Web penetration tester and security researcher. I document exploits, write-ups, and hard-won lessons from CTFs, labs, and real assessments.
I'm a university student focused on building a career in offensive security and penetration testing.
I'm currently in an intensive learning phase, working toward the Burp Suite Certified Practitioner (BSCP) while developing the practical skills required for OSCP-level work.
This blog serves as a record of that journey - documenting CTF write-ups, lab walkthroughs, and technical breakdowns of real-world attack techniques and tools.
Outside of that, I spend most of my time writing Python for automation, working through TryHackMe labs, and solving challenges on Hack The Box to strengthen my hands-on capabilities.
A ready-to-fill walkthrough shell for Devhub from Season 11: Season of the Punk.
open draft shellA growing machine index for HackTheBox write-ups, starting with Devhub from Season 11.
open hubThe full attack path from Nmap and web leaks to PCAP credentials, binary reversing, and a root cron-job module hijack.
read walkthroughA growing screenshot-led walkthrough covering username enumeration and a simple 2FA bypass.
read postA growing room index for recon-to-root write-ups, beginning with the completed Valley challenge.
open hubA screenshot-driven walkthrough of PortSwigger's SSTI labs, covering engine fingerprinting, sandbox disclosures, object abuse, and custom exploit building.
read postA Burp-first walkthrough of PortSwigger's JWT labs, covering none-alg abuse, weak secrets, header injection, and algorithm confusion without Python automation.
read postA zero-cost home NAS built from an old router and a powered 1TB drive, including Windows 11 SMB fixes, mobile access, and the limits of a LAN-only setup.
read post