01 / RESEARCH

Think like the attacker.
Lead like the defender.

Offensive security research by Dahvid Schloss.
Every project ships with the code.

I research how attackers abuse legitimate features: browser debugging channels, NTFS streams, ICMP, signed kernel drivers, and industrial protocols. Then I publish what defenders should look for. Each write-up below covers the question, what the project does, and why it matters.

BROWSER & ELECTRON SECURITYC# · 2026

Glasshouse Framework

What happens when the debugging port meant for developers ships in production desktop apps?

Modern desktop software is increasingly a web app in a wrapper: Next.js for the logic, Electron for the window, shipped fast and, more and more, scaffolded by AI coding assistants that optimize for working code over secure defaults. Glasshouse studies the Chromium DevTools Protocol (CDP) surface those apps and browsers can leave reachable, and how attacker activity can blend into legitimate application behavior through it. Its first component, ChatterBox, is an interactive CDP console for enumerating targets, inspecting runtime state, and turning one-off protocol calls into repeatable, profile-driven workflows. A post-exploitation operator module is in development.

Why it matters: Exposed debug interfaces and permissive runtime defaults are easy to miss in code review and hard to see in telemetry. Glasshouse maps that gap so defenders can close it.

Glasshouse-Framework ↗

BROWSER SECURITYPowerShell · 2026

SilentFrame

Can a browser's own debugging channel be used to collect credentials?

SilentFrame is a research proof of concept and the predecessor to Glasshouse. It started while the team was writing EC Playbook: a known one-liner that keylogs a page's password field looked promising, but needed RDP access, the target's username, and the site already open, all non-starters for stealthy adversary emulation. SilentFrame delivers the same idea through the Chromium DevTools Protocol instead. When a Chromium browser runs with remote debugging enabled, whether through a launch flag or a modified shortcut, SilentFrame finds the CDP discovery endpoint, opens a single browser-level WebSocket, and auto-attaches to every tab, iframe, and background page, existing and future, so one connection can observe the whole session. Its capabilities are deliberately limited: it does not work against multi-step login flows such as Gmail or Microsoft 365.

Why it matters: One flag on a browser shortcut turns the browser into a credential-collection surface. That is a cheap persistence trick worth hunting for in your environment.

SilentFrame ↗Read the write-up ↗

RANSOMWARE & EDR RESEARCHPowerShell · 2025

UnderByte

Can ransomware slip past endpoint protection by staging its encryption in NTFS Alternate Data Streams?

Most ransomware detection keys on a familiar pattern: a call to a cryptographic library followed by a write that overwrites a file in place. UnderByte splits that pattern into two phases. First it writes an encrypted copy of each user file into a hidden Alternate Data Stream (ADS) attached to that file; then a separate pass copies the encrypted data over the file's main stream. It is conceptual research only, with no decryptor and no operational tooling.

What it found: In the lab, the two-phase approach evaded every consumer-grade product tested. Commercial EDR did catch it, but only during the overwrite phase, only when it ran faster than a human could, and only after roughly 20 to 100 files were already encrypted. For defenders: rapid ADS creation with meaningless stream names is a strong signal, especially when correlated with process lineage and focused on user-writable folders.

UnderByte ↗

COVERT CHANNELS & EXFILTRATIONPowerShell + Python · 2024 · 80+ GitHub stars

PILOT

How much can you move out of a network one ping at a time?

Ping-based Information Lookup and Outbound Transfer. A PowerShell sender breaks a file into 32-byte chunks, mimicking the payload size of a default Windows ping, and sends them as ICMP echo requests, starting with a metadata packet that carries the file name, type, and chunk count. A Python receiver, ATC, listens, reassembles, and restores the original file. An optional delay makes the traffic look more like ordinary ping.

Why it matters: ICMP is often allowed outbound and rarely inspected. PILOT shows why it deserves the same egress scrutiny as HTTP and DNS.

PILOT ↗

KERNEL DRIVER RESEARCHPython · 2025

MSR Exploit Hunter

After a Windows kernel 0-day, which of your drivers expose the same primitive?

When Exploit Pack disclosed a Windows 0-day that abused model-specific register (MSR) writes in signed kernel drivers, hunting for similar drivers meant grepping .sys files by hand. MSR Exploit Hunter scans a folder of drivers for WRMSR and RDMSR instructions, checks whether they sit in executable sections, looks for IOCTL-related APIs that could make them reachable from user mode, identifies WDM versus KMDF drivers, and ranks which ones deserve attention first.

Why it matters: A signed driver that lets user mode write privileged CPU registers is a ready-made path to kernel compromise. Fast triage turns a disclosure into a short, ranked to-do list.

MSR-Exploit-Hunter ↗

DETECTION RESEARCH TOOLINGC · 2026

Defender Bender Box

Can you ask Microsoft Defender's engine for a verdict without running Windows?

A local research tool that runs the x64 Microsoft Defender scan engine inside a Linux Docker container through Wine. Each sample is mounted read-only and read rather than executed, in a disposable container with networking disabled, and the tool reports whether the engine raised a detection and the threat name it assigned. It is a prototype for studying static file-scan detections and part of a larger project still to come; a scan with no detection is treated as unverified, not clean.

Why it matters: Red teamers, students, and researchers can study static detections offline, without uploading samples to a public scanning service.

Defender-Bender-Box ↗

ACTIVE DIRECTORY LABSPowerShell · 2023 · 100+ GitHub stars

CRASH

How fast can you make a lab domain look like a real company?

Completely Risky Active-Directory Simulation Hub. Its generator, ADGenny (“the Unintentional IT Administrator”), builds organizational units and groups for departments such as HR, Finance, IT, and Executives, then creates 100 users with randomized names, passwords, and department-appropriate titles, including a director for each department, so a lab domain looks lived-in.

Why it matters: Attack paths only make sense in a domain that resembles a real organization. CRASH gets students and red teamers there in minutes.

CRASH ↗

OPERATIONAL TECHNOLOGY & ICSPython · 2026

OT Lab: Water

What does an attack on industrial control systems actually do to the physical process?

The code behind a low-cost, physical industrial control system training platform, built to demonstrate Modbus exploitation and the kinetic impact of cyber attacks on an industrial process. Related: Just Hacking Training's Hack a Water Tower hack-along teaches Modbus attacks hands-on in a virtual lab.

Why it matters: Water systems are a live target. Seeing a pump respond to a forged Modbus write makes the risk concrete for engineers, executives, and students alike.

OT-Lab-Water ↗Hack a Water Tower ↗

Smaller tools & building blocks

LowRider ↗Finds code caves: slides a Shannon-entropy window across a PE file’s .text section to flag long low-entropy runs of zeros, NOPs, and filler bytes.SimpleJack ↗A deliberately insecure teaching C2 with HTTP and TCP listeners, built to show how sessions register, how callbacks and tasking work, and how defenders spot them.BYOJSON ↗A small JSON parser for C++17, written to avoid heavyweight dependencies.ROR13 Hash Generator 2.0 ↗Fork: extended API and DLL hash generation.ECRef ↗Fork: an offensive security reference project.

All repositories on GitHub ↗

LET’S BUILD WHAT’S NEXT

Big challenges.
Good people.
Let’s talk.

I’m interested in executive leadership and technical offensive security roles where I can build strong teams, meaningful capabilities, and things that work.

contact@dahvidschloss.com

Connect on LinkedIn ↗View résumé ↗

BASED IN RALEIGH, NORTH CAROLINA

Think like the attacker.Lead like the defender.