

Tuxscope Lab 6: Observing Memory with Page Fault Tracing

Encrypted Traffic Classification

System Prompt Extraction and Defense Hardening

Format String Vulnerabilities on x86

SPI and JTAG Flash Dumping from Hardware

Adversarial Evasion of ML Security Classifiers

Windows CFG and Hardware-Enforced Stack Protection (CET)

DNS Exfiltration Detection with Sequence Models

Secure Boot and Firmware Integrity Verification

Tool Use and Agentic Exploitation

Connect Your RAG Pipeline to Live CVE Feeds

Local RAG with PDF Documents

Add a Chat Interface to Your Local RAG Pipeline

Chain-of-Thought and Reasoning Evaluation

Phishing URL Detection with Fine-Tuned Transformers

Exploiting an Embedded Service: Buffer Overflow on ARM

Tuxscope Lab 5: Tracing Process Lifecycle with eBPF

Windows Kernel Pool Overflow Foundations with HEVD

Network Intrusion Detection with Autoencoders

Bypassing ASLR on Windows

Preference Tuning with DPO

Tuxscope Lab 4: Network Monitoring

Indirect Prompt Injection Through Untrusted Data

Tuxscope Lab 3: File I/O Observation

Efficient Fine-Tuning with LoRA and Quantization

Bypassing DEP with ROP on Windows

UART and Serial Console Exploitation

Tuxscope Lab 1: Hello eBPF

Tuxscope Lab 2: Syscall Tracing

Jailbreaking: Bypassing LLM Alignment Controls

LLM Decoding and Prompt Strategies

BERT Fine-Tuning and Position Embeddings

Tokenization and Attention from Scratch

Transformers & LLMs: Series Introduction and Environment Setup

Multi-Tenant GPU Isolation

Prompt Injection from First Principles

Ollama: Run LLMs Locally

Linux Exploitation Lab Setup

LLM Tokens, Context Windows, and the Attack Surface

WebMCP Attack Surfaces

Container Escape: Namespace and Privilege Breakouts

Training a ROP Gadget Classifier with XGBoost

Embedded Linux Attack Surface Analysis

Firmware RE with Binwalk and Ghidra

Cross-Compiling with Buildroot and QEMU

Anomaly Detection on Linux Audit Logs

Build a Local RAG Pipeline with Ollama and ChromaDB

Windows Egghunter Exploitation

Windows SEH Overflow Exploitation