Preface
1 Initial access: Where most networks are already compromised
2 Privilege escalation
3 Recon and lateral movement
4 Persistence: The art of staying put without getting caught
5 Payload crafting and evasion
6 Active directory attacks
7 Command and control (C2) operations
8 Cloud takeover: Where identity is the new shell
9 Social engineering: The human zero-day
10 Data exfiltration and anti-forensics: Leave with the goods, not the fingerprints
11 IoT and embedded device exploitation: Owning the fabric of the connected world
12 Breaking trust: Supply chain, vendor, and software abuse
13 Credential theft and session hijacking: Stealing identity in transit (Part 1)
14 Beyond SMB: Lateral movement with WMI, DCOM, and token abuse
15 C2 obfuscation and infrastructure: How to build a ghost that talks back
16 ICS/SCADA offensive operations: Pulling the plug on the modern world
17 Binary obfuscation and payload mutation: When the signature is the target
18 On the wire: Payload staging, C2 obfuscation, and covert channels
19 Active directory abuse and enterprise takeover
20 Post-exploitation operations: Data mining, exfiltration, and long-term persistence
21 From phishing domains to global C2 farms
22 Counter-detection warfare: Beating SOCs, EDRs, and the human element
23 Connected car exploitation: Offensive operations against modern vehicles
24 Predator tactics: Staying invisible in a monitored network
25 Linux for operators: Privilege, persistence, and payloads
26 The windows tradecraft stack: API abuse, tokens, and ghosts in memory
27 Red team campaign operations: Offensive Ops without a safety net
28 Outrunning the blue team: Evasion, disruption, and misdirection
29 Malware development: Loaders, injectors, and weaponization
30 Adversary OPSEC: Staying hidden by design
31 Beating the defenders: Evasion by design
32 *NIX and macOS post-exploitation
33 The access economy: Brokers, markets, and the first breach
34 LLMs in offensive security: From GPT to exploit generation
35 Mobile offensive security: Hacking iOS and Android devices
36 OSINT-driven targeting: Recon, pretexting, and payload planning
37 Anti-forensics and artifact destruction: Erase, poison, rewrite
38 Forensics and data recovery: Linux at the edge of failure
39 Operator networking: Protocols, failure points, and C2
40 Operator essentials I: Air gaps, drops, and tradecraft in the field
41 Operator essentials II: Tradecraft simulations, persona ops, and analog deception
42 Operator essentials III: Field kits, infrastructure, and operational signatures
43 Operator essentials IV: Temporal tactics, chronological evasion and LLMs
44 Operator essentials V: Memory games—in-memory payloads, process injection, and RAM abuse
45 Operator essentials VI: Burn protocols and blackout tactics
46 Operator essentials VII: Cloud exploitation
47 The things we don’t say out loud
48 The final word: Operators, myths, and the lie of safety
A Field reference: Tooling and commands
B Glossary of offensive security terms
C Designing adversarial lab scenarios: Real offense, real education
D The offensive lab arsenal
E Lab scenario: Operation (offensive) blueprint
F Simulation: Cloud pivoting in healthcare
G Simulation: Operation Atlas Capital
H Simulation: Biotech research facility simulation
I Simulation: Data exfiltration
J Operation: OATHBREAKER
Index