Penetration Testing

A growing archive of my work in penetration testing — from lab environments to structured methodologies.
This is where I sharpen offensive skills to better understand real-world attack surfaces, privilege escalation, and exploitation logic.

Securing Silver: My 2nd Place Win at CYBERSECURITY CONFERENCE 2025 CTF in Mannheim

Posted on Oct 23, 2025 6 mins

My first comprehensive CTF experience at the CYBERSECURITY CONFERENCE 2025 in Mannheim, where my colleague and I secured 2nd place! We dive into the learning, the race, and essential tips on how to truly prepare (and thrive) in a 24-hour CTF challenge.
Breaking in before the VPN broke down - A Journey through Precious (HTB Writeup)

Posted on Aug 6, 2025 9 mins

A full walkthrough of the Hack The Box machine “Precious” — from enumeration to exploitation, including a clever pdfkit command injection and Ruby YAML deserialization for root. With shell stabilisation and some VPN drama on the side.
HTB Reset: From Log Poisoning to Root. Exploiting Tmux, Rexec and Misconfigured Sudo

Posted on Aug 4, 2025 9 mins

A deep-dive into escalating from LFI to full root via log poisoning, named pipe reverse shell, misconfigured sudo permissions, and forgotten tmux sessions. Includes analysis of R-services (rexec, rlogin, rsh) and real-world command chaining.
A Small Prep Session: PortSwigger Beginner Labs

Posted on Jul 17, 2025 3 mins

A short and focused session working through some beginner-level labs from PortSwigger, revisiting the fundamentals of web vulnerabilities like XSS, SQLi, and authentication bypasses.
Uni Exam Practice VM practice: more of LFI2RCE

Posted on Jul 15, 2025 6 mins

In this university exam practice VM, I explored file upload handling, discovered a separate file inclusion point, and chained it with an uploaded webshell to gain remote command execution.
Test Exam: Penetration Testing Playbook

Posted on Jul 3, 2025 8 mins

My personal playbook for my penetration testing test exam, covering all key steps from access via port forwarding to grabbing ALL 8 flags.
Interview Prep Series: Part Two – Technical Deep Dive & Groundwork

Posted on Jun 30, 2025 20 mins

Digging into technical fundamentals and real interview questions to sharpen my baseline as a pentester. Inspired by Steflan Security’s interview cheat sheet & my 2nd Cirosec Interview
Interview Prep Series: Part One – Core Concepts & Confidence

Posted on Jun 26, 2025 11 mins

Kicking off my interview prep journey with key phases of pentests, handling tricky questions, and building confidence under pressure.
[+] Final Part: Active Directory Journay Day Five: Building, Securing, and Managing a Domain

Posted on Jun 21, 2025 10 mins

Day Five covers key AD admin tasks - user and group creation, GPO management, and domain joins—using PowerShell with a security-focused approach.
Active Directory Journey Day Four: Rights, Privileges, GPOs and a Whole Lot More

Posted on Jun 20, 2025 20 mins

This post digs into Group Policy, Active Directory privileges, and built-in groups. I break down who has silent power, how attackers exploit User Rights, and what defenders can do to lock it down. Expect practical cheatsheets, tools, and battle-tested hardening tips.