~/blog

Articles

Every transmission from the lab — adversarial AI research, offensive security tutorials, threat analysis, and the legacy Dr. Chaos archive.

231 articles

Adversarial AI Offensive Security

Kimi K3 and K3 Swarm: An Open-Weight Model Review from the Red Team Chair

A balanced cybersecurity review of Moonshot's Kimi K3 and the multi-agent K3 Swarm. Not "is it smart" but the question a red team actually asks: does an open, self-hostable, agentic model make you more effective on an engagement, and what does it give you that Claude and GPT cannot? Data that stays in the room, no vendor holding your engagement hostage, cost at scale, and a swarm that fits the work, weighed honestly against where the closed frontier models still win.

Aamir LakhaniJul 28, 202613 min read

Offensive Security Tutorials

Webshells, Start to Finish: Build One in a Lab, Use It, Then Catch Yourself

The webshell is the cockroach of offensive security: one line of code, arbitrary command execution, and still everywhere. A deep dive into what webshells are, how attackers plant and use them, how red and blue teams both put them to work, plus a hands-on Docker lab where you build a vulnerable app, drop a shell, use it, and then detect and defend against it three different ways.

Aamir LakhaniJul 28, 202614 min read

Adversarial AI Offensive Security

The State of AI Automation: Zapier vs Make vs n8n, Through a Red Team Lens

AI automation quietly became critical infrastructure that security never signed off on. A deep look at where automation actually is in 2026, the real differences between Zapier, Make, and n8n, when to reach for each, and why every one of them is a beautiful new attack surface: standing credentials, unauthenticated webhooks, shadow automation, and prompt injection into agents that hold tools.

Aamir LakhaniJul 28, 202615 min read

Offensive Security Tutorials

Impacket from Scratch: Kerberoasting, DCSync, and Lateral Movement in a Lab

A hands-on Impacket tutorial for beginners: build a lab, then walk Kerberoasting, AS-REP roasting, secretsdump/DCSync, and remote execution end to end — with the red team, blue team, and attacker view of each, plus the exact Windows event IDs that detect them and the controls that stop them.

Aamir LakhaniJul 24, 202616 min read

Offensive Security Tutorials

BloodHound for Beginners: Mapping the Attack Paths Hiding in Active Directory

Build a lab Active Directory domain, collect it with SharpHound, and use BloodHound CE to find the permission chains that lead to Domain Admin — plus how red teams, blue teams, and real attackers each use it, and how to detect and dismantle the paths.

Aamir LakhaniJul 24, 202621 min read

Offensive Security Tutorials

DNS Tunneling Explained: Build a Lab and Watch Data Hide Inside DNS

A beginner-friendly, step-by-step guide to DNS tunneling: how it works, how to build a safe isolated lab with iodine, what it looks like on the wire, and — most importantly — how to detect and defend against it.

Aamir LakhaniJul 24, 202618 min read

Editorials

Dr. Chaos is back — dark security, total chaos, and adversarial AI

The blog returns with a decade of archives intact and a new focus: adversarial and offensive AI. Here's what to expect.

Aamir LakhaniJul 23, 20262 min read

Adversarial AI

Community Pulse: Top Offensive Security & AI Discussions – July 7, 2026

From the PolinRider DPRK supply chain drama to the JadePuffer agentic ransomware debate, the security community is having big conversations this week. Here's the pulse from r/netsec, r/cybersecurity,

Aamir LakhaniJul 6, 20267 min read

Adversarial AI

AI in the Crosshairs: Top 3 Offensive AI Security Stories – July 7, 2026

AI agents are being weaponized in the wild — from crypto-stealing prompt injections to fully autonomous ransomware. Here's what the AI attack surface looks like in July 2026, and why your security tea

Aamir LakhaniJul 6, 20265 min read

Security

Novel Cyber TTPs: Attacker Playbook Updates – July 7, 2026

This week's attacker playbook includes video cable data exfiltration, Blogspot-hosted fileless loaders, a new Iranian C2 framework, and ClickFix phishing that impersonates Google's own verification UI

Aamir LakhaniJul 6, 20265 min read

Tutorials

Active Exploits & Emerging Threats – July 7, 2026

Active exploitation confirmed on Adobe ColdFusion. PoC released for Linux root escalation. ShinyHunters tearing through healthcare and education sectors. Here's the threat board and what to do about i

Aamir LakhaniJul 6, 20264 min read

Security

Offensive Security Intelligence Brief: Top 5 Stories – July 7, 2026

This week's top five offensive security stories — DPRK supply chain ops, active ColdFusion exploitation, China-nexus RAT campaigns, VM escape vulnerabilities, and rapid-fire Gitea probing. Here's what

Aamir LakhaniJul 6, 20265 min read