Nobex Wahengbam — PJPT-certified penetration tester specialising in Active Directory exploitation, web application security, and red team operations. 17 AD attack techniques and 32 web vulnerability findings — full documentation with MITRE ATT&CK mapping and OWASP Top 10 coverage.
$ ▋
I'm Nobex Wahengbam — a PJPT-certified penetration tester specialising in offensive security and Active Directory exploitation. My background in enterprise IT gives me a real-world understanding of the environments I attack — the same AD structures, GPOs, and remote access configurations found in corporate networks.
My Active Directory home lab (BATMAN.local) is a fully virtualized Windows domain environment where I've executed 17 distinct attack techniques — from LLMNR poisoning and SMB relay through Kerberoasting, credential dumping, Golden Ticket persistence, and critical CVE exploitation — every step mapped to MITRE ATT&CK.
I've also built a comprehensive web application VAPT lab documenting 32 vulnerability findings across OWASP Top 10, covering SQL injection, XSS, authentication bypasses, and API security — tested against DVWA and PortSwigger Web Security Academy with full Burp Suite evidence and CVSS scoring.
Beyond these labs, I sharpen offensive skills through machine walkthroughs on HackTheBox and TCM Security platforms and CTF competitions, documenting each with full methodology, exploitation steps, and vulnerability analysis.
A fully virtualized Windows domain environment (BATMAN.local) built to simulate real-world enterprise attack and defence scenarios. Documents 17 attack techniques end-to-end — from LLMNR poisoning and SMB relay through Kerberoasting, token impersonation, Mimikatz, Golden Tickets, and critical CVE exploitation — each paired with MITRE ATT&CK mapping and defender mitigations.
View on GitHub →Comprehensive web application penetration testing lab covering 32 real-world vulnerabilities across OWASP Top 10. Documented findings from DVWA and PortSwigger Web Security Academy — including SQL injection, XSS variants, command injection, authentication bypasses, and API security flaws. Each finding includes complete exploitation methodology, CVSS scoring, Burp Suite evidence, and enterprise-grade remediation recommendations.
View on GitHub →A fully isolated Windows domain environment for hands-on security research. Every technique is documented with tooling, attack chain analysis, and MITRE ATT&CK mapping — each followed by concrete detection and mitigation recommendations.
Comprehensive web application penetration testing lab covering 32 real-world vulnerabilities across OWASP Top 10. Each finding documented with complete exploitation methodology, Burp Suite evidence, CVSS scoring, and enterprise-grade remediation recommendations.
Hands-on, practical penetration testing certification covering network attacks, Active Directory exploitation, and report writing — assessed via a real-world 24-hour pentest exam.
Verify Certificate →Hands-on bug bounty methodology covering web application vulnerabilities, recon techniques, and responsible disclosure — practical focus on real-world target assessment.
Python scripting fundamentals applied to offensive security — covering tool development, automation, socket programming, and building custom attack scripts.
Broken session-management and authorization flaw — client-supplied cookie trusted as the user's role, allowing authentication bypass and escalation to the protected "inside" state.
View on GitHub →Methodology-driven pentest from reconnaissance to root compromise. Covers enumeration, web exploitation, privilege escalation, vulnerability assessment, and mitigation strategies.
View on GitHub →Full attack chain from Jenkins credential compromise to SYSTEM via Groovy RCE and Unquoted Service Path privilege escalation. Includes detection opportunities and mitigations.
View on GitHub →Complete attack chain from recon and enumeration through exploitation, privilege escalation, and root compromise — with vulnerability assessment and security lessons.
View on GitHub →Detailed penetration testing lifecycle walkthrough covering the Academy VulnHub machine — recon, exploitation, privilege escalation to root with remediation recommendations.
View on GitHub →Methodology-driven walkthrough focusing on SMB and mod_ssl attack surfaces, adapting from failed Meterpreter sessions to a successful reverse shell — demonstrating adaptive enumeration.
View on GitHub →Open to Penetration Testing and Red Team roles in Mumbai. Also available for collaborations, security research, and conversations about offensive security.