Windows for Hackers

Install a free Type 2 hypervisor on your own computer, create a Windows evaluation VM and a security-focused Linux attacker VM, and put both on a host-only or internal network so they reach each other but have no route to the internet or your home network. Take a clean snapshot named baseline so you can roll back after every experiment in minutes.

Windows runs most corporate desktops and a large share of servers, so most penetration tests and real attacks happen against it or the directory service that manages it. Decades of backward compatibility add legacy protocols, forgotten services and complex trust relationships, creating a wide attack surface that rewards testers who understand the system rather than just running tools.

An access token is the identity and group memberships attached to a running process. Windows checks it on nearly every action to decide what the process may do. This is why offensive Windows work is mostly about identity: the goal is to move from a weak token to a stronger one. You can inspect your own with whoami /groups.

Only on systems you own or have explicit written permission to test. In many countries, accessing a system without authorisation is a crime even if nothing is changed. This course is built around an isolated lab you own, on a network with no route to anyone else, so you can practise aggressively without harming anyone.

Services are background programs that often run as powerful accounts such as SYSTEM. A weakly configured service can turn a low-privileged foothold into full local control, making services one of the most common privilege-escalation paths. The same knowledge lets a defender spot and fix those weak configurations.

Event ID 4624 records a successful logon and carries the logon type, 4625 a failed logon, 4672 a logon granted special privileges, and 4688 a new process. With command-line auditing enabled, 4688 shows what actually ran. You can read them in Event Viewer or with wevtutil, and Sysmon adds far richer detail.