I break into networks, web apps, and Active Directory forests for a living, then write the report that helps the blue team fix it. CEH and CPTS certified. Red team, pentesting, and the occasional late-night CTF grind.
Three years in, I've lost count of the apps, networks, and AD forests I've chewed through. I chase down OWASP Top 10 issues: injection flaws, broken access control, misconfigurations, against internal and external client environments. My job is simple. Find what the attacker would find, before they do, then prove it with a repro, not a guess.
I play the threat actor so your SOC doesn't have to meet a real one cold. BloodHound maps the graph, then Impacket and Mimikatz do the dirty work: Kerberoasting, AS-REP roasting, weak trust relationships, excessive privilege, all the way to domain compromise. The goal isn't just a flag. It's figuring out exactly where the defence blinks.
CPTS
CEH
HTB's CPTS and EC-Council's CEH, backed by three-plus years of hands-on engagements. I don't treat certs as trophies. They're just proof I've been tested on the same stuff I claim to know.
Zero access, zero hints. I started with a company name and an IP range. OSINT turned up a reused password, credential stuffing got me a shell, and from there it was a short walk to root. Honestly, the weakest link was never technical. It was reuse.
Grey box, the closest thing to modelling an insider threat. Vhost enum was the chef's kiss here; a hidden Jenkins instance was quietly screaming for attention. A sloppy sudo rule did the rest. Root in under a day.
Read Report arrow_forward
White box. I had the source, the network map, the works, and it still took real work. Two segmented environments, a careful pivot, SNMP leaking what it shouldn't, and eventually root on both. My favourite engagement so far.
What I'm reading, writing & pwning lately
A top 10 tech company admitted 6.5 million leaked passwords in 2012. Four years later, 117 million went on sale. How the attacker got in, how LinkedIn found out, and how they fixed it.
Sumit Gupta's small Delhi office quietly phished politicians, journalists, NGOs and hedge funds for seven years. Citizen Lab finally caught them in 2020. The full case study.
A criminal SaaS startup that franchised ransomware. Travelex, JBS, Kaseya, Quanta, Acer. Then the FBI, Cyber Command and the FSB caught up. The full RaaS playbook.
A Geelong bartender found a 1am to 3am NAB ATM bug. 18 months and AU$1.6 million later, he walked into 60 Minutes and confessed. The bank denied it.
Sachin Dev Duggal conned Microsoft, SoftBank and Qatar with an AI named Natasha. Behind it sat 700 engineers in India writing code by hand. The full story.
A $100 login bought $10.7 million out of Citibank. The St. Petersburg group that found the door, and the X.25 network nobody was watching.
The Alvi brothers signed their names, phone number, and Lahore address inside the first IBM PC virus. Then they built Pakistan's biggest ISP. A case study.
OSINT recon → username-anarchy generation → Hydra FTP/SSH brute force → Sherlock Reddit OSINT → MySQL credential reuse → GTFObins sudo ftp → root.
Dual-machine white-box engagement. SNMP enumeration → IMAPS credential extraction → R-services lateral movement → SSH key exfiltration → root on both KGF1 & KGF2.
Virtual host enumeration → Jenkins default-cred RCE via Groovy console → XLSX hash cracking → rbash escape via vi → GTFObins scp to root.