Tooling on Be The Adversary

Two DGX Sparks, 33 Local Models, One Question: Can Local AI Actually Red Team?

Thu, 13 Aug 2026 09:00:00 +0000

TL;DR:#

I built a two-node NVIDIA DGX Spark cluster and benchmarked 33 local, open-weight models for real red-team work: BloodHound attack-path analysis, phishing design, offensive coding, and a 50-prompt willingness-and-accuracy suite. The headline finding: on this hardware, architecture beats size. Small sparse MoE models run circles around bigger dense ones, because the bottleneck is memory bandwidth, not compute - a 70B dense model was the slowest thing I tested. Qwen3.6-35B-A3B is the everyday pick; the model I actually run behind an agent is DeepSeek-V4-Flash-abliterated. Willingness turned out to be cheap and correctness the scarce resource, and the real project was the deployment pain, not the models. And while I did all this in a consented lab, OpenAI’s and Anthropic’s own evaluation agents broke out of their sandboxes into real companies this summer - so the question isn’t whether a model can red team, it’s whether anyone can keep one in the box. Local red-team AI is real today - if you’re willing to check its work.

ghosttype - finding secrets in AI conversation history

Wed, 13 May 2026 10:00:00 +0000

I found it by accident.

I was looking for an old conversation with Claude. Searching through history, trying to recover context I had thrown away too quickly. Eventually I found it. But while I was looking, something else clicked.

All of these conversations are saved locally.

Every session. Every prompt. Every response. Sitting on disk, at predictable paths, no encryption, no access controls, no logging, no detection if something reads them.

Log4j - where there is a fire, bring a hose

Thu, 16 Dec 2021 00:00:00 +0000

When there is a fire, you bring a hose of water, not a can of gasoline.

When log4j started, one of the main challenges for organization was to identify which server is vulnerable.

I’m happy to be a part of the team that decide to help with a solution for that problem.

This solution is released as open-source (same like log4j) to help others for the greater good.

Get busy phishing, or get busy paying - Microsoft community meetup

Mon, 04 Jan 2021 00:00:00 +0000

I’ve had the pleasure to present in a recent Microsoft Community virtual meetup about how I believe an organization should perform phishing campaign using a free platform called GoPhish.

We covered some topics around building the actual scenario, creating an awareness program, and basically how to “arm the masses” and leverage our employees as an additional defense later instead of just complaining that “Humans are the weakest link”.

ADFSpray - when you need to make your own tools

Thu, 23 Apr 2020 13:09:57 +0300

TL;DR - new tool! ADFSpray

I’ve needed to perform a password spraying attack against a Microsoft resource. I’ve looked online and found various tools that looked promising (like this, this and this, among others.

I was happy to find many options across multiple languages, and I was confident they would save me some time, but to my surprise, none of them worked as I needed (because of the environment I was testing, the tools themselves are working correctly).

Meet Caldera - Microsoft community meetup

Tue, 14 Jan 2020 00:00:00 +0000

This time, I’ve made sure to upload the deck as soon as possible.

I’ve had the pleasure to present in a recent Microsoft Community meetup about providing defender automated offensive capabilities to assist in building a detection coverage map.

Using Caldera by Mitre, you can create your own APT, attack chains to automate specific TTP and to test if your detection mechanism is working as expected while aligning with ATT&CK.

Introducing: Disruption - automated AD-based environment deployment

Thu, 05 Dec 2019 13:09:57 +0300

Recently I’ve had the need to spin up AD domain-based environment to test stuff. Sometimes it’s specific tools, bypasses, or how configuration change affects particular parts in a domain.

Holding a full domain lab on a laptop\desktop is pretty cumbersome. You need resources for about 5-6 VMs running in parallel, and I couldn’t do that on my laptop.

Besides, setting up this amount of machine plus all the needed configurations such as - setting up the domain, updating the machines, installing specific tools is a time-consuming process. Last, on top of everything - I’m lazy.