Senior offensive security specialist — breaking web apps, APIs, and authentication flows before someone with worse intentions does. 7+ years turning assumptions into proof.
Full-scope assessments — injection, access control, business-logic abuse, and the things scanners never find.
REST & GraphQL testing, authorization boundary mapping, and broken-object-level access at scale.
OAuth 2.0, PKCE, OIDC and session management — where the deepest, quietest bugs tend to live.
Authorized phishing and social-engineering ops — pretext design, delivery, and measuring how people and controls actually respond.
Post-foothold internal testing — lateral movement, privilege escalation, Active Directory weaknesses, and segmentation gaps.
Internet-facing exposure — misconfigurations, exposed services, and the soft spots an outside attacker reaches first.
Offensive Security Certified Professional — hands-on exploitation under exam conditions.
VERIFY ↗Offensive Security Web Assessor — modern web application attack techniques.
VERIFY ↗Active security clearance — cleared for sensitive engagement work.
Advanced web exploitation & white-box source-code review. Currently in pursuit.
A gzip-compressed POST body hides the object-reference parameter that proves BOLA — Burp renders it as binary noise, one decompression step turns "untestable" into confirmed API1:2023.
↗The password reset flow forgot to ask for the second factor — one reset link and a 2FA-protected admin account is fully compromised.
↗Sessions rotated on login but not bound to an identity — switching roles in the same browser bleeds admin context through without stealing a single token.
↗Admin panel input stored verbatim and rendered on the public storefront — and HttpOnly on the session cookie did not stop the exploitation chain.
↗A signed JWT delivered as a GET query parameter after SSO login — no session binding, no single-use enforcement, and a static jti. Full admin account takeover confirmed by pasting the URL into a clean browser.
↗A workflow platform that accepts any file type and deploys it immediately on upload — no content validation, no antivirus scanning, no manual approval step. EICAR test file uploaded and confirmed deployed in a single authenticated POST.
↗Five API endpoints on a retail e-commerce platform returning customer profile data, order documents, and benefit records — none with a session ownership check. One valid account was enough to enumerate every other customer in the system.
↗A CMS content API with GraphQL introspection enabled and no authentication — full schema enumeration in one unauthenticated POST. Two separate subdomain instances, both open.
↗A server that echoes your Origin header back in Access-Control-Allow-Origin — with credentials enabled — means any site on the internet can read authenticated API responses on behalf of any visiting user. One Burp header, one check, complete same-origin policy bypass.
↗A cart quantity of 114 items produces a basket total of €1,057 against line items worth €38,000+. Plus an OTP endpoint that accepts brute-force attempts because the frontend CAPTCHA was never validated server-side. Findings no scanner will ever report.
↗Error-based SQLi in a .NET card payments application's login form, plus a database password sitting in plaintext in an SMB-accessible config file. How to intercept thick client traffic and why these applications rarely get tested.
↗A critical race condition in OpenSSH's SIGALRM handler — reintroduced in 2020, discovered in 2024 — found on a production internal server alongside BlueKeep. Why the "6–8 hour exploitation window" argument misses the point in an internal network context.
↗Three session management failures that chain into full account takeover: logout doesn't revoke the token, password change doesn't invalidate other sessions, and old password isn't verified — so a stolen session survives every recovery action a user can take.
↗An internal scan discovers MongoDB on port 27017 with authentication disabled — full read/write to every database, no password. On the same network: a Samba server vulnerable to Badlock, exploitable via the LLMNR relay capability already in hand.
↗CL.TE desync between a reverse proxy and an Apache PHP backend — confirmed on a payment task queue endpoint. How the framing ambiguity works, why payment platforms are higher-stakes targets, and what the front-end normalization fix actually requires.
↗An energy operator's SCADA server — Siemens TeleControl Basic, unauthenticated SQL injection — sitting on a flat corporate LAN reachable from any domain workstation, alongside NTLM relay, cleartext SMB credentials, and shared domain passwords.
↗A Windows executable uploaded in place of an identity document on a public unauthenticated registration portal — one Burp intercept, zero server-side validation, files served from web root.
↗BlueKeep, EternalBlue, Schannel RCE, FlexNet RCE, two EOL databases — and a backup service account in Domain Admins with a reused local password that cracked in two minutes.
↗Sequential transaction IDs with no tenant ownership check — one valid token, any tenant's data. Cross-tenant exposure covering every organisation on the platform, globally.
↗A single unauthenticated GET request returned 412 user records with password hashes, salts, roles, and timestamps — no credentials, no session, thirty seconds from first packet.
↗3DS explicitly off in the SDK config, CVV not validated, withdrawals with no re-auth, and a risk engine that detects fraud then approves it in two seconds.
↗One unpatched SMBv1 host, a shared local admin password, and a service account in Domain Admins — full AD compromise in under thirty minutes.
↗A file that is both a valid PDF and valid HTML walks past upload checks and turns a document form into stored XSS.
↗An offensive look at how a credible, authorized phishing op is built, launched, and measured.
↗Walking through the implementation gaps that quietly defeat PKCE protection in real OAuth deployments.
↗How an "image" upload becomes a credential-stealing surface — and why your CSP probably is not catching it.
↗