Writeups and technical notes.
This is where I keep vulnerability research, penetration-testing writeups, lab notes, and other technical work that I have cleaned up enough to publish.
CVEs and vulnerability disclosures.
Security issues I have researched, validated, documented, and responsibly disclosed.
Hack The Box writeups.
Machines I worked through while building my penetration-testing methodology and preparing for CPTS. These focus on the attack path, why each technique worked, and what I took away from the box.
Fluffy
An internal document led me to a credential-capture foothold, which opened an Active Directory attack path through delegated permissions, service accounts, and ultimately AD CS to reach Administrator.
Jeeves
A Jenkins instance exposed on a non-standard port gave me an initial shell. From there, a KeePass database led to Administrator access, with the final flag hidden in an alternate data stream.
POV
A vulnerable download function exposed the application’s ASP.NET configuration and let me forge a malicious ViewState for code execution. Recovered local credentials then provided the path to SYSTEM.
Tombwatcher
This box was a long, BloodHound-driven Active Directory chain where each compromised account exposed the next permission to abuse, eventually leading through a restored certificate account to Domain Administrator.
Expressway
When the initial TCP scan showed almost nothing useful, UDP enumeration exposed the real path. Information from TFTP and IKE led to working SSH credentials, followed by a vulnerable sudo version for root.