Blog
Articles, guides, and shellcode research.
A migration path from team-server shellcode habits to in-browser generation without losing reproducibility or OPSEC discipline.
How null and alphanumeric presets map to real injection channels, and when you must build a custom bad-char list.
Using a hex view to catch alignment issues, obvious bad chars, and length mistakes before shellcode hits an exploit script.
How to document encoder chains, network parameters, and export formats so retests do not turn into archaeology.
When to use exec-style shellcode versus reverse TCP in authorized labs, and why the flashy option is often the wrong one.
Common paste formats, whitespace traps, and how to round-trip external shellcode through a browser builder without silent truncation.
How stacked encoders change size, decoders, and bad-char profiles, plus a sane order for lab iterations before exploit integration.
What stays local in a browser-native shellcode builder, what still leaks, and how to run authorized tests without polluting your ticket trail.
Why 0x00 breaks strcpy-style delivery, how nulls sneak into reverse TCP structs, and what to do when your encoder pass lies to you.