Portfolio

Overhaul

Mon, 01 Jan 0001 00:00:00 +0000

I came back to my lab after months, found a mess, and rebuilt it from scratch: a VPS tunnel, four DMZs, an inline IDS and a SOC that only accepts logs.

Detection Lab

Mon, 01 Jan 0001 00:00:00 +0000

Decrypting inbound HTTPS and inspecting it with an inline Suricata IPS before it reaches a DMZ web server.

Mon, 01 Jan 0001 00:00:00 +0000

HTB Expressway writeup

TLDR

IKE (IPsec) Aggressive mode leaked enough information to capture an authentication secret allowing SSH access as a local user. An outdated sudo then allowed privilege escalation to root with CVE-2025-32463.

Recon

Initial Nmap scan reveals nothing useful on TCP except SSH and basic information, but on UDP we see ISAKMP.

Nmap scan report for 10.10.11.87
Host is up (0.025s latency).
Not shown: 65534 closed tcp ports (conn-refused)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 10.0p2 Debian 8 (protocol 2.0)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Source code

Mon, 01 Jan 0001 00:00:00 +0000

Source code for tooling I’ve designed and built.

Access is by pre-shared credentials only. If you don’t have them, this page isn’t for you.

Enter