22nd Survey Division is an Australian offensive security training platform built from live research — not sanitized tutorial content. 22 core modules + 3 bonus modules covering Windows internals, malware development, rootkits, C2 frameworks, Android RATs, social engineering, and malware analysis. Every technique taught from first principles with real tools tested against live AV engines.
Built by: George Wu (VADER) — Windows security researcher, Sydney
Entity: OCCUPATION FORCE CALLSIGN GSW PTY LTD (ACN 692 429 397)
Research: MSRC VULN-195458 (Windows Defender Tamper Protection bypass, responsibly disclosed)
Mentor: [HTB] — Israeli offensive security specialist, former anti-virus engineer, IDF soldier. Teaches: "Save every rung." "Privilege escalation is easy." "Real attacks are carried remotely."
| Page | What It Is | Link |
|---|---|---|
| Main Site | Course overview, pricing, proof | rainfantry.github.io/22nd-survey-division |
| Crash Course | 22 core modules + 3 bonus modules + mentor teachings + 8-week plan | → Crash Course |
| Practical Labs | Step-by-step exercises, SSH tests, defense bypasses | → Practical Labs |
| Module Tree | Complete archive — every module, every link | → Module Tree |
| Resources | Cheat sheets, command reference, mentor documents | → Resources |
-
Read the Crash Course → crash-course.html
- 22 core modules + 3 bonus modules organized in 5 phases
- Mentor teachings explained in plain English
- 8-week study plan with deliverables
-
Do the Practical Labs → practical-labs.html
- Copy-paste commands
- Expected outputs shown
- "If this fails" troubleshooting for every step
- Interactive quizzes with right/wrong feedback
-
Check the Module Tree → module-tree.html
- See all modules at once
- Click any module to jump to it
- Status shows what's live vs pending
-
Reference the Resources → resources.html
- Command cheat sheets (recon, privesc, persistence, defender, C2)
- Mentor documents (WHAT_I_HAVE.md, PRIVESC_LADDER.md)
- Tool downloads and build instructions
For people who already know Python, C, or PowerShell but want to learn offensive security.
| Order | Module | What You Learn |
|---|---|---|
| 1 | Module 00: Reader | Course guide, lab setup, study methodology |
| 2 | Module 01: Networking | OSI model, TCP/IP, ports, protocols, Wireshark |
| 3 | Module 02: Recon | Active/passive recon, OSINT, network mapping |
| 4 | Module 04: Coding Basics | C, Python, Windows API for security |
| 5 | Module 06: Memory | Virtual memory, paging, heap vs stack, EPROCESS |
| 6 | Module 10: Code Injection | DLL injection, process hollowing, APC, reflective DLL |
| 7 | Module 08: Privilege Escalation | Token abuse, service misconfig, unquoted paths, UAC bypass |
| 8 | Module 09: Malware Development | Shellcode, XOR encoding, API hashing, anti-sandbox |
| 9 | Module 13: EDR Evasion | Direct syscalls, HWBP bypass, AMSI/ETW bypass, unhooking |
| 10 | Module 16: C2 | Beacon vs interactive, jitter, encryption, Discord bridge |
| 11 | Module 20: Kill Chain | MITRE ATT&CK, TTP mapping, purple teaming |
| 12 | Module 21: Capstone | GeoDefend scenario — full operation from recon to exfil |
| BONUS | Module 22: Web Application Hacking | Recon, auth, SQLi, IDOR, API signature breaking |
| BONUS | Module 23: Infostealers | Builder, victim, C2, detection rules, incident response |
| BONUS | Module 24: Malware Analysis & Backdoor Auditing | Static analysis, IOC extraction, real backdoor discovery |
For people who know pentest tools and the kill chain but want to build their own tooling.
| Order | Module | What You Learn |
|---|---|---|
| 1 | Module 00: Reader | Course guide, lab setup, study methodology |
| 2 | Module 01: Networking | Protocols, ports, packet analysis, tunneling |
| 3 | Module 02: Recon | Active/passive reconnaissance, OSINT targeting |
| 4 | Module 03: PowerShell | Cmdlets, remoting, WMI, AMSI bypass basics, LOLBAS |
| 5 | Module 04: Coding Basics | C, Python, Windows API, compilation, debugging |
| 6 | Module 05: Shellcode | Assembly, registers, PIC, PEB walking, encoding |
| 7 | Module 07: Registry | Hives, persistence, forensics, offline analysis |
| 8 | Module 11: Rootkits | Persistence mechanisms, DLL sideloading, API hooking |
| 9 | Module 12: Defensive Verify | Memory scanning, behavioral analysis, EDR testing |
| 10 | Module 15: Lateral Movement | Pass-the-Hash, Kerberoasting, WMI, PSExec, DCOM |
| 11 | Module 17: Social Engineering | Phishing, pretexting, OSINT targeting, payload delivery |
| 12 | Module 21: Capstone | Full operation — recon, exploit, persist, exfil |
Your mentor's words: "Real attacks are carried remotely. Physical access is niche. The inbox is the new building perimeter."
Social engineering is the highest-ROI skill for independent operators. It requires no zero-days, no expensive tools, and no physical access. It requires understanding human psychology, building credible pretext, and delivering payloads through trust.
Start here for social engineering:
- Module 17: Social Engineering — The full course on phishing, pretexting, OSINT targeting, and payload delivery
- Module 02: Recon — OSINT for building target profiles
- Module 16: C2 — Payload delivery and command infrastructure
|------|-------|-------------| | 1-2 | Socket programming + reverse shells | Working C reverse shell (Windows + Linux) | | 3-4 | OpenSSH persistence + VNC | .42 with SSH + VNC, documented | | 5-6 | PowerShell remoting + AMSI bypass | Lateral movement lab, obfuscated scripts | | 7-8 | AD advanced (BloodHound, DCSync, tickets) | AD lab attack path report | | 9-10 | Linux privilege escalation | 10 THM boxes completed | | 11-12 | Cloud persistence (AWS, Azure) | Cloud-based C2 proof of concept | | 13-14 | EDR deep-dive | Research paper: "EDR evasion beyond HWBP" | | 15-16 | iOS + Flutter | Jailbreak persistence, Flutter RE report |
Mentor's rule: "Organized notes > memorization. Cheat sheets > textbooks."
These are the lessons from [HTB] that shape every module:
| Lesson | What It Means | Where to Learn |
|---|---|---|
| "Reverse shell is basic" | The foundation everything builds on | Module 16 (C2), Practical Labs Exercise 7 |
| "Organized notes > memorize" | Build cheat sheets, not memory | Resources page, Module 02 (Recon) |
| "Privilege escalation is easy" | Misconfigurations, not 0days | Module 08 (Privesc), Practical Labs Sim 2 |
| "Save every rung" | Persistence at every level | Module 11 (Persistence), Practical Labs Widget 3 |
| "Real attacks are remote" | Physical access is niche; remote is money | Module 17 (Social Engineering) |
| "Defender management" | Full spectrum from silent to nuclear | Practical Labs Exercise 3-6 |
| "System settings" | Attack surface lives in configuration | Module 03 (PowerShell), Resources Quick Ref |
| "Eventually all comes to networking" | Every technique needs a channel | Module 01 (Networking) |
| "Linux terminal is way easier" | Learn both, use both | Module 03 (PowerShell) |
| Module | Title | Status |
|---|---|---|
| 00 | Reader Guide — How to Use This Course | ✅ Live |
| 01 | Networking Fundamentals | ✅ Live |
| 02 | Recon & OSINT | ✅ Live |
| 03 | PowerShell Warfare | ✅ Live |
| 04 | Coding Basics | ✅ Live |
| Module | Title | Status |
|---|---|---|
| 05 | Shellcode Development | ✅ Live |
| 06 | Memory Forensics | ✅ Live |
| 07 | Registry Analysis | ✅ Live |
| 08 | Privilege Escalation | ✅ Live |
| Module | Title | Status |
|---|---|---|
| 09 | Malware Development | ✅ Live |
| 10 | Code Injection | ✅ Live |
| 11 | Rootkits & Persistence | ✅ Live |
| 12 | Defensive Verification | ✅ Live |
| 13 | EDR Evasion | ✅ Live |
| Module | Title | Status |
|---|---|---|
| 14 | Cloud Files & Exfil | ✅ Live |
| 15 | Lateral Movement | ✅ Live |
| 16 | C2 Frameworks | ✅ Live |
| 17 | Social Engineering | ✅ Live |
| Module | Title | Status |
|---|---|---|
| 18 | Android RAT | ✅ Live |
| 19 | Active Directory | ✅ Live |
| 20 | Full Kill Chain | ✅ Live |
| 21 | Capstone: GeoDefend | ✅ Live |
Bonus: CEO Translation (board-ready risk language) Bonus: Module 22: Web Application Hacking Bonus: Module 23: Infostealers Bonus: Module 24: Malware Analysis & Backdoor Auditing
Hardware breakpoint bypass for AMSI + ETW. Zero memory writes. 26 Defender-clean binaries. MSRC VULN-195458 research.
Test: Windows 11, Defender RTP + cloud + BehaviorMonitor — CLEAN. Kaspersky Premium — CLEAN.
8-layer AV evasion stack. TCP reverse shell. XOR obfuscation, dynamic API resolution, anti-sandbox timing, PE header stomping.
Test: 10/10 POCs verified on live machine (192.168.1.92). Kaspersky Premium 21.25 — 0 detections.
Full C2 framework. Browser-based operator panel. GPS exfil, VNC shell, AES-256-CBC beacon, Discord bridge, service persistence.
Test: 2 agents live. GPS polling 5s. SMS dump 47 messages. Play Protect bypassed.
Zero-width Unicode steganography. Covert channel framework. 16-character invisible alphabet.
Test: Payload hidden in Discord message. Entropy 0.12. Kaspersky CLEAN.
Windows reconnaissance framework. Process enumeration, privilege escalation checks, network mapping.
Test: 1229 lines of output. Standard user context. 2 writable SYSTEM services found.
| Lab | IP | Status | Key Finding |
|---|---|---|---|
| WUPC | 192.168.1.42 | ✅ SSH_OK | SeImpersonatePrivilege + writable service |
| HOST | 192.168.1.92 | ✅ SSH_OK | Kaspersky active, real-world target |
| RADON | 192.168.1.145 | ⏳ Timeout | C2 beacon SYN_SENT |
Verified 2026-06-29: WUPC .42 — SSH_OK, Admin context, SeImpersonatePrivilege ENABLED. HealthSecurityHost service with Authenticated Users:(M) permissions → SYSTEM in one restart.
Every push is validated by the test suite:
# Run all tests
bash scripts/test-all.sh
# Check site health
bash scripts/validate-site.sh
# Check all links
python3 scripts/check_links.py .
# Performance audit (ad-hoc — quota limited)
bash scripts/perf-check.sh
# Create release
bash scripts/release.sh v2026.06.29Test Results (Latest):
- ✅ 5/5 main pages: 200 OK
- ✅ 29/29 module pages: 200 OK
- ✅ 756/756 internal links: valid
- ✅ 27 quiz options: interactive
- ✅ 28 module tree items: complete
- ✅ All modules have mentor callouts and copy buttons
- ✅ Bonus modules: Web Application Hacking, Infostealers, Malware Analysis & Backdoor Auditing
| Target | Details |
|---|---|
| Production | GitHub Pages (auto-deploy from main) |
| URL | https://rainfantry.github.io/22nd-survey-division/ |
| Staging | http://192.168.1.92:18080/ (local server) |
| Type | Static HTML — no DB, no env, no backend |
# If release breaks something:
git revert HEAD && git push origin main
# GitHub Pages redeploys in ~2 minutesTo move to a new host:
- Copy all files from repo
- Update
CNAMEif using custom domain - Run
bash scripts/test-all.sh - Done — no database migration needed
See DEPLOYMENT.md for full details.
| Date | Commit | What Changed |
|---|---|---|
| 2026-06-29 | ded05d0 |
Automated testing suite, DEPLOYMENT.md, perf-check.sh |
| 2026-06-29 | 36135c2 |
Test scripts, link checker, release pipeline |
| 2026-06-29 | e199d7b |
Interactive quizzes, module-tree.html, copy buttons |
| 2026-06-29 | 7d3641e |
Copy buttons on practical-labs + resources |
| 2026-06-29 | 88201d0 |
Mentor redaction (asi dev → mentor), HTML comments cleaned |
| 2026-06-29 | 4051288 |
Resources: Quick reference cheat sheets, KILL_CHAIN_LAB_EVIDENCE |
| 2026-06-29 | 47ef0eb |
Practical Labs: SSH tests, defense bypasses, simulations, widgets |
| 2026-06-29 | 69483d5 |
Crash course expanded with detailed mentor explanations |
This course teaches authorized security testing only. Every tool is tested on own hardware or authorized lab environments. MSRC responsible disclosure filed for all Microsoft-related findings.
No false claims:
- Every AV result is from live testing, not speculation
- Every screenshot is from real execution, not mockups
- Every module teaches why it works, not just how to copy it
- Every tool includes honest limitations and detection vectors
What you won't learn here:
- How to hack random people (illegal and immoral)
- How to evade law enforcement (impossible and stupid)
- How to get rich quick (this is a trade, not a lottery)
What you will learn:
- How Windows actually works under the hood
- How AV/EDR detects threats and how to engineer around it
- How to build tools from first principles
- How to think like an attacker so you can defend like one
This project is dedicated to my parents, who came from nothing and gave me everything. To Cheyanne — the fighter who never stops battling for her health, whose defiance against the odds inspired every bypass that beats Defender and KAV. And to RADON Associates — for their partnership and support throughout my years growing up, turning a kid with a laptop into someone who could build things that matter.
Entity: OCCUPATION FORCE CALLSIGN GSW PTY LTD
ABN: 50 692 429 397
ACN: 692 429 397
MSRC: VULN-195458 (responsible disclosure)
Location: Sydney, NSW, Australia
- Email: gwu0738@gmail.com
- LinkedIn: linkedin.com/in/georgewu108
- GitHub: github.com/rainfantry
- Discord: The Coalition (invite via email)
VIDIMUS OMNIA — We see everything.