Penetration Testing &
Red Team Operations

• BloodHound triage beyond shortest-path: derivative local admin chains and edges the default queries miss
• Targeted Kerberoasting: SPN hunting, then offline cracking tuned to the password policy
• AS-REP Roasting: preauth-disabled accounts, cracked offline
• RBCU abuse: read access to one object is often enough to take it over
• DCSync or forgery: picking the quieter path based on the noise the client will tolerate
• Token impersonation: the last hop to domain admin

beacon> logonpasswords

• IDOR by object ID pattern: sequential IDs, UUID leaks in responses, role flips
• Business logic races: coupon stacking, redemption races, step skipping
• Auth architecture flaws: JWT confusion, session fixation, OAuth misflows
• Blind SQLi: time-based and out-of-band channels where errors are suppressed
• Chain building: low findings combined into full account takeover
• Retest discipline: every fix is verified before a finding is closed

• APK decompilation: exported components, backup and debuggable flags
• Storage forensics: SharedPreferences tokens, unencrypted SQLite, logs
• Weak cryptography: hardcoded keys, static IVs, and ECB mode where it should never appear
• Deep link abuse: exported intents hijacked live on device
• Pinning bypass: traffic inspection when the app fights back

• External truth sweep: what answers on the wire vs what the asset list claims
• Foothold expansion: one credential to the whole flat network
• Manual service exploitation: scanner verdicts verified by hand
• Segmentation validation: proving the guest VLAN can reach tier-0

• Fileless pipeline: fetch, decode, RW to RX, execute, zero disk writes
• C2 discipline: register, poll, rekey every session
• Sandbox patience: randomized sleeps outlast detonation windows
• Isolated verdicts: Defender, Bitdefender and Sophos tested one change at a time

beacon> blockdlls start

Full methodology in build log 01, build log 02 and build log 04, PoC evidence included.

• PE anatomy: DOS header to section table, mapped by hand
• Base relocations: the delta applied to every absolute address
• IAT resolution: imports wired without the loader's help
• Alert intuition: why hollowing detections fire, from the inside

beacon> execute-assembly Seatbelt.exe -group=system

The whole ritual is written up in build log 03, PoC video included.

• Dual telemetry: Bitdefender GravityZone and Sophos MDR review
• Phishing forensics: header and attachment analysis with a clear verdict on every mail
• IR drills: host isolation under pressure
• Feedback loop: alert reading that sharpened the offense

• CVSS v3.1: scored against the client's environment, not defaults
• Executive summaries: written for the CTO, not the scanner
• Implementable fixes: remediation a developer can act on
• Verification retests: prove the patch, close the case

beacon> download Report.pdf

• Engagement ownership: I run each engagement end to end, from scoping with the client through exploitation, reporting, and the remediation retest.
• Coverage: web applications, Android apps (MASVS), internal and external networks, and Active Directory environments.
• Malware triage: reverse engineering samples that surface in client cases and feeding indicators back to the client's defenses.
• Reporting: CVSS v3.1 scoring, executive summaries, and a retest of every fix before the engagement closes.

• Web pentesting: tested applications in Burp Suite Pro against the OWASP Top 10, reporting IDOR, SQL injection, XSS, and broken access control.
• Endpoint telemetry: worked Bitdefender GravityZone and Sophos MDR queues during incident response drills and helped isolate compromised hosts.
• Phishing analysis: inspected headers and attachments to confirm spoofed senders and malicious payloads.