Hands-on networking and security lab documentation showcasing practical skills in network administration, security hardening, and penetration testing.
- Exploited SSRF vulnerability to abuse AWS IMDSv1 and exfiltrate IAM credentials from EC2 metadata service
- Performed multi-hop SSH pivoting across segmented VPC subnets (public → private → restricted) to compromise isolated instances
- Leveraged overprivileged IAM roles and security group misconfigurations to enumerate EC2 infrastructure and exfiltrate sensitive data from S3
- Captured 3 flags demonstrating full attack chain: initial access, lateral movement, and crown jewels exfiltration
Coming soon - AWS security hardening and defensive configurations
- Developed automated port scanning utilities in Bash using Netcat for TCP enumeration and attack surface discovery
- Built multi-port scanner with external configuration, result logging, and filtering capabilities for scalable network reconnaissance
- Identified open SSH, HTTP, and HTTPS services on target systems with automated grep filtering and persistent result storage
- Demonstrated practical scripting for security assessments with file I/O redirection and dynamic user input handling
Coming soon
- Exploited file upload vulnerability in Zerion Mini Shell to achieve remote code execution and establish reverse shell as www-data
- Discovered exposed password hash in
/etc/passwd, cracked with John the Ripper, and performed lateral movement through multiple user accounts - Enumerated PHPMyAdmin config files to extract reused database credentials, escalating from oracle → karla → root via sudo permissions
- Completed box in ~2 hours with full root access, demonstrating enumeration, lateral movement, and privilege escalation techniques