The map
Thinking like a hacker
Pick the question that sounds like you. Each one opens onto the posts that answer it, in the order they were meant to be read.
01·4 PARTS
How do I get started?
Before the protocol work: why nobody is going to hand you permission to begin, the languages the tooling is written in, the habits that keep you learning rather than copying, and an honest look at what an agent is actually good for.
- 01Post · 5 min readYou don't need permission to startThe gate you are waiting at is not locked. The one that actually matters is somewhere else entirely.
- 02Post · 7 min readSpooky simple Python tricksThe handful of Python tricks I reach for almost daily to reshape, encode and explore data.
- 03Post · 9 min readHow to learn while using AIIt has never been easier to learn with AI. The key is how you use it. This example uses Claude Code to learn gdb
- 04Post · 2 min readBrain explode: AI is getting a little scaryA PE checksum problem, three AI tools, and the one that went and read the docs instead of inventing functions.
02·7 PARTS
How do I move data past everything watching the network?
DNS resolves before anyone authenticates and leaves the building on every network you will ever touch. Build the server from an empty file, then turn it into a channel that carries whatever you want.
- 01Post · 4 min readAbusing DNS, Part 1: How does DNS do what it do?How DNS resolution actually works, and why a protocol every network lets out is such a useful place to hide data.
- 02Post · 5 min readAbusing DNS, Part 2: Serving up some funBuilding a DNS server in Rust that answers real queries — the first working piece of a key-value store that talks over DNS.
- 03Post · 4 min readAbusing DNS, Part 3: What do you want?The client side: a Rust CLI that asks our own DNS server for records, so we stop leaning on dig to test it.
- 04Post · 6 min readAbusing DNS, Part 4: Let the fun begin?Getting real data out of a protocol built for tiny answers, by chunking it across repeated TXT queries.
- 05Post · 7 min readAbusing DNS, Part 5: Client says what?Sending arbitrary data the other way, packed into the 63 characters a single DNS label will carry.
- 06Post · 4 min readAbusing DNS, Part 6: It's all about who you knowRouting queries through the host's own resolver instead of straight at our server, so the traffic looks like everyone else's.
- 07Post · 2 min readAbusing DNS, Part 7: Who is in charge here?The NS records that make a subdomain yours, and the delegation that lets any resolver on the internet find your server.
03·1 PARTIN PROGRESS
How do I get my own code running inside the kernel?
The kernel will happily run your program on every packet, syscall and function entry — no module, no reboot. Start with what eBPF actually is before pointing it at anything.
04
What’s new?
- Post · 5 min read · 13 Aug 2026You don't need permission to startThe gate you are waiting at is not locked. The one that actually matters is somewhere else entirely.
- Post · 9 min read · 09 Aug 2026How to learn while using AIIt has never been easier to learn with AI. The key is how you use it. This example uses Claude Code to learn gdb
- Post · 10 min read · 23 Jun 2026Abusing eBPF, Part 1: What even is eBPF?What eBPF actually is, why it is interesting from an attacker's seat, and a first counter running in the kernel with Rust and aya.
Topics