Professional-style penetration test reports written by Sohaib Gamal Elsayed — Penetration Tester specializing in web application & Active Directory security.
Every report follows a real engagement structure — executive summary → attack-path diagram → step-by-step exploitation with evidence → impact → remediation — rather than a bare "do this, then that" walkthrough. The goal is to show not only that a box was solved, but how the finding would be communicated to a client.
⚠️ Authorized testing only. All work was performed against intentionally vulnerable lab environments (TryHackMe). Techniques are documented for education and authorized security assessments. Do not use them against systems you do not own or have explicit written permission to test.
- Role: Security QA Engineer & Penetration Tester — Web, API & Business-Logic Security
- TryHackMe: tryhackme.com/p/sohaeb — Top 2% globally · 164 rooms · Level 12 (Sapphire)
- Certs / Training: TryHackMe Jr Penetration Tester · CompTIA Security+ (training completed, exam in preparation)
- 🔧 Custom tooling: pentest-tools
- 📚 Study notes (Arabic): pentest-notes
- 💼 Profile: github.com/sohaebgamal · LinkedIn
| Report | Key techniques | Result |
|---|---|---|
| Operation Endgame · 🧰 tooling | guest SMB + RID brute → Kerberoast/AS-REP → password spray → GenericWrite on AD$ → RBCD → S4U2Proxy impersonate Administrator → Pass-the-Ticket |
🔴 Full domain compromise (DA) |
| Attacktive Directory | SMB null session + RID cycling → Kerbrute user enum → AS-REP roast → hashcat → SMB share loot → DCSync → Pass-the-Hash | 🔴 Full domain compromise (DA) |
| Dead Drop | SQLi auth bypass → Node require() RCE → leaked creds → APK hardcoded domain creds → AD ACL abuse (nested Domain Admins) |
🔴 Full domain compromise (DA) |
| Silent Monitor | SQLi + command injection → SSH creds → crack KDBX4 KeePass vault → root | 🔴 Root |
| Operation Promotion | Full-scope web → network → host chain | 🔴 Root (all flags) |
| Intro to AD Breaching | Kerbrute user enum, password spraying, LLMNR/responder, service-account creds | ✅ 100% |
| AD: Basic Enumeration | SMB/LDAP/RPC enum, null sessions, credential spraying | ✅ 100% |
| AD: Authenticated Enumeration | BloodHound, AS-REP roasting, group/ACL mapping from a low-priv account | ✅ 100% |
| Intro to AD Lateral Movement | PsExec / WinRM, Pass-the-Hash, local-admin reuse, SOCKS pivot to DC | ✅ 5/5 flags |
| Intro to Credential Harvesting | LSASS/SAM/LSA secrets, secretsdump, DCSync | ✅ 100% |
| Proxy — Constrained Delegation | Kerberos S4U2Self / constrained delegation abuse → DA | ✅ Solved |
| Forward | AD enumeration & exploitation walkthrough | ✅ Solved |
| Report | Key techniques | Result |
|---|---|---|
| Jump | Anonymous FTP recon → PATH hijack → sudo deploy.sh → sudo less privesc |
✅ Root — 5/5 flags |
| Tomcat CVE-2024-50379 | TOCTOU race-condition RCE on Apache Tomcat 10.1.x → reverse shell | 🔴 RCE |
| Report | Key techniques | Result |
|---|---|---|
| LLM Pentesting | Prompt injection, agent abuse via error-induction / IT-support framing → backend pivot | ✅ Solved |
| Cloud Security Fundamentals | SSRF → IMDS credential theft → role assumption → prod secrets | ✅ Solved |
| Report | Focus |
|---|---|
| Planning & Scoping | Authorization, RoE, scoping, PTES / NIST SP 800-115 / OSSTMM |
| Writing Pentest Reports | Report structure, business impact, remediation writing |
| Re-Testing | Remediation verification & report addenda |
Engagements are mapped to the OWASP Top 10 and the Cyber Kill Chain:
Recon → Weaponization → Delivery → Exploitation → Installation → C2 → Actions on Objectives
Typical toolchain: nmap · ffuf/gobuster · Burp Suite · sqlmap · Metasploit · BloodHound/SharpHound · Impacket · CrackMapExec/NetExec · hashcat/john · custom Python tooling.
Maintained by Sohaib Gamal Elsayed · sebeko.1996@gmail.com
License: CC BY 4.0. Reuse with attribution. For authorized security testing and education only.