Writeups and technical notes.
This is where I keep vulnerability research, offensive-security lab work, defensive analysis, and other technical work that I have cleaned up enough to publish.
CVEs and vulnerability disclosures.
Security issues I have researched, validated, documented, and responsibly disclosed.
Offensive security and penetration testing.
Hack The Box machines I worked through while building my penetration-testing methodology and preparing for CPTS. These focus on enumeration, exploitation, privilege escalation, Active Directory attack paths, and why each technique worked.
Fluffy
An internal document led me to a credential-capture foothold, which opened an Active Directory attack path through delegated permissions, service accounts, and ultimately AD CS to reach Administrator.
Jeeves
A Jenkins instance exposed on a non-standard port gave me an initial shell. From there, a KeePass database led to Administrator access, with the final flag hidden in an alternate data stream.
POV
A vulnerable download function exposed the application’s ASP.NET configuration and let me forge a malicious ViewState for code execution. Recovered local credentials then provided the path to SYSTEM.
Tombwatcher
This box was a long, BloodHound-driven Active Directory chain where each compromised account exposed the next permission to abuse, eventually leading through a restored certificate account to Domain Administrator.
Expressway
When the initial TCP scan showed almost nothing useful, UDP enumeration exposed the real path. Information from TFTP and IKE led to working SSH credentials, followed by a vulnerable sudo version for root.
Defensive analysis and incident investigation.
Hands-on defensive labs focused on investigating suspicious activity, validating indicators, and documenting the evidence used to reach an assessment.
UFO-1
An HTB Sherlock investigation of Sandworm Team / APT44 using MITRE ATT&CK to map campaigns, credential access, persistence, destructive malware, SCADA activity, and associated infrastructure.
Operation Dream Job
An HTB Sherlock investigation of the Lazarus Group's Operation Dream Job campaign using MITRE ATT&CK and VirusTotal to map campaign behavior, malware, and supplied indicators of compromise.
Phishing Email
An HTB Sherlock investigation of a suspicious PayPal-themed email using message headers, embedded-link analysis, sender infrastructure, and reputation checks to identify phishing indicators.