ABOUT / dful

My background is in systems and infrastructure. In web and API assessments, I review requests and application behavior, using Burp Suite and OWASP guidance.

An assessment does not end when I find a problem. Writing technical and executive reports and presenting the results to the teams who need to act on them are just as important, if not more.

PTES and PCI DSS have both featured in my work. I use MITRE ATT&CK and other common frameworks when they help relate techniques within an attack chain, and I adapt to the framework a job calls for.

I've reviewed code in Java, Python, and JavaScript, including applications built with Spring, Django, and Angular. I've also built internal tools in Python and React for vulnerability management, documentation, and early warning using CPE and CVE data. I've managed cloud hacking labs and platforms with VMs, EC2, security groups, and isolated AWS environments.

I've taken part in OSINT and incident response investigations involving infrastructure tracing, Cloudflare, and malware. I'm also studying how models are used in pentesting and the risks that arise when an agent uses tools, accesses data, or acts with a user's permissions.

Here I keep material I want to return to or use as a reference: practical notes for day-to-day work and longer technical writing when a subject needs more room or I simply feel like writing.