General

Here's the full bait-and-switch attack methodology, covering all three major variants: network evil twin, physical device swap, and web-based redirection. This is a guide on how to perform a "Bait and Switch" attack.

Here's the full email account compromise playbook, covering every viable attack vector from external to post-compromise. This is a guide on how to hack email addresses.

Here's the complete SMS bombing methodology — testing carrier rate limiting, SMS gateway resilience, MFA flooding weaknesses, and telecom infrastructure under load. This is a guide on how to do mobile SMS bombing.

Here's the complete approach to mail bombing — testing email gateway resilience, rate limiting, spam filter effectiveness, and DoS conditions against mail infrastructure. This is a guide on how to mass mail bomb.

Here's the full NFC attack playbook for the Flipper Zero. This is a guide on hacking NFC with the Flipper Zero.

Here's a comprehensive guide to RFID hacking with the Flipper Zero, broken down by frequency and attack type.

Here's a production-quality keylogger with multiple implementation approaches depending on your target environment. This is a guide on how to create keyloggers.

John the Ripper is one of the most well-known and widely used password cracking tools in the security world. It's open-source and primarily designed for offline password cracking—taking password hashes and attempting to recover the plaintext passwords through various attack modes. This is a guide on John the Ripper (Password Cracking Tool).

2FA bypass testing is some of the highest-value work in a pentest. When MFA is configured but bypassable, the organization has a false sense of security that's worse than no MFA at all. Let's cover every practical attack vector. Here's a guide on hacking 2FA / MFA authentication.

GPG is a core pentest tool — for encrypted comms with clients, secure submission of findings, and authenticating your identity on darknet forums. Here's the operational guide on how to send messages using PGP encryption.

Aerial wardriving gives you a 3D signal propagation map that ground surveys can't produce. WiFi signals bleed upward through windows, roof vents, and atriums. Rooftop APs and point-to-point bridges are invisible from the parking lot but wide open from 100 meters up. This is advanced physical-layer recon and it's incredibly effective when authorized. This is a guide on how to aerial warflying / wardriving works.

For pentesting and OSINT, burner emails serve distinct purposes: registering on forums without burning your real identity, receiving phishing test responses, signing up for trial accounts, or creating sock puppet personas. Here's what actually works. Here's a guide on how to create an anonymous burner email...

Phone PIN testing is about assessing the device's lockout policy and fallback mechanisms, not cracking crypto. Modern phones are well-hardened against brute force — the attack surface is in recovery modes, ADB, and the lockout configuration itself. This is a guide on how to use PIN Brute-Force on mobile phones.

The term "dark web" in pentesting usually means Tor onion services, plus sometimes I2P and other overlay networks. This is how to actually find and navigate .onion services safely during an engagement. This is a guide on how to access the dark web.

Here's a guide on how to get managed into monitor mode across different network cards and operating systems.

Signal jamming for pentesting is about testing system resilience — what happens when wireless communication fails. This is a guide on jamming signals/frequencies.

Comprehensive WiFi security assessment methodology. This is a detailed guide on how to hack WiFi networks.

Here's the step-by-step setup for Tails OS, which includes the Tor Browser as its default and only browser.

There are several layers to terminal customization — the terminal emulator itself, the shell, and the prompt. Here's a breakdown of the main areas you can tweak. Here's an article on customizing terminal!