v1.2.0: The BlackHAT Roadmap - 44,900+ Lines of Offensive Security Engineering.

The BlackHAT Roadmap v1.2.0 - Initial Public Release

The definitive, zero-to-elite offensive security engineering curriculum built from the metal up.

This release establishes the complete public syllabus spanning 44,900+ lines, 325+ Lines (Payloads), 150+ Diagrams, 1,080+ Code Blocks, 8 progression phases, 1 standalone black-bag volume, 300+ cataloged tools, 200+ MITRE ATT&CK techniques, and compilable low-level payloads.

---

What is Inside v1.2.0

• 8 Core Progression Phases:

  • Phase -1: Hardened OPSEC & Anonymous Infrastructure (counter-surveillance, non-persistent OS, proxy chains)
  • Phase 0: Low-Level Foundations & Systems Internals (x86-64 assembly, C internals, PE/ELF formats, Windows Native API)
  • Phase 1: Modern Web & API Attack Surface (cloud SSRF, OAuth/JWT abuse, race conditions, GraphQL)
  • Phase 2: Network Pivoting & Active Directory Mastery (Kerberos attacks, NTLM relaying, ADCS ESC1-15, Entra ID)
  • Phase 3: System & Kernel Exploitation (position-independent shellcode, ROP chains, Windows heap, BYOVD)
  • Phase 4: 9 Specialized Operator Tracks (EDR evasion, C2 protocol design, rootkits, AI/LLM security, supply chain)
  • Phase 5: GREATEST (Apex Vulnerability Research & 0-Day discovery)
  • Phase 6: Special Operations & Full-Scope Adversary Simulation (physical entry, RF/SDR recon, post-quantum readiness)

• Interactive Operator Journey Tracker:

  • .github/TRACKER.md: A personal milestone and progress dashboard. Operators fork the repository to record their handle, target specialized tracks (primary and secondary), track start/completion timelines, and check off verifiable lab capstones from Phase -1 through Phase 6.

• Black-Bag Tradecraft Volume:

  • black-bag/BlackHat_Long-Term_Survival_Tactics.md: 3,000+ line operational security manual covering digital persona architecture, compartmentalization, operational silence, counter-surveillance, and long-term lifecycle OPSEC.

• Weaponized & Compilable Payloads:

  • 01_dynamic_api_resolver: In-memory PEB traversal and DJB2 hash-based API resolution in C.
  • 02_offensive_rust_loader: Dynamic memory allocation, RW to RX state transitions, and hardened evasion in Rust.

• 7 Master Field Guides:

  • Lab Setup Guide (multi-forest AD, hypervisors, malware analysis sandboxes)
  • 300+ Tools Inventory (indexed across 18 operational categories)
  • MITRE ATT&CK Quick Reference (Enterprise v15, ICS, and ATLAS cross-mapping)
  • Philosophy & Mindset (first-principles adversary thinking)
  • Resources Archive (canonical literature, whitepapers, conference proceedings)
  • Comprehensive FAQ (hardware kits, career paths, 2027 quantum transition)
  • Final Word Capstone (curriculum stats, researcher attributions, future roadmap)

---

Getting Started

1. Curriculum Launchpad: Read the master curriculum launchpad in README.md to find your background entry track.
2. Track Your Progress: Fork the repository and open .github/TRACKER.md to log your milestones, select your Phase 4 tracks, and check off capstones as you progress.

Community & Feedback

• 💬 Have questions, ideas, or feedback? Join the conversation in Discussion #1.
• 🐛 Found a typo, dead link, or payload bug? Please open an issue.

---

⭐ If this curriculum provides value to your journey, consider starring the repository to support ongoing research and development.