I break into infrastructure (ethically) and audit it, bringing an offensive mindset to every system I touch. Security isn't a checkbox for me, it's how I think.
Web app pentesting is my bread and butter, run against the OWASP Top 10 and mapped through MITRE ATT&CK. Every target gets a full vulnerability assessment before anything gets touched — scope first, always.
nmap with NSE scripting is my first stop, backed up by Amass, Nikto, and DNSenum for full surface mapping. Once the attack surface is known, ffuf and gobuster do the heavy lifting on directory and vhost enumeration.
BurpSuite is in my hands for Proxy, Repeater, and Intruder work, with OWASP ZAP as a second set of eyes. SQLMap automates the injection side so I can focus on the logic flaws that scanners miss.
Log analysis, Linux hardening, and security configuration review turn findings into fixes. I close what I opened, so every engagement leaves the target stronger than I found it.
Before this — started coding with Java (CRUD apps, JWT auth, WEB clones) at Odysseus64, then moved into pentesting.
Hands-on experience
Currently growing