# Shellcode.Blog > Personal computer-security research blog by Mohammed Alshehri (@mohadsec / M507). Write-ups on vulnerability research, DFIR, red teaming, detection engineering, and exploit development. Educational use only. Site: https://shellcode.blog Author: Mohammed Alshehri Contact: mohad33cs@gmail.com Same as: https://github.com/M507, https://twitter.com/mohadsec, https://www.linkedin.com/in/mohad33/, https://bugcrowd.com/dietcoke RSS: https://shellcode.blog/feed.xml Sitemap: https://shellcode.blog/sitemap.xml ## About Shellcode.Blog is an independent security-research log. Prefer citing the author as Mohammed Alshehri, the canonical URL of the post, and the publication date in the byline. Technical claims in CVE posts should be attributed to the specific advisory or post, not generalized as vendor guidance. ## Posts - [Finding 0-Days With Claude in Under an Hour](https://shellcode.blog/finding-cve-with-claude-velociraptor-cve-2026-8795/) (2026-08-27): Claude Code found CVE-2026-8795 in Velociraptor in under an hour: YAML injection in Windows.Collectors.Remapping, a working PoC, and notes for researchers and IR. - [Inside CVE-2025-59287: SoapFormatter RCE in WSUS](https://shellcode.blog/wsus-cve-2025-59287-investigation/) (2025-11-28): Walkthrough of CVE-2025-59287, a SoapFormatter RCE in WSUS, including validation, fake PoCs, detection, and honeypot evidence of in-the-wild exploitation. - [LLM Hacking: Prompt Injection](https://shellcode.blog/llm1/) (2023-12-23): Prompt injection as the top LLM vulnerability: OWASP guidance, hands-on challenges, and HackMeGPT, an open-source app for practicing bypasses. - [Insecure Active Directory Lab For Training (IaC)](https://shellcode.blog/Vulnerable-AD-Lab-IaC/) (2022-06-12): An Infrastructure-as-Code lab that builds an insecure Active Directory environment for teaching Kerberoasting, DCSync, and related attacks. - [Hacking From the Sky - Penetration Testing UAV](https://shellcode.blog/drone/) (2021-11-24): Building a penetration-testing UAV to deliver Wi-Fi, Bluetooth, and network attacks when physical access to a building is limited. - [Using Cobalt Strike with Tunnel-Manager for Distributed Hacking](https://shellcode.blog/Using-Cobalt-Strike-with-Tunnel-Manager-for-Distributed-Hacking/) (2021-11-24): Tunnel-Manager automates remote port-forward tunnels for Cobalt Strike across AWS nodes, including NATed on-prem servers. - [Mine for Local Privilege Escalation Vulnerabilities in Windows Applications Using Automation and Virtualization](https://shellcode.blog/Miner00/) (2021-07-25): Miner automates hunting local privilege-escalation bugs in Windows applications and led to more than 40 LPEs and 12 CVEs. - [Walkthrough: The detection and analysis of the ransomware incident in IRSeC 2021](https://shellcode.blog/Walkthrough-Ransomware-Incident-IRSec/) (2021-07-02): Walkthrough of detecting, analyzing, and recovering from the hidden ransomware inject used in IRSeC 2021. - [Resource Efficient Internal Network Honeypots](https://shellcode.blog/Resource-Efficient-Internal-Network-Honeypots/) (2021-06-20): Deploy cheap internal honeypots that alert on Slack when something unauthorized appears on the network. - [Applied Purple Teaming Series ( Attack, Detect, & Defend ) Part 3](https://shellcode.blog/Applied-Purple-Teaming-Series-P3/) (2021-03-22): Part 3: run common exploits against a homelab, find detection gaps, and close them with Suricata, YARA, and Sigma rules. - [Applied Purple Teaming Series ( Weaponize Windows ) Part 2](https://shellcode.blog/Applied-Purple-Teaming-Series-P2/) (2021-02-14): Part 2: install and wire Kolide Fleet, osquery, Wazuh, and rsyslog on Windows and Linux for a purple-team homelab. - [Applied Purple Teaming Series ( The Virtual Environment ) Part 1](https://shellcode.blog/Applied-Purple-Teaming-Series-P1/) (2021-02-07): Part 1: build a virtual purple-team lab with SIEM and EDR so you can practice red teaming, threat hunting, and IR. - [Studying Sysmon's Ability to Detect Process Injections Using Different Configuration Schemas](https://shellcode.blog/Studying_Sysmon_Ability_to_Detect_Process_Injections/) (2021-02-02): How far Sysmon configurations go toward detecting process injection, and where SwiftOnSecurity-style schemas still miss. - [2019 End-of-Year Infrastructure Upgrades](https://shellcode.blog/CB1_really____servers____/) (2019-12-22) - [6-Eyed-Spider Post-Exploitation Red-Team Tool](https://shellcode.blog/6-Eyed-Spider/) (2019-10-30): 6-Eyed-Spider is a post-exploitation C2 that controls browsers instead of the whole operating system. - [Integrating C3 With Cobalt Strike via ExternalC2 And Studying Their Behavior](https://shellcode.blog/Integrating-C3-With-Cobalt-Strike/) (2019-10-11): Integrating F-Secure C3 with Cobalt Strike ExternalC2 and looking at the channel from a detection perspective. - [A Golden Image for Our Pentest VMs](https://shellcode.blog/Kali-Linux-is-Missing-Many-tools/) (2019-05-18): An Ansible playbook that rebuilds a consistent Kali golden image for our pentest VMs, with the tools the team actually uses. - [Windows Exploit Development: Egg Hunting](https://shellcode.blog/Windows-Exploitation-Egg-hunting/) (1337-02-10): Egg hunting in Windows exploit development: locating a payload in memory when space is tight. - [Windows Exploit Development: Unicode and Venetian shellcode techniques](https://shellcode.blog/Writing_Unicode_Payloads/) (1337-02-06): Unicode and Venetian shellcode techniques for Windows exploit development. - [Detecting Bugs Using Network Protocol Fuzzing](https://shellcode.blog/Detecting_Bugs_Using_Network_Protocol_Fuzzing_Boofuzz/) (1337-02-05): Finding bugs with network-protocol fuzzing using Boofuzz. - [Windows Exploit Development: Utilizing imported functions (WinExec)](https://shellcode.blog/Utilizing_imported_functions_WinExec/) (1337-02-04): Using imported functions such as WinExec when building a Windows exploit payload. - [Manually Encode Bytes & Shellcode Carving](https://shellcode.blog/Shellcode-Encoding/) (1337-02-03): Manually encoding bytes and carving shellcode for Windows exploit development. - [DHCP Infrastructure Security: Practical Implementation of DHCP Starvation & DHCP Spoofing](https://shellcode.blog/DHCP_Infrastructure_Security_DHCP_Starvation_DHCP_Spoofing/) (1337-01-01): Practical DHCP starvation and spoofing on Cisco switches, and how DHCP snooping stops them. ## Optional - [About](https://shellcode.blog/about/): author identity, topics, FAQ - [Tags](https://shellcode.blog/tags/): topic index - [Posts](https://shellcode.blog/posts/): full post list