Security isn't one skill. I break systems to learn how they fail, watch them to catch it happening, and write up what I find so it gets fixed. Each step feeds the next.
Break it.
I test lab networks and web apps the way an attacker would: map what's exposed, find the weak point and see how far it goes. Every step is logged so it can be reproduced.
$ recon → foothold → privesc → report
- Recon and service enumeration
- Web app testing against the OWASP Top 10
- Linux and Windows privilege escalation
- Active Directory enumeration and credential attacks
NmapBurp SuiteffufMetasploitNetExec
Output Findings with proof of impact
Defend it.
I watch the logs for what an attacker leaves behind and separate real incidents from noise. Then I scan for weaknesses and rank them by risk, so the worst get fixed first.
$ tail -f alerts | triage --tp-fp
- SIEM monitoring and alert triage
- Log analysis and event correlation
- True / false positive classification
- Vulnerability scanning with CVSS 3.1 scoring
ELK / KibanaSplunkNessusOpenVASWireshark
Output Triaged alerts and a prioritised fix list
Write it up.
When something happens, I work out what, when and how from the evidence: disk and USB images, logs and malware behaviour. Then I turn it into a report people can act on.
$ sha256sum disk.img && timeline
- Disk and USB forensics with chain of custody
- Timeline reconstruction
- Dynamic malware analysis and IOC extraction
- Mapping activity to MITRE ATT&CK
ProcmonWiresharkMITRE ATT&CKNIST SP 800-86
Output A clear report with a remediation roadmap