// certification
CPTS
Certified Penetration Testing Specialist. A full pentest exam covering enterprise networks, multi-host AD attack chains, web apps, and pivoting through segmented networks.
PassedMar 2026
改善
0xSEAN
Offensive Security Practitioner
Permanently Online
0xsean@root $ ls -la ./links
the forge
0xsean@root $ cat ./about.md
About Sean
Hey, I'm Sean.
I'm an offensive security practitioner with 2 years of hands-on experience, in labs and on real engagements. Most of my work is testing enterprise networks (Linux, Windows, and Active Directory) and web apps, then writing up what I found and how to fix it.
Web App
Active Directory
Reporting
Red-Team Tooling
0xsean@root $ ls ./achievements
// certification
PNPT
Practical Network Penetration Tester. External and internal AD engagements: OSINT, password spraying, offline cracking, and a client debrief at the end.
EarnedOct 2025
// certification
eJPT
eLearnSecurity Junior Penetration Tester. Host exploitation on Linux and Windows, plus Metasploit post-exploitation.
EarnedSep 2024
// open source
GitHub
Recon scripts, exploit PoCs, and CTF tooling I've put together while learning.
7public repos
// platform
HackTheBox
Where I root machines, from web apps to full enterprise networks.
Master37 machines
// writing
Box Writeups & Notes
Walkthroughs of retired machines, plus a cheatsheet of the techniques I keep reusing.
25 writeupspublished
the workshop
0xsean@root $ ls ./projects
Things I've Built
// project · python
AI Social Content Generator
A Telegram bot that helps Instagram creators write content in their own voice. It pulls a creator's existing posts with Apify, works out how they write, then uses Claude to suggest topics, headlines, and full carousel and reel scripts. Each step is editable before you move on. It runs async so it can handle several chats at once, caches to disk so a restart doesn't lose state, and runs on a VPS under systemd.
// home lab
Active Directory Attack Lab
A small self-hosted domain (one DC and two joined workstations) where I practice internal network attacks: LLMNR and NBT-NS poisoning with Responder, SMB relay, Kerberoasting, credential dumping, lateral movement, and password spraying.
3-node domainResponderNTLM RelayBloodHound