I break into Active Directory environments, build the labs I break into, and write up what happened.

Most of it is self-directed. I work Hack The Box machines while they’re still active, when there are no public writeups to lean on, and publish mine only once the box has retired. I’ve also finished the Dante and P.O.O. Pro Labs, which are whole networks rather than single targets: pivoting between hosts, moving laterally, and chaining a domain instead of popping one box.

I build the things I attack, too. A Game of Active Directory deployment I stood up and troubleshot end to end, and a Splunk install I pointed at my own domain to see which of my attacks actually generated an alert. The writeups aim to be followable rather than impressive. If you can’t reproduce it from what I wrote, I haven’t finished writing it.

Getting here

I came to security sideways. I hold a Bachelor of Music and a Masters of Music Therapy, and I currently work in customer support for a financial services company. Neither is a security job, and I’m not going to pretend otherwise.

What they did give me is the half of consultancy work that isn’t technical. Music therapy is clinical listening and careful documentation with people who are having a difficult time. Support work is explaining a problem to someone who didn’t ask for it and doesn’t share your vocabulary. Penetration testing is substantially report writing and client debriefs, and I’d rather arrive already good at that part.

What I’m looking for

A first role in penetration testing, based in Sydney. I’m most interested in Active Directory and Windows internals, and I’m equally happy on work that sits closer to detection.

What I work with

Active Directory and Windows: Kerberos abuse, ACL and delegation chains, AD CS misconfiguration, credential extraction and reuse.

Tooling: BloodHound, Impacket, netexec, Evil-WinRM, hashcat, Metasploit, nmap, Responder.

Detection: Splunk Enterprise, Universal Forwarders, Windows event log analysis, writing searches against attacks I’d just run.

Lab infrastructure: VMware Workstation, Vagrant, GOAD, Windows Server and domain builds, network segmentation.

Certifications

  • eJPT — eLearnSecurity Junior Penetration Tester
  • Google Cybersecurity Certificate — Coursera specialisation
  • CPTS — HTB Certified Penetration Testing Specialist, in progress
  • OSCP — next after CPTS

Hack The Box

My profile covers the Dante and P.O.O. Pro Labs, plus machines worked while active and written up after they retired.

Get in touch

The best way to reach me is LinkedIn.