UncleSp1d3r Blog

A working analyst’s tour of dynamic malware analysis.

An operator’s tour of physical pen testing tradecraft.

A working tour of Ryan Cobb’s Covenant C2 framework from an operator’s perspective.

A working tour of IoT hacking from an operator’s perspective.

A working tour of Java from a security perspective.

The full arc of the internet’s history, from ARPANET and packet switching through the BBS era, Usenet, the Web at CERN, the commercial online services (AOL, CompuServe, Prodigy), search engines, the Napster era, mobile, cloud, IoT, and the cybersecurity h…

A working operator’s view of ransomware in 2026.

A working operator’s view of firewall and IDS bypass in 2026.

A working operator’s view of Nishang, the PowerShell post-exploitation toolkit Nikhil Mittal built starting in 2012.

A working operator’s view of CSRF and XXE in 2026.

A working operator’s view of Go as the target-side language of choice.

A storyteller’s tour of the graphics card, from the oscilloscope-style vector monitors that drew Asteroids and the SGI workstations that rendered Jurassic Park, through the 3dfx Voodoo and the GeForce 256 that gave us hardware T&L, into the CUDA era when…

A working operator’s view of what an incident responder finds when they run Volatility on a memory image.

A working operator’s view of pretexting in 2026.

A working tour of the BC Security Empire fork in 2026.

A working operator’s look at the layer 2 and layer 3 attacks that actually move an engagement forward: IPv6 shadow networks and mitm6/ntlmrelayx, NAC bypass against modern profiling-aware appliances, DTP and double-tagging VLAN hopping, and HSRP/VRRP gate…

A working tour of the Python that matters on offensive engagements.

A look back at the Millennium Bug as the largest successful preventative engineering project in computing history.

A working primer on static and dynamic PE analysis from the operator’s seat.

A working operator’s view of password cracking past rockyou.txt.

A walk through the modern phishing campaign architecture from an operator’s seat.

A Rails primer for operators who need to assess or exploit a Rails application.

How Netscape Navigator went from 80% market share to bankruptcy in roughly twelve years, the technologies it left behind (SSL, JavaScript, cookies, the same-origin policy), the 1995 Goldberg–Wagner RNG break that ended “the algorithm is strong” as a defen…

How a stack-based buffer overflow actually corrupts a stack frame, what the classic mitigations (ASLR, DEP/NX, stack canaries) do and how each gets bypassed, why modern Windows and Linux added more layers (CFG, CET shadow stacks, PIE, PAC), and the develo…

A working operator’s view of red teaming versus pen testing, the Unified Kill Chain as a practical mental model rather than a theoretical framework, how modern C2 infrastructure is actually built (and why domain fronting isn’t the answer anymore), purple…

A working operator’s guide to Metasploit.

A working guide to social engineering for red team engagements.

A guide to using Nim for offensive tooling.

PE/ELF/Mach-O structure, x86/x64 assembly, disassembly versus decompilation, dynamic analysis with debuggers and Frida, and the anti-RE tricks you’ll meet on the way.

Past nmap -sC -sV — TCP/IP behavior that shapes scan results, NSE for real enumeration, IDS-aware timing, packet-level evasion, and where RustScan and Masscan are actually faster.

Manual UNION-based exfiltration, error-based and blind SQLi, WAF evasion, out-of-band data theft over DNS and HTTP, second-order injection, and the sqlmap flags that matter on real engagements.

A comprehensive deep-dive into the Rust programming language for offensive security.

A comprehensive deep-dive into the history and evolution of the computer mouse.

A deep-dive into XSS from an offensive perspective.

An introduction to penetration testing for people getting into the field.

A guide for red team operators coming from Linux.

A deep-dive into PsExec for offensive work.

A deep-dive into sc.exe for offensive work.

A deep-dive into Wmic for offensive work.

A deep-dive into microcode.

A guide to Active Directory reconnaissance with built-in tooling.

A comprehensive deep-dive into advanced Windows command-line tools.

A practical walkthrough of Chisel for tunneling — reverse SOCKS, port forwarding, TLS hardening with a real cert, source-level evasion tweaks, and how it compares to Ligolo-ng.

How Pass-the-Hash actually works against RDP — what makes it normally fail, why Restricted Admin Mode flips that around, the correct xfreerdp syntax, RDP-over-SOCKS tuning, and the Logon Type 3 anomaly that gives the technique away.

A working guide to network tunneling for offensive ops — iptables NAT, every flavor of SSH forwarding (including reverse SOCKS and ProxyJump), Windows netsh portproxy, socat, and the modern compiled tools that have largely replaced everything else (Chisel…

A red team walkthrough of Impacket’s mssqlclient.py — discovery, every common auth method, RCE via xp_cmdshell / OLE Automation / CLR, hash capture via xp_dirtree, linked-server hops, file transfer over TDS, and finding the data that actually matters.

A walkthrough of Impacket’s SMB tooling for offensive work — smbclient.py, smbserver.py, secretsdump.py, and ntlmrelayx.py.

A long walkthrough of smbclient for offensive work — SMB dialects, enumeration, bulk exfiltration, Pass-the-Ticket via Kerberos, opsec around credentials, and what the blue team sees when you connect.

A long-form Ruby walkthrough for security folks.

Master the art of flight without leaving a footprint.