Algernon (OffSec PG) — Walkthrough: SmarterMail Build 6985 RCE to Instant Admin
OffSec Proving Grounds Algernon walkthrough — exploiting SmarterMail Build 6985 .NET deserialization RCE (CVE-2019-7214) on a Windows host for an i...
// offensive security · research · writeups
I break things, document how, and help you learn.
Offensive Security Consultant — penetration testing, red teaming, and adversary simulation, with a SOC and threat-detection background.
latest posts
all posts →Hub (OffSec PG) — Walkthrough: FuguHub 8.1 RCE to Instant Root
OffSec Proving Grounds Hub walkthrough — retargeting the FuguHub 8.1 RCE exploit (EDB 51550) from its default HTTPS/443 config to port 8082, landin...
Bratarina (OffSec PG) — Walkthrough: OpenSMTPD CVE-2020-7247 MAIL FROM RCE
OffSec Proving Grounds Bratarina walkthrough — unauthenticated RCE through OpenSMTPD CVE-2020-7247 MAIL FROM command injection, landing instant roo...
ShadowGate — Active Directory Walkthrough: Null Session to AS-REP Roast to AD CS
Active Directory walkthrough of ShadowGate (Windows Server 2022) — anonymous SMB user enumeration, AS-REP roasting a pre-auth-disabled account, and...
ShareThePain — Active Directory Walkthrough: Writable Share to Forced Auth to ACL Abuse
Active Directory walkthrough of ShareThePain (Windows Server 2022) — coercing DC authentication from a writable SMB share, cracking the hash, abusi...
BuildingMagic — Active Directory Walkthrough: Web Leak to Domain Admin
Full Active Directory walkthrough of BuildingMagic (Windows Server 2022) — chaining a web DB leak, Kerberoasting, ACL abuse, share poisoning, and P...
topics
Web App Pentesting
Attacking OWASP Top 10, auth flaws, and real-world web bugs.
Active Directory
Kerberos abuse, lateral movement, and domain dominance.
Red Teaming
Adversary emulation, C2, and evasion tradecraft.
Bug Bounty
Recon workflows and high-impact vulnerability hunting.
Malware Analysis
Static & dynamic triage, unpacking, and IOCs.
OSINT & Threat Intel
Recon, attribution, and intelligence tradecraft.