Jekyll2026-05-09T14:10:38+00:00https://robinx0.github.io/feed.xmlROBINX0Offensive Security Research · Red Team Ops · WriteupsIrfanul MontasirAD Privilege Escalation Primitives: Kerberoasting, Shadow Credentials, RBCD, Injection, and BOFs2026-04-19T00:00:00+00:002026-04-19T00:00:00+00:00https://robinx0.github.io/blogs/red-team-ops/ad-escalation-primitives/Irfanul MontasirThe operator's toolkit for moving from domain user to domain admin - Kerberoasting → Golden Ticket, Shadow Credentials via msDS-KeyCredentialLink, RBCD via GenericWrite, modern process injection, and Beacon Object Files that tie it all together. Theory, tradecraft, and OPSEC for each primitive.Server-Side Web Pentest Playbook: Prototype Pollution, OAuth Flaws, SQLi-to-RCE, and SSRF2026-04-18T00:00:00+00:002026-04-18T00:00:00+00:00https://robinx0.github.io/blogs/web-exploitation/server-side-web-pentest-playbook/Irfanul MontasirFour of the highest-impact server-side web vulnerability classes, chained to full compromise. Prototype pollution → RCE via child_process gadgets, OAuth misconfig → account takeover, MSSQL SQLi → SYSTEM via xp_cmdshell + PrintSpoofer, and SSRF → AWS IAM credential theft. Theory, exploitation, and hardening for each.The Userland EDR Bypass Stack: Unhooking, Syscalls, ETW/AMSI, and Kernel Callbacks2026-04-17T00:00:00+00:002026-04-17T00:00:00+00:00https://robinx0.github.io/blogs/edr-bypass/userland-edr-bypass-stack/Irfanul MontasirA comprehensive guide to the layered techniques that make up modern userland EDR evasion - restoring clean ntdll, dynamic syscall resolution via Hell's/Halo's/Tartarus' Gate, indirect syscalls, AMSI/ETW patching, and optional kernel callback removal. Theory, working code, OPSEC, and detection for each layer.Building a C2 Stack: Implants, BOF Loaders, Redirectors, and DoH Channels2026-04-17T00:00:00+00:002026-04-17T00:00:00+00:00https://robinx0.github.io/blogs/c2-development/c2-stack-build-guide/Irfanul MontasirA practical end-to-end guide to building command-and-control infrastructure - a minimal Rust implant, a COFF-parsing BOF loader, resilient redirector chains, and a DNS-over-HTTPS covert channel. How each layer fits together and where OPSEC attention actually pays off.DCSync and DCShadow: Abusing Replication Rights for Credential Theft and Persistence2026-04-16T00:00:00+00:002026-04-16T00:00:00+00:00https://robinx0.github.io/blogs/red-team-ops/dcsync-dcshadow-operations/Irfanul MontasirA complete operator guide to DCSync and DCShadow - the replication APIs MS-DRSR opens up, how to abuse them for NTDS extraction and stealth object modification, and what actually shows up in the 4662 event log.Hardware Breakpoint Hooking: Bypassing Inline EDR Hooks Without Touching Memory2026-04-14T00:00:00+00:002026-04-14T00:00:00+00:00https://robinx0.github.io/blogs/edr-bypass/hardware-breakpoint-hooking/Irfanul MontasirA practical C++ guide to using x86-64 debug registers (DR0-DR7) for user-mode API hooking - how EDRs are blind to hardware breakpoints, when HWBPs beat patching, and how to build a minimal HWBP engine.JWT Algorithm Confusion: None, HS256/RS256 Mix-Ups, and KID Injection2026-04-11T00:00:00+00:002026-04-11T00:00:00+00:00https://robinx0.github.io/blogs/web-exploitation/jwt-algorithm-confusion/Irfanul MontasirA hands-on tour of the JWT attack surface - from the classic alg:none to public-key-as-HMAC-secret confusion, KID path traversal and SQLi, JWK header injection, and weak HS256 secret cracking. With jwt_tool payloads and real exploitation paths.Beacon Object Files from Scratch: COFF Loading, Dynamic Resolution, and Battle-Tested Tradecraft2026-04-09T00:00:00+00:002026-04-09T00:00:00+00:00https://robinx0.github.io/blogs/c2-development/beacon-object-files-guide/Irfanul MontasirA deep guide to writing Beacon Object Files - from understanding the COFF format and Cobalt Strike's BOF runtime to building a production-grade token-duplication BOF with BeaconPrintf, dynamic function resolution, and thread-safe cleanup.Coerced Authentication Attacks: PetitPotam, PrinterBug, DFSCoerce, and the ADCS ESC8 Chain2026-04-07T00:00:00+00:002026-04-07T00:00:00+00:00https://robinx0.github.io/blogs/network-security/coerced-authentication-attacks/Irfanul MontasirA practical guide to authentication coercion in Active Directory - the four RPC primitives that force a remote host to authenticate to you, how to chain them with NTLM relay to ADCS, and why patched doesn't always mean fixed.Sleep Obfuscation Deep Dive: Ekko, Zilean, and Foliage2026-03-29T00:00:00+00:002026-03-29T00:00:00+00:00https://robinx0.github.io/blogs/edr-bypass/sleep-obfuscation-techniques/Irfanul MontasirAdvanced sleep obfuscation techniques that encrypt implant memory during sleep cycles to evade EDR memory scanning - covering Ekko, Zilean, Foliage, and custom implementations.ADCS Abuse: ESC1 Through ESC8 Attack Paths2026-03-27T00:00:00+00:002026-03-27T00:00:00+00:00https://robinx0.github.io/blogs/network-security/adcs-abuse/Irfanul MontasirComprehensive guide to Active Directory Certificate Services misconfigurations - from ESC1 template abuse to NTLM relay on HTTP enrollment. Covers PKINIT internals, the full ESC1-ESC11 catalogue, exploitation tooling, and audit/remediation strategy.Call Stack Spoofing: Defeating EDR Stack Telemetry2026-03-25T00:00:00+00:002026-03-25T00:00:00+00:00https://robinx0.github.io/blogs/edr-bypass/stack-spoofing-techniques/Irfanul MontasirAdvanced techniques for spoofing thread call stacks to evade EDR behavioral detection - covering return address spoofing, synthetic frames, and thread stack manipulation.Active Directory Attack Methodology: Initial Access to Domain Admin2026-03-23T00:00:00+00:002026-03-23T00:00:00+00:00https://robinx0.github.io/blogs/red-team-ops/full-ad-attack-methodology/Irfanul MontasirA complete red team playbook for Active Directory environments - from initial foothold through lateral movement, privilege escalation, and domain dominance with practical tool usage.Designing a Modern C2 Implant: Architecture and OPSEC2026-03-20T00:00:00+00:002026-03-20T00:00:00+00:00https://robinx0.github.io/blogs/c2-development/implant-architecture-guide/Irfanul MontasirA comprehensive guide to C2 implant architecture - covering communication protocols, execution models, sleep patterns, anti-forensics, and operational security considerations.Active Directory ACL Abuse: Every Attack Path Explained2026-03-17T00:00:00+00:002026-03-17T00:00:00+00:00https://robinx0.github.io/blogs/red-team-ops/ad-acl-abuse-complete-guide/Irfanul MontasirComprehensive guide to exploiting Active Directory Access Control List misconfigurations - GenericAll, GenericWrite, WriteDacl, WriteOwner, ForceChangePassword, and dangerous extended rights.Reflective DLL Injection: Theory & Practice2026-03-12T00:00:00+00:002026-03-12T00:00:00+00:00https://robinx0.github.io/blogs/malware-analysis/reflective-dll/Irfanul MontasirUnderstanding reflective DLL loading - manually mapping a PE in memory without disk or LoadLibrary, with a complete walkthrough of the bootstrap, header parsing, section mapping, relocation fixups, import resolution, and modern OPSEC improvements..NET RAT Unpacking & C2 Protocol Extraction2026-03-10T00:00:00+00:002026-03-10T00:00:00+00:00https://robinx0.github.io/blogs/malware-analysis/dotnet-rat-unpacking/Irfanul MontasirStatic and dynamic analysis of an obfuscated .NET RAT - deobfuscation, behavioral analysis, and YARA signatures. Covers ConfuserEx unpacking, dnSpy/dnSpyEx workflow, anti-analysis defeat, custom protocol reverse-engineering, and detection authoring.Android Runtime Hooking with Frida2026-03-08T00:00:00+00:002026-03-08T00:00:00+00:00https://robinx0.github.io/blogs/mobile-security/frida-android-hooking/Irfanul MontasirUsing Frida to bypass SSL pinning, defeat root detection, intercept crypto operations, and hook JNI native functions - complete coverage of Java-side and native-side instrumentation, the universal hook patterns, and modern anti-Frida defeat techniques.Bypassing Android Biometric Authentication via Frida2026-03-07T00:00:00+00:002026-03-07T00:00:00+00:00https://robinx0.github.io/blogs/mobile-security/android-biometric-bypass/Irfanul MontasirHooking BiometricPrompt callbacks and CryptoObject to bypass fingerprint/face authentication in Android banking apps - covering the full BiometricPrompt API, KeyStore-backed gating, hardware-backed strong biometrics, and a practical Frida bypass chain.NTLM Relay to LDAP: Domain Takeover2026-03-05T00:00:00+00:002026-03-05T00:00:00+00:00https://robinx0.github.io/blogs/network-security/ntlm-relay-ldap/Irfanul MontasirUsing PetitPotam to coerce DC authentication and relay to LDAP for domain compromise via RBCD - full coverage of the LDAP-signing prerequisite, ntlmrelayx tooling, the post-relay RBCD chain, and the modern detection/mitigation landscape.Extracting Cobalt Strike Beacon Configuration2026-03-05T00:00:00+00:002026-03-05T00:00:00+00:00https://robinx0.github.io/blogs/malware-analysis/cobalt-strike-beacon-analysis/Irfanul MontasirStatic and dynamic techniques for identifying Cobalt Strike beacons, extracting C2 configs, and generating detection signatures - covering the configuration block format, parser internals, malleable C2 fingerprinting, and YARA strategy.Unpacking Malware: From UPX to Custom Crypters2026-03-02T00:00:00+00:002026-03-02T00:00:00+00:00https://robinx0.github.io/blogs/malware-analysis/unpacking-packed-malware/Irfanul MontasirA systematic approach to identifying and unpacking packed malware - covering UPX, Themida, custom packers, and manual unpacking techniques with x64dbg.Anti-Analysis Techniques: How Malware Detects Your Sandbox2026-02-28T00:00:00+00:002026-02-28T00:00:00+00:00https://robinx0.github.io/blogs/malware-analysis/anti-analysis-techniques/Irfanul MontasirComprehensive catalog of VM detection, sandbox evasion, debugger detection, and timing-based anti-analysis techniques - with concrete code, the rationale behind each check, and counter-measures for analysts hardening their lab.Kerberos Delegation Attacks: Unconstrained, Constrained, RBCD2026-02-25T00:00:00+00:002026-02-25T00:00:00+00:00https://robinx0.github.io/blogs/network-security/kerberos-delegation-attacks/Irfanul MontasirUnderstanding and exploiting all three Kerberos delegation types for lateral movement and privilege escalation in Active Directory - full coverage of the S4U2Self / S4U2Proxy protocol, coercion primitives, RBCD via GenericWrite, and the post-ms16-014 mitigation landscape.Java Deserialization Attacks: From Gadget Chains to RCE2026-02-25T00:00:00+00:002026-02-25T00:00:00+00:00https://robinx0.github.io/blogs/web-exploitation/java-deserialization-rce/Irfanul MontasirUnderstanding and exploiting Java deserialization vulnerabilities - identifying vulnerable endpoints, building gadget chains with ysoserial, and exploiting real-world applications.Shellcode Analysis: Tips, Tricks & Common Patterns2026-02-22T00:00:00+00:002026-02-22T00:00:00+00:00https://robinx0.github.io/blogs/malware-analysis/shellcode-analysis/Irfanul MontasirA practical guide to analyzing shellcode - identifying encoders, emulation, and recognizing common patterns. Covers triage, PEB walking, hash-based API resolution, scdbg/SpeakEasy emulation, and family-level pattern recognition.LLMNR/NBT-NS Poisoning with Responder2026-02-20T00:00:00+00:002026-02-20T00:00:00+00:00https://robinx0.github.io/blogs/network-security/responder-poisoning/Irfanul MontasirCapturing NTLMv2 hashes on enterprise networks by poisoning LLMNR, NBT-NS, and MDNS multicast name resolution - the protocol details, Responder configuration, hash format walk-through, cracking strategy, and SMB-signing-aware relay alternatives.Ret2Libc: Bypassing NX Protection2026-02-18T00:00:00+00:002026-02-18T00:00:00+00:00https://robinx0.github.io/blogs/binary-exploitation/ret2libc/Irfanul MontasirExploiting a stack buffer overflow with NX enabled using GOT leaking and return-to-libc - a complete two-stage exploit covering libc identification, ASLR defeat via PLT/GOT leak, calling-convention setup, and reliable shell.NTLM Relay Attacks: A Comprehensive Guide2026-02-18T00:00:00+00:002026-02-18T00:00:00+00:00https://robinx0.github.io/blogs/network-security/ntlm-relay-comprehensive/Irfanul MontasirEverything about NTLM relay - from theory to exploitation. Covering relay to SMB, LDAP, MSSQL, ADCS HTTP, and SCCM with practical tooling and real-world attack chains.Heap Exploitation 101: Tcache Poisoning on glibc 2.352026-02-15T00:00:00+00:002026-02-15T00:00:00+00:00https://robinx0.github.io/blogs/binary-exploitation/heap-tcache-poisoning/Irfanul MontasirUnderstanding tcache internals and poisoning the freelist for arbitrary write on modern glibc - covering safe-linking, heap and libc leaks, and a complete exploit walk-through against a use-after-free.Android APK Reverse Engineering: From APK to Source2026-02-15T00:00:00+00:002026-02-15T00:00:00+00:00https://robinx0.github.io/blogs/mobile-security/apk-reverse-engineering/Irfanul MontasirComplete guide to decompiling, analyzing, and patching Android applications using jadx, apktool, and smali - covering APK structure, native libraries, manifest analysis, common security flaws, and the full patch-rebuild-resign workflow.Stack Canary Bypass via Format String Vulnerability2026-02-12T00:00:00+00:002026-02-12T00:00:00+00:00https://robinx0.github.io/blogs/binary-exploitation/format-string-canary-bypass/Irfanul MontasirUsing format string bugs to leak stack canaries, then exploiting the buffer overflow with the leaked value - covering canary internals, format-string read primitives, offset discovery, and the full chained exploit.Intercepting Flutter App Traffic with Frida2026-02-10T00:00:00+00:002026-02-10T00:00:00+00:00https://robinx0.github.io/blogs/mobile-security/flutter-traffic-interception/Irfanul MontasirBypassing Flutter's custom TLS stack to intercept HTTPS traffic that ignores system proxy settings and certificate stores - a deep look at why Flutter is harder than native, plus reFlutter, Frida, and iptables-based interception strategies.x64 ROP Chains: Systematic Gadget Hunting2026-02-08T00:00:00+00:002026-02-08T00:00:00+00:00https://robinx0.github.io/blogs/binary-exploitation/rop-x64-gadget-hunting/Irfanul MontasirBuilding ROP chains on x64 Linux - finding gadgets with ropper, handling calling conventions, chaining syscalls, dealing with bad characters, stack alignment, and a complete worked example.The Complete Guide to Android SSL Pinning Bypass2026-02-05T00:00:00+00:002026-02-05T00:00:00+00:00https://robinx0.github.io/blogs/mobile-security/complete-ssl-pinning-bypass/Irfanul MontasirEvery technique for bypassing SSL certificate pinning on Android - from network_security_config to OkHttp, TrustManager, Flutter, React Native, Xamarin, and native C++ implementations.Heap Feng Shui: Controlling Memory Layout for Exploitation2026-02-01T00:00:00+00:002026-02-01T00:00:00+00:00https://robinx0.github.io/blogs/binary-exploitation/heap-feng-shui-exploitation/Irfanul MontasirAdvanced heap exploitation techniques - understanding allocator internals, shaping heap layout, and achieving reliable exploitation through careful allocation patterns on glibc and Windows.My CRTO Exam Review: Cobalt Strike, Malleable Profiles, and Adversary Simulation2025-12-10T00:00:00+00:002025-12-10T00:00:00+00:00https://robinx0.github.io/blogs/cert-reviews/crto-review/Irfanul MontasirHonest review of Zero-Point Security's Certified Red Team Operator certification - the course content, malleable C2 profile development, AV evasion techniques, and the lateral-movement wall I hit on the exam.Forged in Fortresses: My Complete HackTheBox CPTS Journey2025-06-04T00:00:00+00:002025-06-04T00:00:00+00:00https://robinx0.github.io/blogs/cert-reviews/cpts-journey/Irfanul MontasirA deep dive into my preparation, strategy, and lessons learned earning the HackTheBox Certified Penetration Testing Specialist certification - the most challenging hands-on exam I've attempted.IIUC CyberCon 2022: CTF Challenge Solutions2025-01-24T00:00:00+00:002025-01-24T00:00:00+00:00https://robinx0.github.io/blogs/ctf-writeups/iiuc-cybercon-2022/Irfanul MontasirSolutions for challenges from the IIUC CyberCon 2022 CTF organized by IIUC Cyber Analyst Team (CyberWiz) - covering web exploitation, forensics with Volatility, classic crypto on small-exponent RSA, and the broader event experience.HackTheBox Watersnake Challenge: YAML Deserialization to RCE2024-11-07T00:00:00+00:002024-11-07T00:00:00+00:00https://robinx0.github.io/blogs/ctf-writeups/htb-watersnake-writeup/Irfanul MontasirComplete walkthrough of the HackTheBox Watersnake challenge - exploiting a YAML deserialization vulnerability in a water tank monitoring dashboard's firmware update feature.My eCPPTv2 Exam Review: Pivoting Through the Pain2024-04-09T00:00:00+00:002024-04-09T00:00:00+00:00https://robinx0.github.io/blogs/cert-reviews/ecpptv2-review/Irfanul MontasirComprehensive review of the INE Security eCPPTv2 certification exam - preparation approach, pivoting challenges, buffer overflow section, report writing, and honest tips for passing.BlackHat MEA 2023 CTF Finals: Reverse Engineering Writeup2023-12-25T00:00:00+00:002023-12-25T00:00:00+00:00https://robinx0.github.io/blogs/ctf-writeups/blackhat-mea-2023-reverse/Irfanul MontasirDetailed writeup of the Ground Hog Day reverse engineering challenge from the BlackHat MEA 2023 CTF final round in Riyadh - binary analysis, function recovery, and flag extraction.BlueHens UDCTF 2023: Hardware & Reverse Engineering Writeups2023-10-30T00:00:00+00:002023-10-30T00:00:00+00:00https://robinx0.github.io/blogs/ctf-writeups/bluehens-udctf-2023-hardware-reverse/Irfanul MontasirSolutions for the Locked Circuit hardware challenge and ElectroNes reverse engineering challenge from the BlueHens UDCTF 2023 competition.National Cyber Drill 2021: Reverse Engineering Challenges2021-12-13T00:00:00+00:002021-12-13T00:00:00+00:00https://robinx0.github.io/blogs/ctf-writeups/national-cyberdrill-2021-reverse/Irfanul MontasirDetailed writeups for the reverse engineering challenges from Bangladesh's National Cyber Drill 2021 organized by BGD e-GOV CIRT - binary analysis, GDB debugging, and flag extraction.