ENGINES ON

darkhex.dev00%

security analyst · jr. penetration tester

RORO

Break it. Defend it. Write it up.

open to work · SOC, Jr. Pentest & InfoSec roles

how I work

Three modes. One loop.

Security isn't one skill. I break systems to learn how they fail, watch them to catch it happening, and write up what I find so it gets fixed. Each step feeds the next.

01offence

Break it.

I test lab networks and web apps the way an attacker would: map what's exposed, find the weak point and see how far it goes. Every step is logged so it can be reproduced.

$ recon → foothold → privesc → report
  • Recon and service enumeration
  • Web app testing against the OWASP Top 10
  • Linux and Windows privilege escalation
  • Active Directory enumeration and credential attacks
NmapBurp SuiteffufMetasploitNetExec

Output Findings with proof of impact

02defence

Defend it.

I watch the logs for what an attacker leaves behind and separate real incidents from noise. Then I scan for weaknesses and rank them by risk, so the worst get fixed first.

$ tail -f alerts | triage --tp-fp
  • SIEM monitoring and alert triage
  • Log analysis and event correlation
  • True / false positive classification
  • Vulnerability scanning with CVSS 3.1 scoring
ELK / KibanaSplunkNessusOpenVASWireshark

Output Triaged alerts and a prioritised fix list

03investigation

Write it up.

When something happens, I work out what, when and how from the evidence: disk and USB images, logs and malware behaviour. Then I turn it into a report people can act on.

$ sha256sum disk.img && timeline
  • Disk and USB forensics with chain of custody
  • Timeline reconstruction
  • Dynamic malware analysis and IOC extraction
  • Mapping activity to MITRE ATT&CK
ProcmonWiresharkMITRE ATT&CKNIST SP 800-86

Output A clear report with a remediation roadmap

↺ What I learn writing it up goes straight back into how I break and defend the next system.

Interactive

Prefer a terminal?

Type help. Tab completes, arrow keys recall history.

darkhex@ro — bash

highlights

By the numbers.

TryHackMe

Ranked globally across web, network and system rooms.

Top 16%of users worldwide
Zerodays 2026 CTF

Overall finish, and 23rd in the college category.

#54overall
TCS HackQuest

Season 8 finish.

Top 50Season 8
Certified

CompTIA Security+ and HTB CJCA.

2certifications
In progress

Working through the HTB penetration tester path, then OSCP.

CPTSthen OSCP

Work

Labs & Reports

M.Sc. thesis

Machine-learning DDoS detection

~850k network flows, balanced with SMOTE and tested with 5-fold cross-validation, then deployed in a Django web app.

0.99cross-validated F1
⌕Digital forensics

Insider data theft case

Rebuilt the timeline from disk and USB images and preserved evidence integrity.

◉Malware analysis

Dynamic behaviour

Ran a sample in an isolated lab, mapped behaviour to ATT&CK and extracted IOCs.

@OSINT · passive

Attack-surface review

Mapped a public footprint from open sources only, with remediation advice.

#Active Directory

Credential security labs

Enumeration and privilege escalation practice in a home lab domain.

Explore all work

Contact

Let's talk security.

Hiring for a SOC, penetration testing or information security role in Ireland or across the EU? Connect with me on LinkedIn.