⟩ Offensive Security
INTERNAL / EXTERNAL
Network Pentesting
Internal/external network exploitation with stealthy pivoting.
What I deliver
- Recon, enumeration & exploitation
- Pivoting through compromised hosts
- Privilege escalation chains
⟩ real-world projects
Selected engagements
Sanitized highlights from real client work — approach, the bug we found, and the fix shipped. Names redacted under NDA.
01
Internal network pentest pivoted through 4 segmented VLANs to OT network — air-gap myth busted
02
External engagement — exposed Jenkins + GitLab runners, full source-code exfil simulation
⟩ common vulnerabilities & how I find them
Top bugs I hunt — and the steps
The recurring weaknesses I see in this domain, with the repeatable workflow I run from discovery to fix.
01
HighDefault / Weak Credentials
- STEP 1Banner-grab with nmap + identify mgmt interfaces (iDRAC, iLO, Jenkins, Tomcat)
- STEP 2Spray default creds via Hydra / CME
- STEP 3Pivot from web admin to OS command exec
- STEP 4Fix: mandatory password rotation, MFA on admin panels, network segmentation
02
CriticalSMB / EternalBlue Class Exposure
- STEP 1Scan with nmap NSE smb-vuln-* scripts
- STEP 2Confirm exploitable with Metasploit module in lab-mirror
- STEP 3Demonstrate RCE on test host with safe payload
- STEP 4Fix: patch MS17-010 family, disable SMBv1, segment legacy hosts
03
CriticalIPv6 mitm6 + NTLM Relay to ADCS
- STEP 1Run mitm6 to become the default IPv6 DNS server via rogue RA/DHCPv6
- STEP 2Coerce authentication from a target host (PetitPotam / PrinterBug)
- STEP 3Relay captured NTLM to the ADCS web enrollment endpoint via ntlmrelayx
- STEP 4Fix: disable IPv6 if unused or deploy DHCPv6 guard, disable NTLM on ADCS, require EPA + HTTPS
⟩ arsenal
Tools & frameworks
Nmap
Network Scanning
Responder
LLMNR/NBT-NS
CrackMapExec
Post-Exploitation
Chisel
TCP Tunneling
Wireshark
Packet Analysis
Hydra
Password Brute
John the Ripper
Password Cracking
Hashcat
GPU Cracking
Aircrack-ng
WiFi Attacks
Impacket
Network Protocols
Nessus
Vulnerability Scanner
NetExec
Security Tool
⟩ engage
Need network pentesting expertise?
⟩ related