Penetration Testing &
Red Team Operations

• BloodHound triage beyond shortest-path: derivative local admin chains and edges the default queries miss
• Targeted Kerberoasting: SPN hunting, then offline cracking tuned to the password policy
• AS-REP Roasting: preauth-disabled accounts, cracked offline
• RBCU abuse: one object read to configure, one hop to own
• DCSync judgment: noise budget vs quieter ticket forgery
• Token impersonation: the last hop to domain admin

beacon> logonpasswords

• IDOR by object ID pattern: sequential IDs, UUID leaks in responses, role flips
• Business logic races: coupon stacking, redemption races, step skipping
• Auth architecture flaws: JWT confusion, session fixation, OAuth misflows
• Blind SQLi: time-based and out-of-band channels where errors are suppressed
• Chain building: low findings combined into full account takeover
• Retest discipline: guilty until proven patched

• APK decompilation: exported components, backup and debuggable flags
• Storage forensics: SharedPreferences tokens, unencrypted SQLite, logs
• Crypto smells: hardcoded keys, static IVs, ECB habits
• Deep link abuse: exported intents hijacked live on device
• Pinning bypass: traffic inspection when the app fights back

• External truth sweep: what answers on the wire vs what the asset list claims
• Foothold expansion: one credential to the whole flat network
• Manual service exploitation: scanner verdicts verified by hand
• Segmentation validation: proving the guest VLAN can reach tier-0

• Fileless pipeline: fetch, decode, RW to RX, execute, zero disk writes
• C2 discipline: register, poll, rekey every session
• Sandbox patience: randomized sleeps outlast detonation windows
• Isolated verdicts: Defender and Kaspersky Next EDR tested one change at a time

beacon> blockdlls start

Full methodology in build log 01 and build log 02, PoC videos included.

• PE anatomy: DOS header to section table, mapped by hand
• Base relocations: the delta applied to every absolute address
• IAT resolution: imports wired without the loader's help
• Alert intuition: why hollowing detections fire, from the inside

beacon> execute-assembly Seatbelt.exe -group=system

The whole ritual is written up in build log 03, PoC video included.

• Dual telemetry: Bitdefender GravityZone and Sophos MDR review
• Phishing forensics: headers, attachments, verdict by verdict
• IR drills: host isolation under pressure
• Feedback loop: alert reading that sharpened the offense

• CVSS v3.1: scored against the client's environment, not defaults
• Executive summaries: written for the CTO, not the scanner
• Implementable fixes: remediation a developer can act on
• Verification retests: prove the patch, close the case

beacon> download Report.pdf

• Engagement ownership: scoping, exploitation, reporting and retest, all on my desk
• Domain coverage: web, Android (MASVS), internal and external network, Active Directory
• Malware reverse engineering: supporting client cases at the triage level
• Reporting standard: CVSS v3.1, executive summaries, remediation retests

• Web application pentesting: OWASP Top 10 work in Burp Suite Pro
• Endpoint telemetry: Bitdefender GravityZone and Sophos MDR monitoring
• Phishing analysis: headers and attachments, verdict by verdict
• Incident response drills: compromised host isolation, hands on keyboard