KingdomFall — Full AD Compromise Chain
End-to-end Active Directory lab simulating a real enterprise environment. Covers initial foothold, lateral movement, Kerberoasting, DCSync, and full domain takeover.
whoami --verbose
Ethical Hacker | Active Directory Specialist
I break into networks — legally. Specialised in Active Directory attack paths, Kerberos abuse, and enterprise red team operations. I find the cracks in your kingdom before the adversary does.
From
to the world!
My path to offensive security wasn't a straight line: I studied business in the UK, worked in a bank in Barcelona, and even ran a restaurant in the fjords of Norway. None of it fully clicked. Something was always missing.
That “something” was the same spark I had since I was a kid: the obsession with understanding how systems break, how people think, and how attackers exploit both.
That spark eventually won.
I moved into fraud investigation in Bournemouth, trained in ethical hacking and red‑team operations, and built the career I always wanted — helping organisations defend themselves by thinking like the adversary.
Today, I’m a pentester with a global background, a hacker’s mindset, and a very simple mission:
find the weaknesses before someone else does.
End-to-end Active Directory lab simulating a real enterprise environment. Covers initial foothold, lateral movement, Kerberoasting, DCSync, and full domain takeover.
Custom Python tool that automates SPN enumeration, ticket extraction, and offline cracking pipeline. Integrates with CrackMapExec for seamless red team workflows.
A curated library of 40+ custom Cypher queries for BloodHound, targeting high-value attack paths often missed by default queries. Published on GitHub with 500+ stars.
Achieved Pro Hacker rank on HackTheBox with 30+ machines rooted, specialising in Windows/AD-focused boxes. Write-ups published for retired machines.
Comprehensive AD security audit for a 2,000-user enterprise. Identified 14 critical misconfigurations including unconstrained delegation and ACL abuse paths.
Designed and deployed a covert C2 infrastructure using Cobalt Strike with domain fronting, malleable profiles, and redirectors to evade EDR and network monitoring.






// social & platforms