web & api
Authentication, access control, injection, and the business logic nobody wrote down.
offensive security · vulnerability research · exploit development
I’m an offensive security operator and infrastructure hacker. I break into systems on paper first, then for real, then write down exactly how — so somebody can close the hole.
Penetration testing, vulnerability research, red team tooling, and the unglamorous hardening work that stops the next one. Everything reproducible. Nothing decorative.
Authentication, access control, injection, and the business logic nobody wrote down.
Network, directory, containers and cloud. The path that runs through the boring bits.
Initial access through objective, with the detection gaps mapped on the way out.
Source review and fuzzing. A proof of concept, or it didn’t happen.
nftables, systemd, auditd, least privilege. The half of the job that stays up.
Disposable targets and reproducible builds, so a result can be re-run and re-proven.
Everything runs on my own iron: Ubuntu, Docker, Tailscale. Targets are KVM guests on segregated libvirt networks with default-deny egress, snapshotted before every run.
The lab gets rebuilt, not repaired. A target that has been touched once is a target that lies.
githubgithub.com/Apol1o-DevOps
emailangeldevz0@proton.me