A student who breaks things
for a grade.
Offensive security student at Hogeschool Utrecht. 24 years old. Most at home inside an Active Directory that wishes I wasn't.
My primary playground is HackTheBox — 50+ machines across Easy → Insane. I write everything up after the box retires, because the lesson lives in the explanation, not the root flag.
On the Windows side: Kerberos abuse — AS-REP, Kerberoast, delegation chains — BloodHound path-finding, NTLM relay, and certificate services abuse. I run a Server 2022 DC and two workstations at home, so nothing I do on HTB feels unfamiliar when I sit down at it.
On Linux: privesc through weak services, SUID chains, misconfigured cron. On the web: SQLi, SSRF, auth bypass, chained logic bugs. Burp as a scalpel — not a shotgun.
I glue my recon together with Python: nmap, ffuf, gobuster piped into a single report template. Currently grinding CCNA because the best attackers actually understand the network they're living in. Next on the cert list: CJCA and CPTS.