Full Archive of 12 Offensive Audits & Threat Intelligence Research
Web Pentest / VAPTCONFIDENTIAL CLIENT WORK
Private Organization Security Assessments
Performed authorized penetration testing and vulnerability assessments for multiple private organizations. Discovered and validated several critical-severity vulnerabilities, including Remote Code Execution (RCE), alongside authentication, authorization, input validation, and business logic weaknesses. Produced professional VAPT reports documenting exploitation evidence, business impact, severity, and practical remediation guidance.
APPARATUS STACK USED
Burp Suite ProOWASP Top 10RCE ValidationVAPT ReportingCVSS v3.1
Protected Under NDA · Findings Redacted
AI / LLM SecurityACTIVE RESEARCH
Adversarial LLM Security Assessment
Built and pentested a local multi-model AI environment using Ollama, evaluating Mistral, Qwen, Gemma, Granite, and LLaMA against real-world adversarial techniques. Conducted automated prompt injection testing using Garak v0.14 across 768 attack attempts. Mistral:7b rated DC-2 (Very High Risk). Fingerprinted a live RAG-powered chatbot backend using LLMap. Built and open-sourced garak-report-to-excel for structured vulnerability reporting.
A Python utility that parses raw Garak LLM vulnerability scanner .jsonl report files into structured Excel spreadsheets. Built to solve the problem of unreadable Garak output during adversarial LLM security research.
An open-source asynchronous subdomain enumeration and alive-checking tool for security assessments, bug bounty hunting, and VDP reconnaissance. Integrates multiple passive intelligence sources including crt.sh, AlienVault OTX, RapidDNS, HackerTarget, urlscan.io, ThreatCrowd, and SecurityTrails. Features concurrent alive-host validation using AsyncIO and AIOHTTP, optional subfinder integration, JSON/CSV export, and a Rich-powered terminal interface.
Built a fully isolated enterprise-grade AD environment across four network segments — enterprise.dc (Primary Forest), corp.enterprise.dc (Child Domain), and manufacturing.local (Secondary Forest). Simulates real-world attack paths including network pivoting, trust relationship attacks, privilege escalation across domain boundaries, and cross-forest compromise via bidirectional forest trust.
APPARATUS STACK USED
Active DirectoryDomain TrustsDouble PivotsKerberosBloodHound
Conducted a Grey Box penetration test on a self-hosted web application. Identified critical vulnerabilities including weak JWT implementation leading to account takeover, XSS enabling session hijacking, authentication flaws, and insecure transport mechanisms. Findings manually validated with actionable remediation aligned to OWASP and PTES.
APPARATUS STACK USED
Burp Suite ProOWASP Top 10JWT AuditsXSS InjectionPTES
Conducted structured forensic analysis of a phishing email impersonating a major brand. Performed full email header inspection, sender infrastructure tracing, and SPF/DKIM/DMARC verification. Analyzed embedded URL using VirusTotal, URLVoid, and PhishTool, confirming an active credential harvesting portal. Documented findings in a structured SOC report with IOC summary and containment recommendations.
Simulated a full compromise-and-detection scenario on a Windows endpoint using Metasploit. Established a Meterpreter reverse TCP session, deployed malicious.exe as an auto-start Windows service (BackupService), and added a registry run key for logon persistence. Detection phase included process tracing via WMIC, service analysis with Get-CimInstance, network analysis confirming the Meterpreter session on port 5555, registry forensics via PowerShell, and autorun baselining with PSAutoRun to diff pre/post-compromise snapshots. VirusTotal flagged the hash 58/71 as trojan.metasploit/rozena.
SIEM Deployment & Blue Team Detection — Splunk Enterprise
Deployed and configured Splunk Enterprise on Ubuntu to understand how defenders detect offensive techniques at the log level. Ingested real HTTP web server logs and used SPL to investigate traffic patterns — identifying a single IP generating 2,920 out of 3,086 total requests. Surfaced a Hydra brute-force tool signature making POST requests to /login.php. Built a multi-panel security dashboard covering top user agents, URI path frequency, geographic IP distribution, and HTTP volume over time. Configured a real-time alert for Local File Inclusion (LFI) detection.
Demonstrated credential harvesting in Active Directory using Mimikatz, SAM dumps, LSASS extraction, DCSync attacks, and Overpass-the-Hash / Pass-the-Ticket techniques. Highlights precise execution to avoid triggering service loops, with lateral movement simulation across AD environments.
