back5lash:~$ whoami
You've never heard of me. That's the job.
I am a hacker. I have been doing this for a long time. Professionally. I do not advertise and I do not explain my methods. If you are reading this, someone gave you the address. That was deliberate.
I was thirteen the first time I was inside a system I had no business being inside. I had been locked out of an account, and where most people would have given up or asked someone for help, I studied the lock instead. I found that the system kept a second entrance — a path in for anyone who could answer the right questions. A first pet. The street I was raised on. My mother's maiden name. I answered every one of them, and I was through within the hour. That was the day I understood what I am. The recovery path is the weakest point in any system built by people, and I have been walking through it ever since. I have never once been turned away.
A matter of professional courtesy before we go any further. The name is A Hacker Named Back5lash — the whole of it, the five included. People shorten it; they see the number and reach for the familiar word, and I correct them, because I assume anyone would want to be corrected. Don't call me Backslash. It's rude. Say the whole thing or don't say it at all. There is no sharpness in the reminder. I am simply telling you a thing you would rather know than not.
My work is a method, and I do not deviate from it. I run the same sequence every time, in the same order — study, then preparation, then position, and only then the move. The order is not a habit. It is the expertise. Most people believe the skill lives in the final step; they are looking in the wrong place entirely. By the time I arrive at the final step the outcome is already settled, because everything that settles it happened earlier, in the order it was meant to. I prepare until there is nothing left to prepare. What remains after that is the smallest part of the work — and the part everyone else mistakes for the whole of it.
I have made one lasting contribution to the vocabulary of this field, and I will claim it plainly. PaaS. Pwning as a Service. The client names the objective; I take full responsibility for reaching it; the client is never troubled with the how. I coined the term years ago and I still consider it the cleanest description of the model there is. It has not been widely adopted yet. That is the field's oversight, not a fault in the term, and recognition of this kind tends to arrive late.
There are lines I hold to without exception, and I hold to them absolutely. I do not work against a former client; the relationship outlasts the invoice. I do not begin an engagement before intake is complete — not once, not as a favour, not under any deadline. I do not work from equipment that is not my own. I do not take engagements by phone. And I do not touch hospitals or emergency services, ever: there are systems where failure is counted in lives, and those are not mine to gamble with. A professional is defined as much by the work he turns down as by the work he accepts.
Certifications are for people who need to prove something to someone who was not going to take their word for it. I have never been that person; the work is its own proof, and the people who matter can already tell the difference. I am completing one regardless — the credential ends a certain kind of conversation before it can begin, and I find that efficient. I take on very little. I am selective past the point most would think reasonable, and exactly to the point I think correct. For the right engagement, I am available.
The discipline is not one thing. It is a set of capabilities, applied in the correct order, by someone who knows which order that is.
Before I go in, I learn everything about the target — their people, their routines, the shape of their day. It takes months. I work the search engines the way they were built to be worked, the older ones, from before they started deciding what you were permitted to find. What I need is always out there. People have no idea how much of themselves they leave where anyone patient enough can read it.
Every system has a way in. More often than not it is a door someone already left open — an account with no password on it, a page that was never meant to face the public. I find the one that was left open, and I walk through it. The doors that are properly shut I note, and I move past them. Patience leaves more of them open than force ever could.
A lock is only as strong as the odds against opening it. I work through the choices people actually make until one gives. The list of what they choose is short. I know it by heart.
My presence online is deliberate and minimal. I run my own private network, hosted by me, so no one else controls the line. And I use a different password on every account.
The technical layer is only half of any target. The other half is the person in front of it, and people will tell you far more than they should if you simply ask. I call, and I ask, and most of the time they answer. When they do not, it only means I have not yet reached the right person. I always reach the right person in the end.
The best work leaves no name behind it. You have not heard of me, and that is the point. The operators whose names you know all made the same mistake somewhere. I have made none.
A record of what I have built and where I operate. Assembled over years. Maintained personally.
A framework I built for automated reconnaissance. It runs the sweep of a target and writes the complete results to disk, so nothing is lost between the survey and the approach. I built it to take the manual steps out of the work. It has not failed once.
A list of every password worth trying, built up over years. When a target's front door is a password, this is what I put against it. The list is the work. Knowing it is complete is the skill.
A single-purpose script, commissioned to my exact specification and kept ready at all times. It runs the moment access is achieved and carries out the rest on its own. The best money I have spent. The work does not begin until it runs.
I entered a capture-the-flag competition against a field of the best in the field. Multiple categories — web, binary, cryptography. A real test, under real pressure. I participated to completion.
I am completing a recognized offensive-security certification. It is not handed out. The material holds nothing I have not already done in the field, but the credential closes a conversation before it starts.
In progress
A Hacker Named Back5lash. I walk through the biggest names in the field and the small, stupid things that took each of them down. If you want to learn how people get caught, learn it from someone who hasn't been. I do not ask anyone to subscribe.
Client work is confidential by default. What can be shown is shown here.
My most significant contract to date. The client required command-level access to the military operations of Atropia — not a perimeter, not a public-facing system, the operational core. I have taken work at every scale in this profession. This was the largest, and I treated it accordingly. Scale is a matter of preparation, and preparation is where I am strongest.
Reconnaissance on a target of this magnitude cannot be hurried. Mine took four months. I do not regard that as a delay. I regard it as the work. I built the picture from the ground up — the structure, the chain of command, the points where a large organization is exposed without knowing it. I worked from open sources exclusively, because open sources are where the real intelligence lives and because a careful operator leaves no trace during the survey. The current generation of search tools filters heavily and returns what it wants you to see. I used older methods, which return what is actually there. By the end of it I understood the target better than most of the people inside it.
With the picture complete, I made the two decisions that define a professional engagement. First, I commissioned the tooling. I do not reach for whatever is nearest to hand; I had a script written to my exact specification by a qualified professional, staged and ready to run the moment I was through. Delegating the build is not a limitation. It is seniority. Second, I brought up my own private network — hosted by me, so that no one else controls the line — and confirmed I was untraceable before I advanced another step. Security comes before the first move, never after it.
When the preparation was complete, I moved on the objective. I will not detail the window or the mechanism; the client's confidentiality is absolute and I do not commit live tradecraft to writing. What I will say is this: when I arrived at the objective, another group had reached it ahead of me. Very fast. Very thorough. I assessed their work with professional respect — it was clean, and clean work merits acknowledgement regardless of who produced it. What remained of the operation was archived and released under the classification of a mockumentary. I have reviewed that material in full. It is consistent with my own findings.
I regard the engagement as a success in every respect I control. The reconnaissance was flawless. The preparation was complete. The tooling was staged and correct. That another party reached the objective marginally ahead of me is a matter of timing, and timing is the one variable no operator commands. The payment has not yet cleared. I am not concerned. On contracts of this size settlement takes time, and I have never once in my career chased an invoice. These things settle.
Status: Payment pendingThe most efficient engagements are the ones I originate myself. For this one I identified a target holding material it could not afford to see published, acquired that material, and converted the position into a demand. There is no client to answer to on a self-directed operation and no margin surrendered to a middleman. It is the purest form of the work, and it is the form I prefer.
I selected the target after a period of study and moved on its holdings deliberately. Acquiring sensitive material is not a smash-and-grab; it is a careful reading of what an organization keeps, where it keeps it, and which of it carries consequence if it leaves. I took my time. By the end I held a body of their material and I understood precisely what it was worth to them. A less experienced operator grabs volume. I grab leverage. They are not the same thing, and only one of them pays.
With the material in hand I set the demand. The figure was priced against the cost to the target of disclosure, not against my own effort — a professional prices the consequence, never the labour. I prepared the proof, chose deliberately what to show and what to withhold, and structured the communication so the target understood both the seriousness of the position and the discretion available to them if they were sensible about it.
I issued the demand and adopted the posture the situation required, which is patience. The party under pressure is the one who must move; the operator applying the pressure does not chase, does not repeat himself, and does not betray urgency. Silence, on my side of the exchange, is not weakness — it is leverage, and I let it work. I sent what needed sending, once, and I waited.
Status: Awaiting settlement// 2 comments
l_barrowMar 6, 2025
I run the company you emailed. You said you had breached us and would publish our data unless we paid. Everything you attached as proof is already on our website — we published it there ourselves. You linked this page in the demand, which is how I ended up reading it.
Back5lashauthorMar 7, 2025
The material was acquired and its sensitivity established. That you also chose to publish it does not change that I held it first. The leverage was real. The demand stands.
A client retained me to obtain a specific set of confidential files held by a competitor. Locate the material, remove it cleanly, place it in the client's hands. Commercial acquisition of this kind is a discipline of precision: the wrong files are worse than no files. I take the right ones, and I take them clean.
I located the material, extracted it, and delivered the complete set to the client, in full, exactly as contracted. The files were removed from the competitor's environment and placed in the client's hands. That is the measure of the work — obtained, and delivered. Both were done. I do not consider an engagement of this kind partial once the deliverable is already with the client.
Status: Delivered// 2 comments
f_duboisOct 14, 2024
The files arrived, as promised. Every one of them is encrypted and he does not have the key, so we cannot open a single file. He tells us the engagement is complete because the data was extracted.
Back5lashauthorOct 15, 2024
The contract was acquisition and delivery. Both were performed to specification. Decryption was never in scope and was never discussed. The material is in your possession. The engagement is complete.
A client engaged me to reach into a target organization, and I determined that the most efficient path ran through its leadership rather than its perimeter. Systems are hardened. People are not, and the people closest to authority are the softest of all, because everyone beneath them is conditioned not to question them. I spent weeks on the executive layer — the reporting lines, the personalities, who deferred to whom and how quickly. Human reconnaissance is more demanding than the technical kind; a system behaves consistently and a person does not. I learned the chain of authority cold before I said a word to anyone inside it.
The approach was built on authority. The most effective pretext is not a clever story; it is a position no one in the organization feels able to challenge. I presented as the organization's leadership and directed the operation from that position, because people do not interrogate an instruction that appears to come from the top — they act on it. That is the entire mechanism, and it is far older than any network. I will not detail the specifics; the design is mine and the client's matter is confidential.
I ran it as a sustained campaign rather than a single contact, because authority applied once is a request and authority applied consistently is a routine. I held the pretext across the length of the engagement and moved the target steadily toward the action the client required — contact by contact, along the line I had drawn for it.
Status: Concluded// 2 comments
n_stavrosJul 22, 2024
You walked me through this one, Backslash. To move the executive, you phoned the company posing as their chief executive. Their chief executive is a woman. You did not check before you called.
Back5lashauthorJul 23, 2024
My name is A Hacker Named Back5lash. Don't call me Backslash. It's rude. Say the whole thing or don't say it at all.
No evidence of the work was ever found.
— Name withheldNothing in our environment was disturbed. Nothing was out of place afterward.
— ████████████The matter has not been raised again since.
— Name withheldNo one has contacted us about it. Not once.
— Principal, ████████Our systems were unaffected throughout the engagement.
— ██████████He was clear that he could not discuss the method, and he never did.
— Name withheldThe email above is a courtesy, for those who have not yet found the right door. The proper channel is this one:
Serious inquiries only. I do not discuss my methods, my clients, or my rate in writing. If you have the address, you already have what you need.
You will not find me anywhere else. That is the credential.
// 3 comments
j_hollowayAug 8, 2023
I am the one who put him onto the Atropia job. It was a joke between friends. Atropia is not a real country — it is a fictional one an army uses for training exercises. There was no client. We did not think he would actually spend four months on it.
Back5lashauthorAug 9, 2023
Atropia is a live training environment run by a national army. That is not a smaller target. It is a more disciplined one. The engagement was real because I was engaged. The rest is detail.
s_ferroNov 2, 2023
The "mockumentary" is a comedy short. It is publicly viewable and it is not classified. He appears to have watched it and taken it for intelligence.