Active Directory attack paths, lab building, and detection — working toward a first role in penetration testing.
Mapping how a foothold in a Windows domain becomes full control — across single machines and across multi-host networks in the Dante and P.O.O. Pro Labs.
Standing up the domains, servers, and networks I test against — including the parts that break, and what it took to fix them.
Instrumenting those same labs with centralised logging, then checking whether the attacks I just ran actually show up.
A Linux box where the attack surface is the air between three VLANs. A password leaked over SNMP opens a consultant laptop stocked with Wi-Fi radios, …
A Linux box modelling an industrial plant, where the privilege escalation is not a CVE but the plant’s own safety logic being fed a forged sensor …
A rootkit hides by lying to whoever asks, so asking /proc twice gets you the same lie twice. kdetect asks through channels a rootkit has to subvert …
A Linux box where the attack surface is the air between three VLANs. A password leaked over SNMP opens a consultant laptop stocked with Wi-Fi radios, and the route to root runs through the networks it can hear: crack the tablets’ WPA2-PSK, decrypt the capture to hijack a cookie-trusting router panel, pivot through a .phtml upload, then clone the corporate WPA2-Enterprise AP with its own stolen certificate to crack an EAP identity and reach root.
A Linux box modelling an industrial plant, where the privilege escalation is not a CVE but the plant’s own safety logic being fed a forged sensor reading. Unauthenticated Apache NiFi → operator SSH key in support-bundles → password-cracked PLC manual → anonymous OPC UA writes → CalibrationOffset ramped into the maintenance window → helix-maint-console → root.
A Windows domain box where a chain of small misconfigurations adds up to full control, ending in an Active Directory certificate template flaw. Henry → targeted Kerberoast on Alfred → AddSelf to INFRASTRUCTURE → ReadGMSAPassword on ansible_dev$ → Sam → John → WinRM pivot → reanimate tombstoned cert_admin via John’s GenericAll on OU=ADCS → ESC15 (CVE-2024-49019) on the WebServer template → Administrator.
Mapping an Active Directory domain with BloodHound, then walking the permission chain it exposes from a low-privilege account to domain administrator. Olivia → BloodHound ACL chain (ForceChangePassword) → Benjamin → FTP .psafe3 → hashcat → password spray to Emily → targetedKerberoast on Ethan → DCSync Administrator.
A Windows box that falls to a known file-server vulnerability, then to a kernel-level privilege escalation. Rejetto HFS 2.3 RCE (CVE-2014-6287) for a foothold, then local exploit enumeration to SYSTEM.
A web app that leaks another user’s traffic capture, and a Linux privilege feature left too permissive. IDOR → PCAP recovery of credentials → SSH user shell → Linux file capabilities (getcap) → root via python3.8 capability.
I connected an AI-driven recon tool to a self-hosted LLM running on my own GPU, drove it from a Kali attack VM, and pointed it at a ClassicPress target on a segment I control. Cross-host inference, a VRAM wall, a clean run against the wrong target, and the lesson I keep relearning: a local model is a lead generator, not an oracle.
Setting up Game of Active Directory (GOAD-Light) on Windows 11 with VMware Workstation and Vagrant — and the real story behind it: troubleshooting the VMware utility, the launcher’s provider bug, a missing plugin, host-only networking, and provisioning failures that stood between me and a working AD lab.
Step-by-step lab guide to run a safe phishing simulation using GoPhish and SET (Social-Engineer Toolkit). For isolated lab environments only.
Step-by-step notes from a homelab penetration test: discovery, enumeration, Kerberos user discovery, brute force, and admin shell with Evil-WinRM. Includes commands used and outputs captured during the exercise.
Centralised logging and detection engineering in my Windows homelab using Splunk Enterprise and Universal Forwarders.
Overview of my Active Directory homelab: domain setup, users, security exercises, and next steps for monitoring and detection.
A rootkit hides by lying to whoever asks, so asking /proc twice gets you the same lie twice. kdetect asks through channels a rootkit has to subvert separately and treats their disagreement as the finding. This is how it works, how I validated it against a real rootkit, and the false positives that nearly shipped.
Quick-reference commands for recon, enumeration, exploitation, and post-exploit work on Linux and Windows targets.