In the second part of this series, we take Scarecrow and make it our own by changing how payloads are stored and executed. By the end of this experiment we can get a better understanding of the iterative testing approach that can keep our payloads alive....

Scarecrow is an open-source Go loader designed to take raw shellcode and execute it while utilizing ETW/AMSI patching, EDR unhooking and direct syscalls. In this first post of a series, we look at its feature and dig in, to understand how it works....

The OSEP certification has proved to be the most difficult exam I’ve taken so far. A lengthy 700 pages long PDF, tons of exercises, 6 challenge labs and a grueling 48-hour exam simulating a black-box penetration test. In this post I’ve collected my thoughts on the course in general, the preparation and the exam process…...

Recently I completed a bootcamp offered by Pentesteracademy which dives into exploring and exploiting Azure services. The course has a clear offensive focus and can be used as a great starting point if you have little to no previous experience...