44,900+ Lines  ·  8 Phases  ·  300+ Tools  ·  200+ ATT&CK Techniques  ·  1,080+ Code Blocks  ·  150+ Diagrams  ·  325+ Lines (Payloads)

If this curriculum has value for your offensive security journey, consider starring the repository to help other researchers and operators discover it.

• Built from the metal up. Every phase teaches the underlying system internals before attack techniques. No "just run this tool" shortcuts.
• Compilable offensive code. Not just theory. Includes working C and Rust payloads with PEB traversal, DJB2 hashing, and in-memory loaders.
• OPSEC before hacking. Phase -1 comes before Phase 0. Operational security, threat modeling, and anonymous infrastructure are prerequisites.
• Full MITRE ATT&CK alignment. 200+ techniques mapped across Enterprise v15, ICS, and ATLAS. Every section ties back to the framework.
• Covers what others skip. Physical red teaming, drone reconnaissance, social engineering pretexts, quantum SNDL, and post-quantum cryptography.

Fork the Journey Tracker to monitor your progress across phases.

The cybersecurity industry is saturated with surface-level certification guides, multiple-choice cheat sheets, and automated tool tutorials that fail the moment modern defensive telemetry is encountered.

The BlackHAT Roadmap v1.2.0 · GREATEST Edition is engineered on a fundamentally different principle: understanding systems completely from the metal up.

This repository contains over 44,900 lines of battle-tested technical documentation, weaponized code architectures, evasion mechanics, and operational security doctrines across 15 master modules. It bridges the gap between running automated point-and-click tools and operating as a tier-one security researcher, red team engineer, or exploit developer.

+-----------------------------------------------------------------------------+
| REPOSITORY AT A GLANCE (v1.2.0 · 2027 EDITION)                              |
+-----------------------------------------------------------------------------+
| Total Content Volume : 44,900+ lines of dense offensive engineering         |
| Total Documentation  : ~1.80 MB source markdown across 15 master modules    |
| Progression Depth    : 8 Core Phases (Phase -1 through Phase 6)             |
| Section Count        : 440+ Major Sections (H2), 1,120+ Subsections (H3)    |
| Code Implementation  : 1,080+ Verified Code Blocks across 13+ Languages     |
| Offensive Tooling    : 300+ Unique offensive tools cataloged                |
| MITRE Alignment      : 200+ ATT&CK Techniques (Enterprise, ICS, ATLAS)      |
| Compilable Labs      : Native C API Resolver & Offensive Rust In-Memory Dev |
| Special Operations   : Physical Red Team, SE, Drone Recon, Quantum / SNDL   |
+-----------------------------------------------------------------------------+

Most educational resources teach how software is supposed to work. Real offensive security requires understanding how software actually works when subjected to edge cases, flawed assumptions, and memory corruption.

The-BlackHAT-roadmap/
├── .github/                      <- Project metadata, issue templates, PR template & tracker
├── assets/
│   ├── banner.svg                <- Cybernetic HUD SVG banner (v1.2.0)
│   └── diagrams/                 <- Modularized Mermaid diagrams & high-res renders
├── black-bag/                    <- Covert operational tradecraft & survival payload
│   └── BlackHat_Long-Term_Survival_Tactics.md <- 3,000+ line master OPSEC & counter-surveillance manual
├── field-guides/                 <- Operational manuals, tactical matrices & infrastructure
│   ├── FAQ.md                    <- Career realities & operational transitions FAQ
│   ├── Final_Word.md             <- Verification statistics, attributions & 2027-2028 roadmap
│   ├── Lab_Setup_Guide.md        <- Multi-tier enterprise AD & hypervisor blueprints
│   ├── MITRE_ATT&CK_Quick_Reference.md <- Enterprise v15, ICS & ATLAS tactical matrix
│   ├── Philosophy_The_BlackHat_Mindset.md <- Cognitive doctrine & primitive mental models
│   ├── Resources_Aggregated.md   <- Canonical literature, whitepapers & archives
│   └── Tools_Inventory.md        <- 300+ phase-aligned offensive tool directory
├── payloads/                     <- Compilable weaponized source implementations
│   ├── README.md                 <- Master payload index, toolchains & lab prerequisites
│   ├── 01_dynamic_api_resolver/  <- In-memory PEB traversal & DJB2 export hashing in C
│   └── 02_offensive_rust_loader/ <- RW -> RX memory state flipping & binary hardening in Rust
├── phases/                       <- STRICTLY the 8 chronological curriculum phases
│   ├── PHASE_-1.md               <- Hardened OPSEC & Anonymous Infrastructure
│   ├── PHASE_0.md                <- Low-Level Foundations & Systems Internals
│   ├── PHASE_1.md                <- Modern Web & API Attack Surface
│   ├── PHASE_2.md                <- Network Pivoting & Active Directory Mastery
│   ├── PHASE_3.md                <- System & Kernel Exploitation
│   ├── PHASE_4.md                <- Specialized Operator Tracks (4A-4I)
│   ├── PHASE_5.md                <- GREATEST (Apex Vulnerability Research & 0-Day)
│   └── PHASE_6.md                <- Special Operations & Adversary Simulation
├── CHANGELOG.md                  <- Version history and public release notes
├── CITATION.cff                  <- Native GitHub Citation metadata
├── LICENSE                       <- MIT License
└── README.md                     <- Master curriculum hub & navigation launchpad

To bridge the gap between theoretical comprehension and binary execution, the repository includes ready-to-compile, weaponized codebases in payloads/:

payloads/
|-- README.md                  # Master payload index, toolchains & lab prerequisites
|-- 01_dynamic_api_resolver/   # Windows PEB traversal, In-Memory API export hashing in C (DJB2)
`-- 02_offensive_rust_loader/  # Memory protection flips (RW -> RX), Native API wrapping in Rust

• Payload 01: Dynamic API Resolver in C: Demonstrates resolving Windows API functions purely in memory by traversing the Process Environment Block (PEB) and hashing export table strings, defeating static Import Address Table (IAT) analysis.
• Payload 02: Offensive Rust In-Memory Loader: Demonstrates staging encrypted shellcode in memory, avoiding direct RWX allocation flags, and flipping memory permissions to executable (PAGE_EXECUTE_READ) immediately prior to thread dispatch.

The curriculum integrates the newest offensive paradigms required to defeat modern security stacks:

Defeating memory scanners (Moneta, Hunt-Sleeping-Beacons, Pe-sieve) through asynchronous timer-based memory protection flips.

• Ekko, Foliage, and Cronos implementations: ROP chain encryption via NtContinue, CreateTimerQueueTimer, and stack frame wiping.
• Call Stack Spoofing: Synthetic stack frame generation (SilentMoonwalk, Unwinder) to pass return address validation.
• Indirect Syscalls: Resolving SSNs dynamically and executing syscall instructions from within legitimate ntdll.dll memory space to bypass user-mode hooks.

• ADCS Exploitation: Abuse of Enterprise Certificate Authority misconfigurations across ESC1 through ESC15.
• Authentication Coercion: Forcing NTLM authentication via PetitPotam (MS-EFSR), DFSCoerce (MS-DFSNM), and Shadow Credentials.
• Entra ID (Azure AD): Primary Refresh Token (PRT) extraction, Conditional Access bypasses, Device Code phishing, and Azure Arc lateral movement.

Replacing legacy C/C++ loaders with high-performance, statically compiled Rust:

• Dynamic API resolution via hashed PE exports.
• Direct invocation of Windows Native APIs using safe wrappers.
• In-memory shellcode execution without RWX allocation artifacts.

• Exploitation of LLM-integrated enterprise applications: Indirect prompt injections, Retrieval-Augmented Generation (RAG) poisoning, and agent jailbreaking.
• Local offensive LLM pipelines: Fine-tuned local models for automated vulnerability triaging, decompilation analysis, and exploit script generation.

• Store Now, Decrypt Later (SNDL): Harvesting encrypted enterprise traffic ahead of Cryptanalytically Relevant Quantum Computers (CRQCs).
• Post-Quantum Cryptography (PQC) Downgrades: Forcing hybrid key exchange negotiation fallbacks to classical ciphers during migration windows.

• Non-destructive entry: pin tumbler lockpicking, bypass tools, latch slips, and under-door tools.
• Electronic access control: Wiegand protocol interception, OSDP auditing, and RFID/NFC badge cloning.
• Drone reconnaissance: optical patrol mapping and thermal HVAC/server room heat profile analysis.

To execute the practical exercises in this curriculum, the recommended self-hosted lab setup includes:

1. Virtualization Hypervisor: Proxmox VE, VMware ESXi, or VMware Workstation Pro.
2. Active Directory Range: Dual Windows Server Domain Controllers (2019/2022) with Active Directory Certificate Services (ADCS) installed, and 2-3 joined Windows 10/11 enterprise workstations.
3. Malware Analysis Sandbox: Isolated FlareVM (Windows) and REMnux (Linux) nodes configured with non-routed virtual host-only adapters.
4. Tooling Environment: Dedicated Kali Linux or Debian instance equipped with Docker, Rust toolchain, MinGW-w64, Clang/LLVM, and Ghidra.
5. Hardware Security Kit (Phase 4G & Phase 6): RTL-SDR blog V4, HackRF One, SouthOrd/Sparrows lockpick set, Proxmark3 RDV4 / Flipper Zero, Hak5 LAN Turtle, and CAN bus transceiver module.

roadmap · blackhat-roadmap · greatest-roadmap · penetration-testing-roadmap · cybersecurity-roadmap · AI-ML-Jailbreak · security · cybersecurity · reverse-engineering · security-tools · hacking · pentesting · osint · penetration-testing · network-security · ctf · infosec · malware · ethical-hacking · red-team · kali-linux · malware-analysis · active-directory · web-security · mitre-attack · bug-bounty

If this curriculum provides value to your research or career, consider starring the repository to help other researchers find it:

Contributions that raise the technical bar are welcome. Whether it is a new payload, a deeper module, or a dead link fix, real contributions from the community make this curriculum stronger.

• Getting Started: Check out the Contributing Guidelines and look for issues tagged good first issue for approachable entry points.
• Quality Threshold: PRs adding generic tool lists or introductory material will not be merged. We prioritize depth over breadth.
• Code Standards: Code samples must be functional, accompanied by technical rationale, and compiled against modern toolchains. Check out the Weaponized Payloads directory.
• Formatting Rule: Adhere strictly to clean markdown standards. Do not include em-dashes anywhere in text or documentation.

If you utilize this curriculum, offensive engineering architectures, or lab implementations in your academic research, technical whitepapers, or institutional courses, please cite this work as follows:

@misc{biswas2026blackhat,
  author       = {Sagar Biswas},
  title        = {The BlackHAT Roadmap: From 0 to GREATEST (v1.2.0)},
  year         = {2026},
  publisher    = {GitHub},
  journal      = {GitHub repository},
  howpublished = {\url{https://github.com/SagarBiswas-MultiHAT/The-BlackHAT-roadmap}}
}

Or reference the native CITATION.cff file via GitHub's "Cite this repository" interface.

Sagar Biswas

• GitHub: @SagarBiswas-MultiHAT
• Agency: MultiHAT Dev
• Projects: Portfolio & Engineering Projects
• Notebooks: Technical Research Notebooks
• Articles & Blog: Security Analysis & Writeups

• Penetration Testing Roadmap: Practical workflows, methodologies, and toolchains for real-world offensive assessments.
• Awesome Cybersecurity Paths: Structured learning paths across defensive, offensive, and research specializations.
• Awesome Cybersecurity Books: Essential foundational and advanced literature for security researchers and practitioners.