RESEARCH 2026
A penetration test of a Linux host running a Laravel-based blog and a Laravel Admin panel. The chain starts with an unauthenticated blind SQL injection in the password reset form, extracts the admin bcrypt hash, cracks it with a common password list, abuses CVE-2023-24249 in laravel-admin to upload a web shell, extracts a Monit credential from a local configuration file to pivot to a second user, and finally abuses a 7z wildcard injection in a root-owned backup script to read the root SSH private key.
RESEARCH 2026
A complete penetration test of a Linux host running Nginx, BIND and Mattermost. The chain starts with a path traversal on a download endpoint, extracts a BIND rndc-key from the filesystem, uses the DNS server's allow-update directive to hijack a mail subdomain, intercepts a Mattermost password reset token via SMTP, harvests SSH credentials through a chat bot, pivots with CVE-2023-23946 to a second user, and finally abuses CVE-2023-20052 in ClamAV to read the root SSH key.
PUBLIC 2026
A self-contained red team lab built on VMware Workstation: three isolated networks, a dedicated router VM running iptables, an Nginx TLS-passthrough redirector, a Sliver C2 server, and a Windows Server target. Includes beacon generation, delivery, execution, and a realistic Windows Defender exclusion scenario.
RESEARCH 2026
A professional assessment of a Linux environment running Gogs, a Flask API, and HashiCorp Vault. The chain starts with credentials buried in Git history, escalates through an eval() injection in the API, pivots across containers with Ligolo-ng, extracts plaintext database credentials, recovers an SSH private key from a private repository, and ends with root access via a Vault root token and the SSH OTP engine.
RESEARCH 2026
A complete penetration test report of a Windows Active Directory environment: anonymous FTP exposing a KeePass database, password policy inference, MSSQL RID brute-force, Helpdesk abuse, SYSVOL policy enumeration, and constrained delegation with protocol transition. From unauthenticated network position to Domain Admin in a single chain.
RESEARCH 2026
A complete penetration test report of a Windows Active Directory environment: anonymous SMB access, Ansible Vault credential extraction, PWM configuration abuse, LDAP pass-back, and ADCS ESC1 exploitation. From unauthenticated network position to Domain Admin in a single chain.
PUBLIC 2026
A post-exploitation enumeration tool that lists installed Debian packages, cross-references them against OSV, and enriches the results with EPSS, CISA KEV, Debian Security Tracker urgency, and public PoC detection. Prioritizes manually installed packages — the ones that actually matter during a pentest.
RESEARCH 2026
A complete penetration test report of a Windows Active Directory environment: WriteSPN for Kerberoasting, gMSA password extraction, WriteOwner abuse, ADCS ESC15 exploitation, and tombstone restoration to recover a deleted certificate admin account. From assumed-breach user to Domain Admin in a single chain.
RESEARCH 2026
A complete penetration test report of a Windows Active Directory environment: NFS unauthenticated export, plaintext credentials, Kerberos password spraying, PetitPotam coercion, NTLM relay to AD CS web enrollment, and DCSync. Four chained vulnerabilities leading to domain admin in under two hours.
RESEARCH 2026
A complete staged payload pipeline: Sliver mTLS beacon, XOR-obfuscated URL in a custom C stager, PEB process path spoofing, Startup-folder persistence, and delivery wrapped inside a fake Chrome installer with a spoofed Authenticode signature.
PUBLIC 2026
A .bat script that weaponizes an unlocked workstation and a USB port — disables Defender, dumps browser credentials with SharpChromium, restores Defender, gone in under a minute. A study of what physical access actually buys an attacker.
