I break things I own, on infrastructure I built, and write down exactly how. Web application exploitation, wireless attacks, and the hardware to run them.
I'm a cybersecurity student working through the Certificate IV in Cybersecurity at TAFE SA, with SEC0 and SEC1 lined up next. Most of what I actually know came from building things and then taking them apart.
I run a segmented home lab on a three-node Proxmox cluster, deliberately isolated from everything else on the network. That's where the work happens — web app exploitation chains, wireless attacks, service enumeration, privilege escalation — against targets I own, on infrastructure I built.
I build the hardware too. Raspberry Pi cyberdecks, handheld terminals, ESP32 RF tools, a NetHunter phone. If a tool didn't exist the way I wanted it, I made one.
Every project here is documented: what I tried, what worked, what didn't. Findings are only useful if someone else can follow them.
SQL injection through to shell — union-based extraction, hash cracking, file upload abuse, post-exploitation enumeration. Full chains, start to finish.
WPA2 handshake capture and cracking, evil twin and captive portal setups, monitor mode and packet injection on supported adapters.
Software-defined radio, sub-GHz and NFC tooling, custom builds on ESP32 and Raspberry Pi — including portable platforms I designed and assembled.
A three-node Proxmox cluster on an isolated lab network. VM and container management, segmentation, self-hosted services.
Subnetting, routing, access control lists, packet analysis in Wireshark. Lab topologies built and hardened rather than read about.
Every engagement documented — method, evidence, remediation. The technical work is half the job; explaining it is the other half.
Everything below was built, exploited, or broken in my own lab. Newest first.
This site. Static Astro build on Cloudflare Workers, with a content-security policy generated from build-time script hashes.
Handheld Linux terminal. Solved a persistent audio fault with a GPIO-switched MOSFET circuit so the speaker only powers on demand.
Portable terminal running a CM5 with SDR and LoRa hats. Fixed charging via a PMIC udev rule; still tracing a device-tree conflict on boot.
Mapped a lab network from an unrooted Android handset — six live hosts discovered and services enumerated, then documented where the platform hits its ceiling.
Local language model running in an LXC container against a separate inference backend, with no data leaving the lab network.
ESP32 display board pulling live CPU, memory, disk and network stats from the Proxmox API over a scoped token, cycling nodes on a button press.
Complete chain against a deliberately vulnerable app: union-based injection, credential hash dump, offline cracking, upload to reverse shell, then privilege escalation enumeration.
Custom firmware on a cheap display board, wired to sub-GHz, NFC and infrared modules for RF signal capture and analysis.
Migrated a three-node cluster onto its own isolated network so exploitation work can't touch anything I rely on. Separate router, separate subnet, no bridge.
Stood up a rogue access point against my own network and captured test credentials through a captive portal, then documented the detection signals that give it away.
Full wireless workflow on my own access points — monitor mode, deauthentication, handshake capture, GPU-accelerated cracking against a wordlist.
Custom Android ROM with root and a mobile pentesting environment. Established the internal chipset can't do monitor mode and specified the adapter needed for injection.
Portable Raspberry Pi 5 field unit — UPS hat, 18650 cells, touchscreen, compact keyboard, battery telemetry over I2C, running a full offensive Linux distribution.
Hiring, collaborating, or just want to talk about a build — send it through. I read everything.