WebApp Exploit Lab
Built a vulnerable e-commerce app in a local lab and documented exploit chain + hardening checklist.
Hello! I am a Computer Science student pursuing a career in offensive cyber security. (Most of the data listed below on this website is simply mock data to fill out in the future).
Breaking things (safely), then learning how to fix them.
About Me
Who am I?
I am a computer science student focused on penetration testing and red teaming. I like building VM Labs, and expoiting them in different ways. I am also capable of scripting in multiple computing languages, including Python, Bash, PowerShell, JavaScript, Ruby, and SQL.
Education & Training
- DIP Computer Science - Expected 2025
- TryHackMe - Jnr. Penetration Tester 2025
- CompTIA - PenTester+, Red Team Pro 2024
Skills
Offensive Skills
- Penetration Testing
- Red Teaming
- Vulnerability Assessment
- Exploit Development
Scripting Languages
- Python
- Bash
- PowerShell
- JavaScript
- Ruby
- SQL
Tools
- Burp Suite
- Metasploit
- Nmap
- Wireshark
- OWASP ZAP
Reporting Skills
- Technical Writing
- Documentation
- Presentation Skills
Soft Skills
- Team Collaboration
- Problem Solving
- Adaptability
- Time Management
Operating Systems
- Linux (Kali, Ubuntu)
- Windows
- macOS
Projects
GraphQL Checkout Exploit
Built a vulnerable GraphQL checkout API and exploited introspection/injection/mutation.
Kerberoast to Domain Admin
Exploited Kerberos authentication to obtain service tickets and escalate privileges to Domain Admin.
Smart Camera Firmware Backdoor
Extracted and reverse-engineered camera firmware to find an unauthenticated telnet/debug backdoor and PoC remote control; includes firmware hardening steps.
EternalBlue Exploit
Developed a proof-of-concept exploit for the EternalBlue vulnerability in SMBv1, allowing for remote code execution on vulnerable Windows machines.
SSTI Template RCE
Exploited a server-side template injection vulnerability to achieve remote code execution.
Zigbee Replay Door Unlock
Conducted a replay attack on a Zigbee-enabled door lock to unlock it without authorization.
Privileged Helm Host Escape
Exploited a misconfigured Helm chart to escalate privileges within a Kubernetes cluster.
NTLM Relay
Relayed captured NTLM auth to an AD CS enrollment service to obtain a forged machine certificate and gain domain access.
MQTT Broker Takeover
Gained unauthorized access to an MQTT broker and manipulated IoT devices connected to it.
Azure SAS Token Misissue
Exploited a misconfigured Azure Storage account to obtain a SAS token with elevated privileges.
SQL Product Search
Conducted a SQL injection attack to extract sensitive product information from the database.
Contact Me
Get in Touch!
Feel free to reach out for collaborations, inquiries, or just to say hello!
Contact Information
- Email: bryanheuir@gmail.com
- LinkedIn: linkedin.com/in/bryanheuir
- GitHub: github.com/14thMember
- Location: Sydney, Australia