|
Independent Active Directory & Internal Infrastructure Penetration Tester
Real adversaries rarely rely on zero-days once inside an enterprise network—they chain misconfigured Active Directory DACLs, AD CS certificate templates, Kerberos delegations, and authentication coercion paths. I identify and validate realistic attack paths from initial internal foothold to Tier-0 domain dominance, delivering clear findings and production-safe remediation guidance.
Available for direct enterprise Active Directory assessments and specialized white-label subcontracting for offensive security consultancies worldwide.
Assessment Capabilities
01 // Active Directory & AD CS Auditing
In-depth offensive auditing of Enterprise PKI (ESC1–ESC16, orphaned certificate templates, enrollment relays), Kerberos delegations (Unconstrained, KCD, RBCD, Shadow Credentials), dangerous DACL edges, GPO abuse, and cross-forest trust boundaries.
02 // Internal Network & Assumed Breach
Full lateral movement validation across 100–500+ endpoint environments. Authentication coercion & NTLM relaying, SMB/LDAP signing enforcement checks, LAPS/gMSA credential exposure, network segmentation verification, and infrastructure service pivoting.
03 // Subcontracting for Consultancies
Reliable, senior Active Directory & internal testing capacity for pentest firms and MSSPs. Seamless white-label execution aligned with your rules of engagement, testing infrastructure, and client reporting standards.
04 // Actionable Remediation & Debriefs
Zero automated scanner dumps. Every engagement delivers validated attack-path narratives, executive risk summaries, and live technical debriefs to help infrastructure teams fix root-cause identity flaws without disrupting production.
Featured Research & Tooling
nxc-adcs-orphans — NetExec AD CS Hygiene & Orphan Template Detector
Open-Source Tool & ResearchEnterprise CAs can continue publishing certificate-template references in Active Directory even
after the underlying pKICertificateTemplate object is deleted.
When combined with delegated PKI write permissions, attackers can recreate missing template
objects that an Enterprise CA is already configured to issue.
nxc ldap <DC_IP> -u <USERNAME> -p '<PASSWORD>' -M adcs_orphansCertifications & Credentials
HTB CAPE
2026Certified Active Directory Pentesting Expert (HackTheBox)
Advanced enterprise Active Directory exploitation, AD CS abuse, Kerberos delegations, trust boundaries, and defense evasion.
Verify credential (opens in a new tab)OSCP
2024Offensive Security Certified Professional (OffSec)
Hands-on network penetration testing, internal pivoting, privilege escalation, and Active Directory domain compromise.
Verify credential (opens in a new tab)Completed Enterprise Pro Labs
- Alchemy(opens in a new tab) · Hack The Box · 2025
- Dante(opens in a new tab) · Hack The Box · 2024
Engagement Track Record & Experience
- > Freelance Internal Penetration Tester @ Independent Security Consultant (January 2026 – Present)
Delivering Active Directory and internal network penetration tests for enterprise environments comprising approximately 200–300 endpoints and 400–500 users, both directly and as a specialized subcontractor for cybersecurity consultancies. Worldwide, remote engagements.
Key Responsibilities & Achievements:
- Privilege Escalation & Lateral Movement: Identified and validated complex attack paths from initial internal access to Domain & Enterprise Administrator privileges.
- Internal Infrastructure Assessment: Assessed network segmentation, trust boundaries, AD CS configurations, exposed services, insecure protocols, and authentication weaknesses across authorized environments.
- Network & Device Exploitation: Leveraged misconfigured printers, switches, and network appliances to harvest credentials, bypass segmentation, and establish internal footholds.
- Reporting & Remediation: Produced executive summaries and detailed technical reports with validated findings and attack-path evidence, business impact, and prioritized remediation recommendations.
- Stakeholder Debriefing: Delivered remote and onsite technical debriefs to security and infrastructure teams, supporting remediation planning and risk reduction.
- > Cybersecurity Engineer @ Osmium Solutions (August 2024 – January 2026)
Secured aerospace and automotive systems through Linux hardening, threat modeling, and offensive assessments within a five-person team supporting EU and ESA-related projects. Remote role across Spain and Italy.
Key Technical Achievements:
- System Hardening: Mitigated boot-level attack paths through kernel hardening and SELinux restrictions.
- Security-Control Coverage: Improved coverage to 80% against ANSSI and 86% against NIST across the assessed core controls.
- Offensive Assessments: Conducted security assessments of aerospace embedded systems, identifying exploitable attack paths.
- Technical Reporting: Documented findings and remediation recommendations for security and engineering stakeholders.
- > Cybersecurity Researcher @ Instituto de Telecomunicações (October 2021 – December 2023)
Analyzed decentralized P2P energy-trading platforms and gRPC-based IoT infrastructure for consensus, cryptographic, and network-layer weaknesses. Based in Aveiro, Portugal.
Key Technical Achievements:
- Threat Modeling: Assessed distributed systems to identify critical attack paths, exploitation scenarios, and asynchronous abuse cases.
- Protocol & Smart Contract Auditing: Audited distributed ledger protocols for transaction-manipulation risks and contributed upstream security fixes to the Hedera JavaScript SDK.
Education
- > Master's Degree in Cybersecurity (2021–2023)
University of Aveiro
- > Bachelor's Degree in Computer Engineering (2018–2021)
University of Aveiro
Ready to audit your Active Directory attack paths?
Whether you need a standalone internal network pentest or a specialized AD contractor for an upcoming client engagement, let's scope your requirements.